Privacy Policy.
How we collect, use and protect personal information when you visit our website or get in touch, and the rights you have over it.
1. Who we are.
This website is operated by Euston Business Consulting Ltd (“EBC”, “we”, “us”, “our”), a company registered in England and Wales under company number [company number], with its registered office at [registered office address], London, United Kingdom.
We are the controller of the personal data described in this policy. This means we decide why and how it is processed and we are responsible for it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where they apply to you, the EU General Data Protection Regulation (EU GDPR) and other privacy laws.
This policy covers personal data collected through this website, our “Book a Call” enquiry form, and emails or calls with us that follow from it. When we deliver services to a client, how we handle data within that engagement is set out in our engagement terms with that client.
For any question about this policy or your data, email taalish.khan@eustonbusinessconsulting.com.
2. Information we collect.
Information you give us
- Enquiry form: your full name, email address, phone number and company (optional), the service you are interested in, your message, and your confirmation that we may contact you about the enquiry.
- Correspondence: anything you share when you email, call or meet us, such as your job title, business details and the context of your request.
Information collected automatically
- Enquiry metadata: the date and time you submitted the form, the page you sent it from, your browser type (user agent), and a one-way, keyed hash of your IP address. We use the hash only to block spam and repeated automated submissions; we do not store your IP address itself with your enquiry.
- Server and security logs: like most websites, our hosting provider automatically records technical information about requests to the site, such as IP address, date and time, pages requested and browser details, to keep the service secure and working.
We do not use analytics, advertising or social-media tracking tools on this website, and we do not knowingly collect special category data (for example health or religious information). Please do not include such information in your message.
3. How and why we use it.
Data protection law requires a lawful basis for each use of personal data. Ours are:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to your enquiry, arranging a call and discussing how we could work together | Enquiry form data, correspondence | Steps at your request before entering a contract (Art. 6(1)(b)) and our legitimate interests in responding to business enquiries (Art. 6(1)(f)) |
| Keeping a record of enquiries and managing our relationship with prospective and existing clients | Enquiry form data, correspondence | Legitimate interests in running and developing our business |
| Protecting the website and form from spam, fraud and abuse | IP hash, enquiry metadata, server logs | Legitimate interests in keeping our systems secure |
| Complying with legal obligations and establishing, exercising or defending legal claims | Any relevant data | Legal obligation (Art. 6(1)(c)) and legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights and you can object at any time (see your rights). We will only send you marketing emails if you have asked for them or where the law otherwise allows, and every such email will include a way to unsubscribe. We do not make decisions about you based solely on automated processing, including profiling.
4. Cookies and similar technologies.
Cookies are small files stored in your browser. This website only uses cookies and similar storage that are strictly necessary for it to work securely, so they do not require your consent under the UK Privacy and Electronic Communications Regulations (PECR) or the EU ePrivacy rules. We do not use analytics, advertising or tracking cookies.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| humans_* | Our hosting provider | Security check that distinguishes visitors from automated bots before pages load | Browser session |
| ebc_preloader_seen (session storage) | EBC | Remembers that you have already seen the opening animation, so it is not shown again on every page | Until you close the tab |
| ebc_enquiries, PHPSESSID | EBC | Keeps authorised staff signed in to the website’s administration area; not set for regular visitors | Browser session |
Fonts. To display our typefaces, your browser downloads fonts from Google Fonts, which means Google LLC receives your IP address and browser information as part of that request. Google’s handling of this data is described in the Google Privacy Policy.
You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site from working. If we ever introduce non-essential cookies, we will ask for your consent first and update this section.
5. Who we share it with.
We do not sell your personal data, and we do not share it for advertising. We share it only where needed with:
- Service providers who process it on our behalf and under our instructions, such as our website hosting provider, our web development and maintenance partner, and our email and IT providers. They are bound by contracts requiring them to keep it confidential and secure.
- Professional advisers such as lawyers, accountants and insurers, where necessary.
- Authorities, regulators or courts where we are legally required to, or to protect our rights, property or safety and those of others.
- A buyer or successor if our business, or part of it, is sold or reorganised, in which case your data would remain protected under this policy.
6. International transfers.
We are based in the United Kingdom. Some of our service providers, or their personnel, may be located outside the UK or the European Economic Area (EEA). When personal data is transferred to a country that does not have an adequacy decision, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses. You can contact us for more information about these safeguards.
7. How long we keep it.
- Enquiries and related correspondence: up to 24 months after our last contact with you, unless you become a client, in which case we keep it for as long as our relationship continues and then for the period required by law (typically up to 6 years after an engagement ends, for tax, accounting and legal reasons).
- Spam-protection records (hashed IP addresses used for rate limiting): deleted automatically within 24 hours.
- Server and security logs: kept by our hosting provider for a limited period for security purposes and then deleted.
You can ask us to delete your enquiry sooner at any time.
8. How we protect it.
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and hashed passwords for our administration area, spam and brute-force protection, and limiting access to people who need it. No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the relevant regulator of a personal data breach where the law requires us to.
9. Your rights.
Under UK and EU data protection law you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: ask us to delete your data in certain circumstances.
- Restriction: ask us to limit how we use your data in certain circumstances.
- Objection: object to processing based on our legitimate interests, and to direct marketing at any time.
- Data portability: receive data you provided to us in a structured, machine-readable format, or have it sent to another organisation, where technically feasible.
- Withdraw consent at any time where we rely on consent, without affecting processing carried out before you withdrew it.
To exercise any of these rights, email taalish.khan@eustonbusinessconsulting.com. We may need to verify your identity first. We will respond within one month, which can be extended by two further months for complex requests, and there is normally no fee.
If you are unhappy with how we have handled your data, please contact us first so we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. If you are in the EEA, you can complain to the data protection authority in the country where you live or work.
If you live elsewhere, you may have similar rights under your local law, such as Canada’s PIPEDA, Australia’s Privacy Act 1988 or India’s Digital Personal Data Protection Act 2023. Contact us and we will honour applicable requests.
10. Additional information for US residents.
If you are a resident of California or another US state with a comprehensive privacy law, the following applies in addition to the rest of this policy. In the past 12 months we have collected the categories of personal information described in section 2 (identifiers, professional information and internet activity information) from the sources and for the purposes described in sections 2 and 3, and disclosed them only to the categories of recipients in section 5.
- We do not sell personal information and do not share it for cross-context behavioural advertising. We do not knowingly sell or share the personal information of anyone under 16.
- We do not use or disclose sensitive personal information for purposes that would give you a right to limit its use.
- Subject to applicable law, you have the right to know what personal information we hold about you, and to request that we correct or delete it. You may use an authorised agent to make a request.
- We will not discriminate against you for exercising your privacy rights.
To make a request, email taalish.khan@eustonbusinessconsulting.com.
11. Children.
Our website and services are intended for businesses and adults. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we will delete it.
12. Changes to this policy.
We may update this policy from time to time, for example if the law or the way we use data changes. The “last updated” date at the top shows when it was last revised. Where changes are significant, we will take reasonable steps to let you know.
13. Contact us.
Euston Business Consulting Ltd
[registered office address], London, United Kingdom
Email: taalish.khan@eustonbusinessconsulting.com
See also our Terms & Conditions.