Privacy Policy
Nalgo Consulting Ltd · Last updated: 14 June 2026
Nalgo Consulting Ltd (“Nalgo”, “we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. This policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over it.
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.
1. Who we are
Nalgo Consulting Ltd is a company registered in England and Wales.
We are the data controller for the personal data described in this policy, which means we are responsible for deciding how and why your data is used.
We have not appointed a statutory Data Protection Officer, as we are not required to. For any data-protection question, contact us at hello@nalgo.co.uk.
2. What this policy covers
This policy applies to personal data we collect:
- through our website,
- when you contact us by form, email, phone or social media,
- when you sign up to receive updates or other communications from us, and
- in the course of providing our consultancy services to clients.
It does not cover third-party websites we link to, which have their own policies.
3. The personal data we collect
Information you give us directly
- Identity and contact details: your name, email address, phone number, job title and the organisation you work for.
- The content of your enquiry or correspondence with us.
- Assessment submissions: if you choose to have your results emailed to you from one of our online assessments (such as the AI governance, EU AI Act or AI readiness checks), the name, email address and organisation you provide, together with your answers and the results. We retain these so we can send your report and, where you have consented, follow up about relevant services.
- Information you provide in the course of a consultancy engagement.
Information we collect automatically when you use our website
- Technical data: IP address, browser type and version, device information, and similar.
- Usage data: the pages you visit, links you click, and how you move through the site, collected through server logs, cookies and analytics (see Section 5).
Information we receive from third parties
Where applicable, we may receive data from referrals, publicly available professional sources such as LinkedIn or company websites, or our analytics providers.
We do not knowingly collect any special category data (such as health, religion or political views). Please do not send us such data unless we have specifically asked for it in the context of an engagement.
4. How we use your data, and our lawful basis
Under UK GDPR we must have a lawful basis for using your personal data. We rely on the following:
| What we use it for | Lawful basis |
|---|---|
| Responding to your enquiry and discussing potential work | Legitimate interests; steps prior to entering a contract |
| Providing our consultancy services and managing the engagement | Performance of a contract |
| Sending you information or updates you have asked for | Consent |
| Sending you marketing about our services | Consent, or legitimate interests where permitted |
| Operating, securing and improving our website | Legitimate interests; consent for non-essential cookies |
| Meeting our legal, accounting and tax obligations | Legal obligation |
Where we rely on legitimate interests, our interest is in running and growing our business, communicating with prospective and existing clients, and keeping our systems secure. We balance this against your rights, and you can object at any time (see Section 10).
Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
5. Cookies and analytics
Our website uses essential cookies required for the site to function and analytics provided by Google, to understand how the site is used.
Following changes under the Data (Use and Access) Act 2025, certain low-risk analytics and functionality cookies may be used without prior opt-in consent, but we will always tell you clearly what we use and give you a straightforward way to opt out.
You can also control cookies through your browser settings. Blocking essential cookies may stop parts of the site working.
6. Who we share your data with
We do not sell your personal data. We share it only where necessary, with:
-
Service providers (processors) who help us run our business, under
contracts that require them to protect your data, for example:
- Website hosting: Cloudflare
- Email and communications: Google
- Our professional advisers, such as accountants and lawyers, where needed.
- Authorities or regulators, where we are legally required to disclose data.
7. International transfers
Some of our service providers may store or process data outside the UK, for example in the United States or EU.
Where data is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK law: UK adequacy regulations for the country concerned, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.
8. How long we keep your data
We keep personal data only as long as we need it for the purpose we collected it, including to meet any legal, accounting or reporting requirements.
- Enquiries that don’t become engagements: up to 12 months.
- Client and financial records: retained for at least 6 years to meet UK tax and accounting obligations.
- Marketing data: until you unsubscribe or ask us to stop.
When we no longer need your data, we securely delete or anonymise it.
9. How we protect your data
We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including access controls, encryption in transit, reputable service providers, and limiting access to those who need it. No system is completely secure, but we work to keep your data safe and will notify you and the regulator of any breach where we are required to.
10. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data (“right to be forgotten”), in certain circumstances.
- Restrict how we use your data, in certain circumstances.
- Object to processing based on legitimate interests, and to direct marketing.
- Portability: receive certain data in a portable format.
- Withdraw consent at any time, where we rely on consent.
To exercise any of these rights, contact us at hello@nalgo.co.uk. We will respond within one month. There is normally no charge, and we may ask you to verify your identity first.
11. How to complain
If you are unhappy with how we have handled your personal data, please contact us first at hello@nalgo.co.uk so we can try to put it right. We will acknowledge your complaint within 30 days and keep you informed of the outcome.
If you are still not satisfied, you have the right to complain to the UK’s data protection regulator:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
12. Marketing
We will only send you marketing communications where you have agreed to receive them, or where we are otherwise permitted to. You can opt out at any time using the unsubscribe link in our emails or by contacting us, and we will stop.
13. Children
Our website and services are intended for businesses and professional users. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with data, contact us and we will delete it.
14. Third-party links
Our website may link to third-party sites. We are not responsible for their content or privacy practices, and we encourage you to read their privacy policies.
15. Changes to this policy
We may update this policy from time to time. The current version is always shown on this page, with the “Last updated” date at the top. Material changes will be made clear.
16. Contact us
For any question about this policy or your personal data:
Nalgo Consulting Ltd
hello@nalgo.co.uk