This notice explains, in plain English, what personal data we collect, why we use it, how long we keep it, and the rights you have under UK data-protection law. We're a small consultancy and we keep our data practices deliberately narrow.
1. Who we are
Altaworks LTD ("Altaworks", "we", "us", "our") is a private limited company incorporated in England & Wales (company number 13171255, VAT registration 388659521) with its registered office at 124 City Road, London, EC1V 2NX.
We are the data controller for the personal data described in this notice in respect of our own website, enquiries we receive, our suppliers, and our marketing activities. Where we process personal data on behalf of a client during an engagement, we typically do so as a data processor under the terms of that client's contract and data-processing agreement — see §3 below.
Questions about this notice or our data practices? info@altaworks.co.uk.
2. What we collect
2.1 Information you give us
- Enquiry details. When you complete our contact form or email us directly: your name, work email address, the company you represent (where you provide it), and the content of your message.
- Engagement information. If we go on to work together, the contractual contact details of the people in your organisation who we coordinate with — name, work email, job title, telephone where appropriate.
- Mailing list. If at any point we introduce a newsletter and you sign up, your email address and any preferences you tell us about.
2.2 Information we collect automatically
- Hosting and security logs. Our hosting provider, Cloudflare, automatically processes basic technical information for each request — IP address, browser and device characteristics, the page requested, and a timestamp. This is used for site security, abuse prevention, and to keep the service available. We do not use it to build a profile of you.
- Strictly necessary cookies. Cloudflare may set a small number of strictly-necessary cookies (for example __cf_bm for bot management) that are essential to operate the site safely. See §8.
2.3 Information we receive from third parties
In limited circumstances we receive personal data from third parties — for example a colleague at your organisation introducing you, or business-network platforms such as LinkedIn where you have made your professional profile public. We treat any such data under this notice.
2.4 Special category data
We do not intentionally collect special-category personal data (such as health or biometric information) through this website. Please do not include such data in messages you send us.
3. Why and how we use it
We process personal data only where we have a lawful basis to do so under Article 6 of the UK GDPR. The table below shows the main purposes and the lawful basis we rely on for each.
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Replying to your enquiry and exploring potential work together. | Art. 6(1)(b) — steps prior to entering a contract; or Art. 6(1)(f) — legitimate interests (running our business). |
| Delivering services to clients under a contract, and managing the engagement. | Art. 6(1)(b) — performance of contract. Where we act as processor for a client we follow their documented instructions and the data-processing agreement that governs the engagement. |
| Maintaining business records (accounting, invoicing, tax, professional indemnity). | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interests. |
| Security, fraud and abuse prevention on this website. | Art. 6(1)(f) — legitimate interests (keeping the site safe and available). |
| Newsletter or marketing emails (only if/when we introduce them, and only to people who opt in). | Art. 6(1)(a) — consent. You can withdraw at any time using the unsubscribe link in any email or by writing to us. |
| Establishing, exercising or defending legal claims. | Art. 6(1)(f) — legitimate interests. |
4. Who we share it with
We share personal data only with a small set of carefully selected providers and advisers, and only where they need it to support our operations. We don't sell personal data and we don't share it for cross-context behavioural advertising.
- Hosting and infrastructure. Cloudflare, Inc. (web hosting and content delivery for this site).
- Productivity, email and storage. Enterprise SaaS providers used to run the business — for example for email, document storage, calendar and project management. Each is bound by a written data-processing agreement and our own due-diligence checks.
- Professional advisers. Our accountants, auditors, lawyers and insurers, where they need limited personal data to advise us.
- Clients. Where you contact us in connection with an existing or potential client engagement, we may share relevant correspondence with the client.
- Regulators and authorities. Where we are required to disclose personal data by law (for example to the Information Commissioner's Office, HMRC, or a court).
A current list of subprocessors used for any specific client engagement is available on request under the terms of the relevant data-processing agreement.
5. International transfers
Some of our suppliers are based outside the United Kingdom or the EEA, or process data in regions outside it. Where this happens we make sure an appropriate safeguard is in place under UK GDPR Articles 44–49 — typically:
- an adequacy decision recognised by the UK government for the destination country; or
- the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum; combined with our own due-diligence review of the recipient's technical and organisational measures.
You can request a summary of the safeguards we rely on for a specific transfer by writing to us at the address in §11.
6. How long we keep it
We keep personal data only for as long as we need it for the purpose for which we collected it, then we delete or irreversibly anonymise it. Our default retention periods are:
- Enquiries that don't lead to an engagement — up to 24 months from the last meaningful contact, then deleted.
- Engagement records — for the duration of the engagement, plus the period required by tax, accounting and professional-indemnity rules. This is typically six years from the end of the engagement.
- Mailing list — until you unsubscribe, or after 24 months of inactivity, whichever comes first.
- Server and security logs — typically up to 30 days, longer only where needed to investigate a suspected security incident.
- Statutory records (for example invoices) — the periods required by HMRC and Companies House, currently six years from the end of the relevant financial year.
7. Your rights
Under UK data-protection law you have a number of rights in relation to your personal data. These rights are not absolute and exceptions apply, but where they are available you can ask us to:
- Access the personal data we hold about you (Art. 15).
- Correct personal data that's inaccurate or incomplete (Art. 16).
- Erase your personal data in certain circumstances (Art. 17).
- Restrict our processing of your personal data in certain circumstances (Art. 18).
- Receive your personal data in a portable format (Art. 20).
- Object to processing we carry out on the basis of legitimate interests, including any direct marketing (Art. 21).
- Withdraw consent at any time, where we rely on consent — without affecting the lawfulness of processing done before withdrawal (Art. 7(3)).
- Not be subject to a solely automated decision with legal or similarly significant effects (Art. 22). We don't currently make any such decisions.
To exercise any of these rights, email info@altaworks.co.uk. We aim to respond within one month, and we will tell you if we need an extension or further information from you to identify your records.
8. Cookies and tracking
This website does not use third-party analytics, advertising or social-media tracking cookies. We do use a small number of strictly necessary technologies for the site to work safely:
- Cloudflare bot-management and security cookies (for example __cf_bm), which expire after a short session and help protect the site from automated abuse. These do not require consent under the UK Privacy and Electronic Communications Regulations (PECR).
- Browser-local preferences such as the prefers-reduced-motion setting, which we read at page load to disable animations. This is not stored by us.
If we introduce a privacy-friendly analytics tool in future (such as Plausible or a similar non-tracking analytics provider) we will update this notice and, where required by PECR, ask for your consent before any non-essential cookies are set.
9. Security
We apply administrative, technical and organisational measures appropriate to the personal data we process and the risks involved. These include:
- transport encryption on this website (HTTPS / TLS 1.2 or later) and a strict Content Security Policy;
- least-privilege access controls and multi-factor authentication on our internal systems;
- regular vendor due-diligence and contractual safeguards with our suppliers; and
- a documented incident-response process. Where a personal data breach is likely to result in a risk to your rights and freedoms we will notify the Information Commissioner's Office within 72 hours, and notify affected individuals where the risk is high, in line with UK GDPR Articles 33 and 34.
No method of transmission or storage is perfectly secure. If you believe an incident has occurred please tell us at info@altaworks.co.uk.
10. Changes to this notice
We may update this notice from time to time — for example when we change how we process data, when a supplier changes, or when the law changes. The date at the top shows when it was last updated. For material changes that affect people on our mailing list or active clients, we will let you know directly.
11. Contact and complaints
If you have a question, want to exercise a right, or want to tell us we've got something wrong, please contact us first — we'd rather hear from you and fix the issue:
- Email: info@altaworks.co.uk
- Post: Altaworks LTD, 124 City Road, London, EC1V 2NX, United Kingdom
You also have the right at any time to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF