Privacy policy

Who we are

This website, sbpoconsulting.com, is operated by SBPO Consulting ("we", "us"). We are the data controller for personal data collected through this site.

Our registered company details are being finalised and will be published here and on the contact page. In the meantime, all privacy enquiries are handled through the contact routes below.

What we collect, and why

Information you send us

If you submit the enquiry form or email us, we receive whatever you choose to send: typically your name, email address, organisation and the content of your message. We use it for one purpose — to reply to you, and if we go on to work together, to deliver and administer that work. The lawful basis is legitimate interest before a contract exists, and performance of a contract once one does.

Please do not send confidential or commercially sensitive material in a first message. If you need to, ask us for a non-disclosure agreement first and we will arrange one.

Information collected automatically

This site currently runs no analytics and sets no tracking cookies. If that changes, this policy will be updated before the change goes live, and the cookie policy will describe exactly what is set.

Our hosting provider keeps standard server logs, which may include IP address, user agent and the URL requested. These exist for security and abuse prevention, are retained for a short period, and are not used to identify individuals.

Cookies and local storage

This site is deliberately built to work without tracking. We set no advertising cookies and no cross-site trackers. See the cookie policy for the full detail, including anything a third-party embed might set.

Who we share data with

We do not sell personal data, and we do not share it for advertising. We do use a small number of processors to run the business:

• Hosting and content delivery — to serve this website.
• Email — to receive and reply to your enquiry.
• Form processing — if the enquiry form is connected, to deliver submissions to our inbox.

Each is bound by a data processing agreement and may only act on our instructions. We will name the specific providers on request. We may also disclose data where we are legally required to, which has not happened to date.

International transfers

Some processors may store data outside your country. Where that happens we rely on the provider's standard contractual clauses or an equivalent transfer mechanism. If you would like to know where a specific piece of your data sits, ask and we will tell you.

How long we keep it

• Enquiries that do not become projects — up to 24 months, then deleted.
• Client project records — for the duration of the engagement and then for as long as we are required to retain them for tax and legal purposes.
• Server logs — a short rolling window set by our hosting provider.

Your rights

Depending on where you live, you may have the right to:

• ask what personal data we hold about you, and get a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we process it;
• receive your data in a portable format;
• withdraw consent where processing relies on it;
• complain to your data protection regulator.

To exercise any of these, use the contact page. We will respond within 30 days, and usually much sooner.

Security

This site is served over HTTPS. It is a static site with no user accounts and no database of personal information, which removes entire categories of risk by construction. Access to the inbox that receives enquiries is limited to the people who need it and protected by multi-factor authentication. If you believe you have found a security issue, please report it via our security.txt.

Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, tell us and we will delete it.

Changes to this policy

If we change how we handle personal data, we will update this page and change the "last reviewed" date at the top. Where a change is significant — new tracking, a new category of data, a new purpose — we will make that change before it takes effect, not after.