Legal
Privacy notice
This notice explains what personal data Luke Mallett Consulting Ltd collects through this website and in the course of its work, why, who helps us process it, how long we keep it, and what you can ask us to do with it. We collect what we need to do the work, we keep it secure, and we never sell it.
1. Who we are
Luke Mallett Consulting Ltd is the controller of the personal data described here. Company number 15130094, registered in England and Wales. Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF. We trade as Luke Mallett Consulting and Luke Mallett Consulting Associates, and the practice works from London and Paris.
We handle personal data under the UK General Data Protection Regulation and the Data Protection Act 2018 and, for people in the European Union, the EU General Data Protection Regulation.
For anything about your data, write to Luke Mallett, Principal, at Luke@lukemallettconsulting.com, or by post to the registered office.
2. What we collect, why, and for how long
We collect only what you choose to give us, and the basic technical data any website receives.
| Where it comes from | What we collect | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Booking a conversation through Calendly | Name, email, and any notes you add to the booking | To arrange and hold the conversation you booked | Steps you ask us to take before a contract; legitimate interests | 24 months from the conversation, then deleted unless we are working together |
| Email, phone and LinkedIn messages | Whatever you choose to send us | To reply, and to keep a record of our correspondence | Legitimate interests | 24 months from your last contact, or for the client record period below if we work together |
| Client engagements | Contact details of the people we work with, and any personal data contained in the work itself | To deliver, invoice and account for the engagement | Contract; legal obligation for financial and tax records | Six years after the engagement ends, the period UK company and tax law sets for financial records |
| Visiting this website | IP address, browser type, the pages requested and the time of each request, logged by our hosting provider | To deliver the site and protect it from misuse | Legitimate interests | Kept by our hosting provider under its own retention schedule. We do not use it to identify you |
Where a client asks us to handle personal data on its behalf during an engagement, the data processing terms agreed for that engagement govern instead, including return or deletion of the data when the work ends.
Please keep health or other sensitive information out of the forms and booking notes. If an engagement involves it, we will agree how it is handled before any is shared.
3. Who processes it for us
We use a small number of service providers, each bound by contract to use your data only to provide their service to us:
- Netlify, which hosts this website.
- Microsoft, whose Microsoft 365 services carry our email and files.
- Notion, where we keep our record of enquiries and engagements.
- Calendly, which runs our booking calendar.
- Google Fonts, which supplies the typefaces on this site and receives your IP address in doing so.
Where an Associate of the practice works with us on an engagement, they see only the data that work requires, under confidentiality terms. We share personal data with nobody else unless the law requires it, and we never sell it, rent it or use it for advertising.
4. Transfers outside the UK
Several of the providers above are based in the United States, and the practice works from London and Paris. Where personal data leaves the UK or the European Economic Area, we rely on adequacy decisions (including those between the UK and the European Economic Area), on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or on standard contractual clauses with the UK International Data Transfer Addendum. You can ask us for a copy of the safeguard that applies.
5. How we keep it secure
This site is served over HTTPS only, with strict transport security and a content security policy that limits which services the pages can connect to. Data you send through the site is encrypted in transit. Access to our records is limited to the people who need it for the work. If a breach put your rights at risk, we would tell you and the regulator as the law requires.
6. Cookies
This site sets no cookies and runs no analytics or advertising trackers. The booking link opens Calendly’s own site, which sets cookies under its own cookie notice.
7. Your rights
You can ask us to:
- tell you what personal data we hold about you, and send you a copy;
- correct it;
- delete it;
- restrict how we use it, or object to our using it, including at any time to any direct marketing;
- send it to you or another organisation in a portable format, where you gave it to us and we use it on the basis of consent or contract;
- stop using it where you gave consent, without affecting anything we did before you withdrew it.
Write to Luke@lukemallettconsulting.com. We will reply within one month, as the law requires, and we will act on a request to delete within five working days of confirming who you are.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or, if you live in the European Union, to your national regulator; in France that is the Commission nationale de l’informatique et des libertés at cnil.fr.
8. Children
Our work is with organisations and their leaders, and this site is meant for adults. We do not knowingly collect personal data from anyone under 18.
9. Terms of use
The content on this site is provided for information. Any work we undertake is governed by a separate written agreement, and nothing on the site forms part of one.
10. Accessibility
We aim to meet WCAG 2.1 AA across the site. If you find an accessibility problem, write to Luke@lukemallettconsulting.com and we will fix it.
11. Changes to this notice
We update this notice when what we collect, or how we use it, changes, and we change the date at the top when we do.