Legal

Privacy policy

What happens to personal information when you use this website: what is collected, why, who else can see it, and what you can require us to do about it.

In effect from Effective date — set at legal sign-off

Draft — legal review required

This policy has been drafted from what the website actually does. It has not been reviewed by a qualified adviser, and the clauses marked below depend on details Stage 3 has still to supply. It should not be published in this state.

Have the policy reviewed against the law that governs this website and the organisation behind it.
Fill every marked blank: legal entity, registered address, data protection contact, retention periods, named processors and jurisdiction.
Put a written processing agreement in place with each organisation that will handle this data before the site takes its first enquiry.

Who we are

Stage 3 Consulting decides what personal information this website collects and what happens to it afterwards. In data protection language that makes it the controller, and the party answerable for everything set out below. The details that identify it in law have still to be supplied.

Legal entity: Registered legal entity name
Registered address: Registered address
Data protection contact: Named contact, role and email for data protection

What this policy covers

It covers this website and the enquiry form on it. It does not cover personal information handled inside a client engagement — research respondents, recruitment records, or data a client passes to us to analyse. That work is governed by the contract signed for it, and for a research organisation it is the larger obligation of the two. It needs its own notice rather than a paragraph borrowed from this one.

Separate privacy notice for research respondents and client engagements

What we collect

Three different things, gathered in three different ways. They are worth separating, because you control the first, you cannot avoid the second, and the third does not involve us at all once the page has loaded.

What you send us

The enquiry form asks for your name, your organisation and a work email, all of which are required; a phone number, which is not; the capability your enquiry relates to; and the description of the challenge you type into the message field. Nothing else on this site asks you for anything.

Nothing here asks for financial details, identity documents or any special category of personal data, and none of it should be sent through the form.

What the server records

Serving a page produces a log entry, as it does on any website. That entry typically holds:

the IP address the request came from;
the date and time of the request;
the page or file requested, and the response the server gave;
the page that referred you, where your browser sends one;
the browser and operating system your browser reports.

These entries are a by-product of delivering the page rather than something added to observe you, and they are not used to build a profile.

What your browser sends elsewhere

The typefaces used on this site are loaded from Google's font service. Your browser fetches them directly from Google, which discloses your IP address and browser details to Google whether or not you do anything on the page. Hosting the same fonts on our own server would remove that disclosure entirely, and is a decision worth taking before launch.

Decision on self-hosting the typefaces

Why we use it

To answer your enquiry — to read what you sent, reply to it, and carry on the conversation you started.
To keep the site working — to diagnose errors, investigate abuse and keep the service available.
To meet obligations that apply to us — where a law or a regulator requires a record to be kept.

Two commitments belong here and should be confirmed rather than assumed: that enquiry details are used to answer the enquiry and not to build a marketing list, and that personal information collected through this site is never sold.

Confirm the no-marketing-list and no-sale commitments

Our lawful basis

The vocabulary below is the GDPR's, because it is the most demanding standard likely to be held against a site of this kind. Which regime actually governs it, and which authority a complaint would be made to, is the first question for legal review.

Governing law, jurisdiction and supervisory authority

Answering your enquiry — our legitimate interest in responding to someone who has contacted us, and steps taken at your request before entering into a contract.
Running and securing the site — our legitimate interest in keeping it available and free of abuse.
Analytics or any non-essential cookie — consent, asked for before anything is set and withdrawable afterwards.
Records we are required to keep — legal obligation, once it is established which obligations apply: Statutory record-keeping duties

The enquiry form

The form on the contact page is the only place on this site that collects anything you have typed, so it is worth being precise about what happens to a submission.

The submission is written to the site's own database before any email is sent, so that a failed delivery cannot lose an enquiry. That means two copies exist, and both are personal information.
The form carries one hidden field, positioned off-screen and out of the keyboard order. People never see it; automated scripts fill it in, and a submission that fills it is discarded. It records nothing about you.
Where the enquiry is delivered, and who is able to read it: Destination inbox and everyone with access to enquiries
Where the database that stores it sits: Hosting provider and country for the site database

Please keep commercially sensitive material out of the message field. A web form is a good way to start a conversation and a poor way to move confidential information. Say that there is something to discuss and we will arrange a route that suits it.

See the form before you use it

Cookies and analytics

As the site is built today it sets no cookies of its own. There is no account to sign into, nothing held in a basket and nothing that has to be remembered between one page and the next, so nothing is stored on your device by us and no consent banner is warranted.

That is a statement about the current build, not a permanent promise. The moment analytics, an embedded video, a chat widget or a login is added, this clause has to be rewritten and consent has to be asked for before any non-essential cookie is set. The font request described above is not a cookie, but it is still a disclosure, and it happens on every page load.

Confirm whether analytics will run at launch, and which product

Third parties and processors

Anyone who handles this data on our behalf has to be named here and has to be under a written agreement limiting what they may do with it. The list below is the shape of that disclosure; the names are outstanding.

Website and database hosting: Hosting provider and country
Delivery of enquiry email: Email or SMTP provider
Typeface delivery: Google, which receives your IP address and browser details when the fonts are fetched.
Analytics, if any is enabled: Analytics provider
Anyone else holding administrative access to the site or its data: Agencies or contractors with administrative access

No organisation should be added to that list without an agreement signed first, and the same applies to any that are already in place.

Signed data processing agreements for each named processor

How long we keep it

The principle is settled even though the periods are not: nothing is kept for longer than the purpose requires, and when the purpose ends the record is deleted or stripped of anything that identifies a person. Each of the following needs a stated period rather than an assurance.

Enquiry submissions, in the database and in the inbox: Retention period for enquiries
Server logs: Server log retention period
Backups: Backup retention and deletion cycle

Backups deserve the honesty most policies withhold. A record deleted from the live database survives in backups until that cycle turns over, and the deletion is only complete when it does.

Your rights over your information

Subject to the law that turns out to govern this site, you can ask us to:

give you a copy of the personal information we hold about you;
correct anything that is wrong or incomplete;
delete it, where there is no continuing reason to keep it;
restrict what we do with it while a question about it is resolved;
stop processing that rests on legitimate interests, where you object to it;
provide it in a portable form, or send it to another organisation;
act on a withdrawal of consent, which you can make at any time — it does not undo what was lawfully done before it.

We may need to establish who you are before acting on a request, and we will answer within the period the governing law allows. You are also entitled to complain to the supervisory authority rather than to us.

Requests to: Contact point for data protection requests
Response time: Statutory response deadline that applies
Complaints to: Supervisory authority for complaints

International transfers

The server, the inbox and the font service may each sit in a different country from you, and personal information crosses a border every time that happens. The request to Google's font service described above is itself one of those transfers, and it occurs before you have done anything at all on the page.

Where the site and its database are hosted: Hosting location
Where enquiry email is received and stored: Mail hosting location
The route relied on where a transfer leaves a jurisdiction that restricts it: Transfer mechanism relied on

Changes to this policy

When this policy changes, the revised version is published on this page and the effective date at the top changes with it. Where a change materially affects information already collected, we will say so on this page rather than rely on anyone noticing a new date. Earlier versions should be kept on record so that it is always possible to establish which terms applied when.

How to contact us

Questions about this policy, and any request about your own information, go to the data protection contact named in the first clause. Until that contact is confirmed, the details below are the outstanding part of this document.

Email: info@stage3consulting.com
Post: Postal address for written requests

For anything that is not about data protection, the enquiry form is the faster route.

Contact page Terms of use