Privacy policy

This notice explains how Afferentic Ltd handles personal data. It is written in plain English so you can understand what we do with information about you before you decide to share it. It is written to satisfy the UK GDPR and the Data Protection Act 2018.

Who we are

Afferentic Ltd is a private limited company registered in England and Wales under company number 17146782. Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Afferentic Ltd is the data controller for the personal data we collect through this website and in the course of providing our services.

Data Protection Officer

Afferentic Ltd is not required to appoint a Data Protection Officer under Article 37 of the UK GDPR. Our processing activities do not involve large-scale monitoring of data subjects, nor large-scale processing of special category or criminal offence data.

Data protection enquiries, subject access requests and any concerns about how we handle your personal data can be sent to privacy@afferentic.com. Afferentic Ltd is registered in England and Wales, company number 17146782, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.

What data we collect

Through this website:

• The forms on the homepage and on /start. They open your own email app with your message addressed to us. Nothing is sent until you press send. When you do, we hold what you wrote, the address you wrote from, and your name if you gave it. We do not ask for your phone number, company, or anything else.
• Correspondence with us. If you email us, call us, or contact us through any channel, we keep a record of that communication and your contact details.
• Analytics. We use Cloudflare Web Analytics to count visits and pages viewed. It sets no cookies and does not identify you. If, and only if, you accept analytics cookies, we also use Google Analytics and Microsoft Clarity to understand how the site is used: which pages you visit, where you came from, your approximate location from your IP address, your device and browser, and how you scroll and click. Clarity can replay a visit as a recording, with anything typed into forms masked. We do not use advertising cookies, and we do not use this to identify you.

During a client engagement:

• Client contact details. Name, business email, job title, and phone number of the people at the client organisation we work with.
• Operational data accessed during an engagement. As part of the Afferentic Map and subsequent build work, we access data held in the client's own systems through authorised, scoped integrations. This may include personal data held by the client about their customers, staff, or suppliers. In all such cases we are acting as a processor on behalf of the client, who remains the data controller.
• Notes and deliverables. Notes from conversations, findings from assessments, and documents we produce for you.

Why we collect it and our lawful basis

We process personal data on one of the following lawful bases under Article 6 of the UK GDPR:

• Legitimate interests — for responding to form submissions and enquiries, maintaining contact with prospective clients, and operating the business. This is our default basis for business-to-business communications.
• Contract — for processing necessary to deliver the services you have engaged us for.
• Legal obligation — for processing necessary to comply with laws that apply to us, such as tax records, company filings, and responses to regulatory enquiries.

We do not process special category data (data about health, ethnicity, political opinions, religion, sexuality, biometric, genetic, or trade union membership) through this website. If an engagement would require processing of special category data, we would agree a specific lawful basis with the client in writing as part of a Data Processing Agreement.

How we store and protect it

We take the security of personal data seriously. Our measures include:

• Data stored on UK or EU-hosted infrastructure; the client platform runs in data centres in Finland
• Access controlled by multi-factor authentication and, where applicable, device-compliance checks
• Client data isolated per-engagement and not co-mingled with other clients
• Access to client systems uses scoped, revocable credentials agreed with the client, held in a secrets vault and never in code
• Audit logs of access and actions retained for the duration of the engagement and for an appropriate period afterwards
• Data encrypted in transit
• Workstations and devices with disk encryption and automatic screen locking

How long we keep it

• Prospect and enquiry records: up to two years from last contact, unless you ask us to delete them sooner
• Client engagement records: six years from the end of the engagement, for legal, tax, and professional indemnity purposes
• Accounting records: six years, as required by UK law
• Statutory company records: for the lifetime of the company plus six years after dissolution

Who we share it with

We do not sell personal data. We share it only with:

• Service providers we use to run the business — such as Microsoft (email, calendar, file storage), Starling Bank (banking), our accountants, and hosting providers. These providers act as our data processors under written agreements that require them to protect your data.
• Analytics providers — Cloudflare for cookie-free visit counts, and, only if you accept analytics cookies, Google (Google Analytics) and Microsoft (Clarity).
• Professional advisers — such as solicitors, insurers, and auditors when their involvement is required.
• Authorities, courts, or regulators — when we are legally required to disclose information.

We do not transfer personal data outside the UK or European Economic Area without an appropriate safeguard in place, such as the UK International Data Transfer Agreement or equivalent.

Your rights

Under UK GDPR, you have the right to:

• Ask us what personal data we hold about you and receive a copy
• Ask us to correct inaccurate data
• Ask us to erase your data, where we no longer need it and no legal basis requires us to keep it
• Ask us to restrict or object to how we process your data
• Ask us to provide your data in a portable format
• Withdraw any consent you have given us at any time
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint — we would ask that you contact us first so that we can try to resolve any issue directly

To exercise any of these rights, email privacy@afferentic.com. We will respond within one month.

Cookies

When you first visit, we ask whether you accept analytics cookies. If you choose “No thanks”, none are set: the site then stores only your answer, and your light or dark theme, in your own browser. If you choose “Accept”, Google Analytics sets cookies beginning _ga (kept up to two years) and Microsoft Clarity sets cookies such as _clck and _clsk (kept up to a year). We do not use advertising or social media tracking cookies. To change your answer, clear this site’s data in your browser and you will be asked again.

Changes to this policy

We may update this policy from time to time. We will change the “last updated” date at the top of the page and, if changes are material, we will let you know by email or by a notice on the site.

Contact

Afferentic Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
privacy@afferentic.com