Privacy Policy

---

OSR Consultancy ("we", "us", "our") is committed to protecting the privacy and personal data of everyone who visits our website or engages with our services. This Privacy Policy explains what personal data we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully. By using our website at osrconsultancy.co.uk, you acknowledge you have read and understood its contents.

OSR Consultancy is a boutique AI, Data and Regulatory transformation consultancy based in Hertfordshire, UK. For the purposes of data protection law, OSR Consultancy is the data controller in respect of personal data collected through this website and in the course of providing our services.

Contact: contact@osrconsultancy.co.uk

We may collect and process the following categories of personal data:

• Contact enquiry data — your name, email address, phone number, and the contents of any message you send us via our contact form or directly by email.
• Website usage data — anonymised analytics data about how visitors use our website, including pages visited, time spent, and browser/device type (collected via cookies — see Section 7 below).
• Business relationship data — if you engage us for services, we may hold additional professional information such as your job title, company name, and correspondence related to the engagement.

We do not collect any special category data (such as health information, ethnicity, or political opinions) through this website.

We use the personal data we collect for the following purposes and on the following legal bases:

• Responding to enquiries — to respond to messages sent via our contact form or by email. Legal basis: legitimate interests.
• Providing our services — to fulfil contractual obligations where you or your organisation has engaged OSR Consultancy. Legal basis: performance of a contract.
• Improving our website — to understand how visitors use our site so we can make it more useful. Legal basis: legitimate interests.
• Legal compliance — to comply with any legal or regulatory obligations. Legal basis: legal obligation.

We will never use your personal data for unsolicited marketing without your explicit consent.

We do not sell, rent, or trade personal data. We may share data in the following limited circumstances:

• Service providers — third parties who help us operate our website or business (e.g. our website hosting provider, GoDaddy). These providers are bound by data processing agreements and may only use your data on our instructions.
• Professional advisers — lawyers, accountants, or insurers where necessary.
• Legal requirements — where we are required to disclose data by law, regulation, or court order.

We retain personal data only for as long as necessary for the purpose for which it was collected:

• Enquiry data (contact form messages, emails) — up to 2 years from the date of last contact, unless an ongoing business relationship exists.
• Client engagement data — for the duration of the engagement and up to 6 years thereafter, in line with UK statutory limitation periods.
• Website analytics data — typically 26 months (standard analytics retention period).

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct inaccurate or incomplete data.
• Right to erasure — to ask us to delete your personal data in certain circumstances.
• Right to restrict processing — to ask us to limit how we use your data.
• Right to data portability — to receive your data in a commonly used, machine-readable format.
• Right to object — to object to our use of your data where we rely on legitimate interests as our legal basis.

To exercise any of these rights, please contact us at contact@osrconsultancy.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Our website uses cookies — small text files placed on your device — to help us understand how the site is used. We use:

• Essential cookies — necessary for the website to function correctly.
• Analytics cookies — to collect anonymous information about how visitors use the site (e.g. Google Analytics or equivalent). No personally identifiable information is collected through these cookies.

You can control or disable cookies through your browser settings at any time. Note that disabling cookies may affect some website functionality. Our cookie consent banner gives you the option to accept or decline non-essential cookies when you first visit the site.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website is hosted on a secure platform and all data transmissions are encrypted using SSL/TLS. However, no method of transmission over the internet is entirely secure, and we cannot guarantee absolute security.

Our website may contain links to third-party websites (for example, LinkedIn). We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal data to them.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will always reflect the most recent version. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy or how we handle your personal data, please get in touch:

OSR Consultancy
Email: contact@osrconsultancy.co.uk
Website: osrconsultancy.co.uk