Legal

Privacy policy

Last updated 9 August 2026

This policy explains what personal data Groundwork collects through this website, why we collect it, how long we keep it and what rights you have over it.

Who we are

Groundwork is a fractional COO and commercial, procurement and security consultancy. For the purposes of UK data protection law we are the data controller for personal data collected through this website.

What we collect

When you use the readiness check and book a call

The short check on our home page asks you to tick the statements that sound like your company, and to give a name and work email before booking. When you click through to book, we record:

• the name and email address you entered;
• which statements you ticked;
• the services our check suggested on the basis of those answers;
• the date and time you submitted it.

We use this so that whoever takes your call has read your answers beforehand, rather than asking you to repeat them.

When you sign up to our newsletter

The sign-up form at the foot of our home page is provided by our newsletter platform, and it is that provider, acting as our processor, that holds your email address and the date you subscribed. Submitting the form sends your address to them rather than to this website.

We use it only to send you the newsletter, no more than once a month. We do not use it for anything else, and we do not sell it or pass it to anyone beyond the provider that sends the emails for us. Every email includes a way to unsubscribe, and you can also ask us to remove you at any time.

When you email us or book a call

If you email us, we hold that correspondence and the address it came from. Bookings are made through Google Calendar's appointment scheduling, and the details you give in that form are held by Google on our behalf.

Technical data

Our hosting provider records standard server logs for every request, including IP address, browser type and the page requested, to keep the site running and secure.

We also use Google Analytics to count visits and see which pages people read, so we know which of our writing is worth doing more of. It records the pages you visit, roughly where in the world you are, and the type of device and browser you used. We do not use advertising cookies, we do not build profiles of individual visitors, and we have not linked Google Analytics to any advertising product.

Cookies

Google Analytics sets a small number of cookies in your browser so that repeat visits within a session are counted once rather than several times. They hold a randomly generated identifier, not your name or your email address, and the main one expires after two years.

If you would rather not be counted, most browsers can block cookies for a single site, and Google publishes a browser add-on that opts you out of Google Analytics everywhere. Nothing on this site stops working if you do either.

Beyond that, the only cookie we use is a strictly necessary one that keeps our own staff signed in to an internal page, and it is never set on a visitor's browser.

Our lawful basis

Legitimate interests

Responding to enquiries and preparing for a call you have asked us to have. We have considered your interests and rights, and we think you would reasonably expect us to use the details you gave us for exactly the purpose you gave them for. The same basis covers the visit statistics we collect through Google Analytics, which tell us how the site is used in aggregate and never identify you.

Consent

Sending you the newsletter, where you have asked us to. You can withdraw that consent whenever you like, and we will stop.

Legal obligation

Where we have to keep records for tax, accounting or regulatory reasons.

Giving us your details is entirely optional. You can also book a call from any other button on the site, or simply email us, without filling the check in.

Who your data is shared with

We do not sell personal data, and we do not share it for marketing. It is handled on our behalf by a small number of service providers acting as our processors: our website host, the database that holds readiness-check submissions, the platform that runs our newsletter, Google Analytics, and the calendar and email services we use. Each is bound to process it only on our instructions. We will tell you who they are if you ask.

Some of these providers may process data outside the UK or European Economic Area. Where that happens, the transfer is covered by the safeguards those providers offer, such as the UK addendum to the EU standard contractual clauses.

How long we keep it

Newsletter subscriptions are held by our newsletter provider until you unsubscribe or ask us to remove you. We keep readiness-check submissions for 24 months from the date you sent them, then delete them. Google Analytics deletes the visit data it holds on our behalf automatically, on the retention period set in our account. Correspondence is kept for as long as we have an active relationship with you and for a reasonable period afterwards. Records we must keep for tax or accounting purposes are held for as long as the law requires.

If you ask us to delete your data sooner, we will.

Your rights

Under UK data protection law you have the right to:

• ask what personal data we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• receive your data in a portable format;
• object to processing we carry out on the basis of legitimate interests.

To exercise any of these, email hello@groundworkconsultancy.com. We will respond within one month.

If you are unhappy with how we have handled your data, you can come to us first so we can put it right.

Changes to this policy

If we change how we handle personal data, we will update this page and the date at the top of it.