Privacy Policy

1. Who We Are

Cashflow Consulting Ltd ("Cashflow Consulting", "we", "us", "our") is a payments consultancy registered in England and Wales (Company No. 14656198). This Privacy Policy explains how we collect, use and protect personal data in connection with our website at cashflowpayments.co.uk and our consultancy services.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data We Collect

We collect personal data in the following ways:

• Contact form submissions: your name, email address, phone number (optional), and the content of your message.
• Direct email correspondence: any personal data contained in emails you send us.
• Website analytics & server logs: IP addresses, browser type, pages visited, and session duration — collected automatically by our hosting provider when you visit the site.
• Cookies: see Section 7 below.

We do not collect sensitive personal data (such as health, financial account, or identity document information) through our website.

3. Why We Collect It — Legal Bases

Purpose	Data Used	Legal Basis (UK GDPR)
Responding to enquiries submitted via the contact form or email	Name, email, phone, message content	Legitimate interests (Art. 6(1)(f)) — responding to business enquiries
Providing paid consultancy services to clients	Contact details, business information	Performance of a contract (Art. 6(1)(b))
Maintaining financial and business records	Contact and transaction details	Legal obligation (Art. 6(1)(c)) — Companies Act, HMRC requirements
Improving our website and understanding how visitors use it	IP address, server logs, cookies	Legitimate interests (Art. 6(1)(f)) — subject to cookie consent where required
Sending updates, articles or marketing communications	Email address	Consent (Art. 6(1)(a)) — you can withdraw at any time

4. How Long We Keep Your Data

• Enquiries that do not lead to a client engagement: 24 months from the date of last contact, after which personal data is deleted.
• Client records (contracts, correspondence, invoices): 7 years from the end of the engagement, in line with HMRC guidance and the Limitation Act 1980.
• Server logs and analytics: up to 12 months, held by our hosting provider.
• Cookie consent records: 12 months, stored locally in your browser.

5. Who We Share Your Data With

We do not sell, rent or share your personal data with third parties for marketing purposes. We may share data with:

• Website and email hosting providers — who process data on our behalf under data processing agreements.
• Professional advisors (accountants, solicitors) — where necessary for legal or financial obligations, subject to confidentiality obligations.
• Regulatory or law enforcement bodies — where we are legally required to disclose information.

Where third-party processors are based outside the UK, we ensure appropriate safeguards are in place (such as the UK International Data Transfer Agreement or adequacy decisions).

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, contact us at nick@cashflowpayments.co.uk. We will respond within one calendar month.

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data where we no longer have a legal basis to retain it.
• Right to restrict processing — ask us to pause processing your data in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests or for direct marketing purposes.
• Rights relating to automated decision-making — we do not use automated decision-making or profiling.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113.

7. Cookies

Cookies are small text files stored on your device when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies: required for the site to function (e.g. your cookie consent preference). These do not require your consent.
• Analytics cookies: used to understand how visitors interact with the site (e.g. pages visited, session duration). We only set these if you accept cookies via the banner on our homepage.

You can withdraw cookie consent at any time by clearing your browser's local storage, or by adjusting your browser's cookie settings. Note that declining cookies will not affect your ability to use the site.

8. ICO Registration

Organisations that process personal data are generally required to register with the ICO under the Data Protection (Charges and Information) Regulations 2018. Cashflow Consulting Ltd reviews its registration obligations on an annual basis. For information on whether your organisation needs to register, visit ico.org.uk/registration.

9. Security

We take appropriate technical and organisational measures to protect personal data from unauthorised access, loss or disclosure. These include using HTTPS encryption on this website and limiting access to personal data to those with a genuine business need.

In the unlikely event of a personal data breach that is likely to result in a risk to individuals, we will notify the ICO within 72 hours as required by UK GDPR.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will always reflect the most recent version. We encourage you to review this policy periodically.

11. Contact Us

For any questions or concerns about this Privacy Policy or your personal data, please contact:

Cashflow Consulting Ltd
8 Tysoe Close, Wootton, Bedford, MK43 9FY
nick@cashflowpayments.co.uk