Legal
Privacy Policy
Concursys Limited. Effective date: 4 July 2026. Last updated: 4 July 2026
1. Introduction
This Privacy Policy explains how concursys Limited collects, uses and protects personal data when you visit our website at concursys.com (the Website) or otherwise interact with us. We are a digital management consultancy working with organisations across critical national infrastructure, and we take the protection of personal data seriously.
We are the controller of the personal data described in this policy for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Who we are
Concursys Limited is a company registered in England and Wales.
Company registration number: 17273519
Registered office: Crown Walk, 1 Jewry Street, Winchester, Hampshire, SO23 8BB, United Kingdom
Data protection contact: [email protected]
3. The personal data we collect
3.1 Information you give us
When you complete the enquiry or contact form on our Website, or contact us by email, we collect the information you choose to provide. This typically includes your name; your email address; your employer, job title or organisation (if you provide it); and the content of your message and any other details you choose to share.
3.2 Information we collect automatically
When you use our Website, we and our analytics providers automatically collect certain technical information through cookies and similar technologies, including your IP address (which may be truncated or anonymised); browser type and version, device type and operating system; the pages you view, the links you click and how you navigate the Website; and referring website addresses and approximate location derived from your IP address. See our Cookies section below for more detail on how you can control this.
4. How and why we use your personal data
We use your personal data only where we have a lawful basis to do so under the UK GDPR. The table below sets out our purposes and the corresponding lawful basis.
| Purpose | Detail | Lawful basis |
|---|---|---|
| Responding to your enquiries | To respond to messages submitted through our contact form or by email, and to provide the information or services you request. | Our legitimate interests (to respond to and manage enquiries about our services), and, where the enquiry relates to a potential engagement, steps taken at your request prior to entering into a contract. |
| Managing our client and business relationships | To communicate with prospective and existing clients, associates and partners, and to administer our services. | Legitimate interests (to run and develop our business) and, where relevant, performance of a contract. |
| Website analytics and improvement | To understand how our Website is used and to maintain, improve and secure it. | Your consent (given through our cookie banner) for non-essential analytics cookies; and our legitimate interests in keeping the Website secure and functioning. |
| Legal and regulatory compliance | To comply with our legal obligations and to establish, exercise or defend legal claims. | Compliance with a legal obligation, and our legitimate interests in protecting our business. |
5. Cookies and analytics
Cookies are small text files placed on your device when you visit a website. Our Website uses essential cookies that are necessary for the Website to function and cannot be switched off in our systems; and analytics cookies (including Google Analytics, provided by Google) that help us understand how visitors use our Website. These are only set where you have given consent.
When you first visit our Website, you will be presented with a cookie banner allowing you to accept or reject non-essential cookies. You can change your preferences at any time through the cookie settings on the Website, and you can also block or delete cookies through your browser settings, although some parts of the Website may not work correctly as a result.
Google Analytics may transfer information to, and store it on, servers operated by Google. For information on how Google uses data, see Google's own privacy resources. We configure analytics to limit the data collected where practicable, including IP anonymisation.
6. Sharing your personal data
We do not sell your personal data. We share it only where necessary, and with appropriate safeguards, with service providers who process data on our behalf, such as website hosting, email, and analytics providers, acting under contract and only on our instructions; professional advisers such as lawyers, accountants and insurers, where necessary; regulators, law enforcement or other authorities where we are required to do so by law; and a buyer or successor in the event of a merger, reorganisation or sale of our business.
7. International transfers
Some of our service providers (for example, analytics providers) may process personal data outside the United Kingdom. Where personal data is transferred outside the UK, we take steps to ensure it receives an adequate level of protection, for example by relying on UK adequacy regulations or by putting in place the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You may contact us for more information about the safeguards in place.
8. How long we keep your personal data
We keep personal data only for as long as necessary for the purposes for which it was collected. Enquiry correspondence that does not lead to an engagement is generally retained for up to 24 months and then deleted or anonymised. Data relating to clients and contracts is kept for the duration of the relationship and for a further period afterwards to meet our legal, accounting and regulatory obligations. Analytics data is retained in line with the retention settings of our analytics tools.
9. Your rights
Under the UK GDPR you have the following rights in relation to your personal data: the right to be informed about how we use your data; the right of access to a copy of the data we hold about you; the right to rectification of inaccurate or incomplete data; the right to erasure in certain circumstances; the right to restrict processing in certain circumstances; the right to data portability in certain circumstances; the right to object to processing based on our legitimate interests, and to object to direct marketing at any time; and rights relating to automated decision-making and profiling (we do not carry out such processing).
Where our processing is based on consent, you have the right to withdraw that consent at any time. To exercise any of these rights, contact us at [email protected]. We will respond within one month, as required by law. Exercising your rights is free of charge in most cases.
10. Marketing
We will only send you marketing communications where you have asked to receive them or where we are otherwise permitted to do so. Every marketing email includes an option to unsubscribe, and you can ask us to stop at any time by contacting [email protected].
11. Security
We maintain appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. No method of transmission over the internet is entirely secure, however, and we cannot guarantee absolute security.
12. Third-party links
Our Website may contain links to third-party websites. This Privacy Policy does not apply to those websites, and we are not responsible for their content or privacy practices. We encourage you to read the privacy policies of any website you visit.
13. Children
Our Website and services are intended for businesses and professionals and are not directed at children. We do not knowingly collect personal data from anyone under 18.
14. Changes to this policy
We may update this Privacy Policy from time to time. The current version will always be posted on our Website with the effective date shown above. Material changes will be made clear on this page.
15. Complaints
If you have any concern about how we handle your personal data, please contact us first at [email protected] so we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or by calling 0303 123 1113.