Skip to content
CiAConsultancy in ActionAI Operations for Real Businesses

Privacy

Privacy notice

A plain-English summary of how we handle personal data. This is the policy customers and assessment respondents agree to.

Who we are

Consultancy in Action (“we”, “us”) is a UK consultancy delivering AI Operations services to small and medium-sized businesses.

The data controller for the personal data described in this notice is Consultancy in Action Ltd, a private limited company registered in England and Wales under company number 17388810.

Registered address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

For anything to do with your data — questions, access requests, complaints — contact us at hello@consultancyinaction.com.

What we collect

  • · AI Readiness Assessment leads: name, work email, company, optional phone, budget range, your answers, your computed score, and your consent record (version, timestamp, IP), plus the campaign tags shown below.
  • · Enquiries and booking requests: what you type into the enquiry form on this site — name, work email, company, optional phone, and optionally company size, budget range and timeline, plus your message and your consent record. Bookings are arranged by email from there; we don’t use a third-party scheduling tool.
  • · How you found us:when you send an enquiry, take the assessment or sign up for updates, we store any UTM campaign tags in the address bar of the first page you landed on, that landing page’s address, and the external site or search engine that referred you. It tells us which of our own campaigns is worth paying for. It is kept with your enquiry, it is not shared with any advertising network, and it is held only for this browsing session (in your browser’s session storage, not a cookie) unless you actually submit a form.
  • · Engagement records: details necessary to deliver a paid engagement (project scope, contact information, invoicing details).
  • · Analytics: consent-gated only. If — and only if — you allow analytics on the cookie banner, we record your page views using Umami, which we self-host at stats.consultancyinaction.tech: the page viewed, the referring page or search engine, campaign tags in the link you clicked, your country, and your browser, operating system, device type and screen size. Your IP address is used to derive the country and is not stored, Umami sets no cookies, and nothing is sent to an advertising network. Decline, or make no choice, and the script never loads. We run no session recording and no heatmaps. The only thing we store in your browser is your cookie choice itself — see our cookie policy.
  • · Advertising measurement: a separate consent. Allowing analytics does notallow advertising measurement — the banner asks the two questions separately, because advertising is not covered by the exemption that applies to audience statistics. If — and only if — you choose “Allow all”, we load a tag from the advertising platform (currently Google Ads) which sets its own cookies and tells that platform that an advert led to an enquiry. It receives that a conversion happened, not the contents of your enquiry. Choose anything else and your browser contacts no advertising host at all. We are not running any advertising at the time of writing, so today the tag is not configured and does not load for anyone.

If we contacted you first (business outreach)

Sometimes we write to someone at a business who has not contacted us — a direct, one-to-one email or message about our services. If that is how you arrived here, this section is the privacy information you are owed under Article 14 of the UK GDPR, because we obtained your details from somewhere other than you.

  • · What we hold: your name, your job title, your employer, and a work email address or LinkedIn profile. Nothing else. We do not hold, buy or build a profile of you.
  • · Where we got it:publicly available business sources — your employer’s own website, a trade or chamber-of- commerce membership directory, a published award listing, the Companies House register, or LinkedIn. We do not buy contact lists, we do not use scraped databases, and we do not use personal (non-work) addresses.
  • · Why: to ask whether a conversation about AI in your organisation would be useful. That is direct marketing, and we say so plainly.
  • · Lawful basis:legitimate interests (UK GDPR Art. 6(1)(f)) — our interest in offering a relevant business service, weighed against the limited intrusion of one message to a work address about the recipient’s own professional responsibilities. Marketing email to a corporate subscriber — a limited company, LLP, plc, Scottish partnership or public body — does not require prior consent under PECR reg. 22. We do not send unsolicited marketing email to sole traders or ordinary partnerships, who are individual subscribers under those rules.
  • · How long: if you do not reply, we delete your details within 6 months of the last message. If you ask us to stop, we keep the minimum needed — normally your email address alone — on a permanent suppression list, so that we can honour your objection and never contact you again.
  • · Who else sees it: nobody. It is not shared, sold or passed to a third party, and it stays with the controller named at the top of this page and our hosting and mail provider listed under Sub-processors.

Your right to object is absolute. Reply to any message with “stop”, or email hello@consultancyinaction.com, and we stop immediately and permanently. There is no balancing test and nothing for you to justify. You may also ask us for a copy of what we hold, or ask us to delete it.

Lawful basis

  • · Legitimate interest — to deliver the report or service you’ve asked for.
  • · Legitimate interest — to send a business contact at a corporate subscriber a direct message about our services, on the terms set out under business outreach above.
  • · Consent — for marketing-style follow-up (separate opt-in; never pre-ticked).
  • · Contract — to perform an engagement once you become a client.
  • · Legal obligation — for accounting and tax records.

Your rights

Under the UK GDPR and the EU GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting processing already carried out). Email hello@consultancyinaction.com and we will action requests promptly, normally within one month.

Retention

Assessment leads are retained for up to 24 months from your last interaction with us, then automatically deleted by a scheduled retention job unless you have asked to stay on marketing. You can ask us to erase your data at any time and we action it promptly. Client engagement records are retained for the statutory period required for tax and accounting purposes.

Sub-processors

We keep this list deliberately short. Today it is:

  • · Hostinger — hosting for this website and the database that stores assessment leads and enquiries, and the mail service that sends our transactional email (your assessment report, your enquiry acknowledgement).

We do not currently use a CRM or a third-party scheduling tool. Our analytics are not a third-party service either: we run Umami ourselves on our own server, so consent-gated analytics data stays on infrastructure we control and is never shared with an analytics vendor or an ad network. Advertising measurement is the one exception, it is opt-in on the banner, and it is described above. If any of that changes we will update this notice before the new processor goes live. All processors we do use are bound by their own GDPR commitments.

International transfers

A sub-processor may be located outside the UK and EEA. Where personal data is transferred internationally, we rely on an adequacy decision or appropriate safeguards — such as the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses — so your data keeps an equivalent level of protection.

Complaints

If you’re in the UK, you can complain to the Information Commissioner’s Office at ico.org.uk. If you’re in the EU/EEA, you can lodge a complaint with your national data protection supervisory authority — you can find yours via the European Data Protection Board. We’d appreciate the chance to resolve it with you first.

Cookies

For how we use cookies and how to change your choice, see our cookie policy.

This page is a plain-English summary. Where a written client Data Processing Agreement is in place, that DPA governs in case of conflict. Get in touch for the full DPA template.

Last reviewed: July 2026.