Privacy notice.

Who we are

Hyphora Consulting Ltd (“Hyphora”, “we”, “us”) is the controller of the personal data described in this notice. We are registered in England and Wales, company number 12904446, registered office 126 Crampton Street, London, England, SE17 3AE.

Questions about this notice, or requests about your data, go to Ben Hart at ben@hyphora.co.uk. We do not have a Data Protection Officer; we are not required to appoint one.

What we collect and why

When you contact us or book a call

If you email, phone or book a call, we hold your name, contact details, organisation, role and whatever you choose to tell us. We use it to reply, to prepare for the call and, if it leads to work, to propose and run the engagement.

Calls are booked through Google Calendar appointment scheduling. Google collects your name, email address and any notes you add, and shares them with us so the booking appears in our calendar.

Lawful basis: our legitimate interest in responding to business enquiries, or steps taken at your request before entering into a contract.

When we work with your organisation

During an engagement we hold business contact details for the people we work with, and may receive personal data contained in the information your organisation provides, such as names on site records, meter data or sign-off documents.

Lawful basis: performance of our contract with your organisation, our legitimate interest in delivering and managing the work, and compliance with legal obligations (for example record keeping for ESOS and for tax). Where we process personal data on your organisation's behalf as a processor, a data processing agreement will set out the terms.

When you visit this website

The site has no forms and sets no cookies. The ESOS eligibility checker runs entirely in your browser: your answers are not sent to us or stored anywhere, and disappear when you leave the page.

We use Vercel Web Analytics to count page views. It does not use cookies and does not identify individual visitors; it gives us aggregate figures such as the number of visits, the pages viewed, the referring site, country and device type. Our hosting provider, Vercel, also keeps short-lived server logs, which include IP addresses, to run and secure the site.

Lawful basis: our legitimate interest in running a secure website and understanding how it is used.

Business development

We may contact people in a professional capacity, using business contact details that are publicly available or that you have given us, about services relevant to their role. Where we did not get your details from you directly, they come from public professional sources such as company websites and LinkedIn, or from mutual introductions. Every such message tells you how to opt out, and we will stop when asked. We do not send marketing emails to personal (non-business) addresses without consent.

Lawful basis: legitimate interests in developing our business.

Events and webinars

If you register for an event or webinar we run with a partner organisation, we share your registration details with that partner only to organise the event.

Lawful basis: our legitimate interest in running the event, or consent where we ask for it.

Our contact database

We keep the work contact details of clients, prospective clients, partners and other professional contacts (name, organisation, role, business email and phone, and notes of our dealings) in a contact database hosted on Notion. We use it to manage relationships and engagements.

Lawful basis: our legitimate interest in running and developing our business.

Who we share it with

We do not sell personal data. We share it only with:

• service providers who run our business systems: Google (email, calendar, document storage), Notion (contact database and project records), Anthropic (Claude, an AI assistant we use to help organise and draft work, with the setting that allows our conversations to be used for model training switched off), Vercel (website hosting and analytics), and our accountants;
• the Environment Agency or other regulators, where an engagement requires a filing or where the law requires disclosure;
• contractors, associates or other advisers working on your engagement, with your organisation's agreement and under confidentiality obligations;
• professional advisers and insurers, and anyone who acquires our business, where reasonably necessary.

International transfers

Some of our providers, including Google, Notion, Anthropic and Vercel, store or access data outside the UK, mainly in the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by the ICO's International Data Transfer Agreement or Addendum.

How long we keep it

• Enquiries and professional contacts we are not working with: up to two years after our last contact, unless you ask us to delete them sooner.
• Engagement records: six years after the engagement ends, to meet legal, tax and insurance requirements and to deal with any claims. ESOS evidence may be kept for longer where the scheme requires the records to be available for a full compliance phase.
• Website server logs: deleted by our host within 30 days.

Your rights

Under UK data protection law you can ask us to:

• confirm whether we hold your data and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, where there is no longer a reason to keep it;
• restrict how we use it, or object to our using it;
• stop using it for direct marketing (this right is absolute);
• give it to you, or another organisation, in a portable format;
• withdraw any consent you have given, at any time.

Email ben@hyphora.co.uk. We will respond within one month and there is no charge.

If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Security

Data is held in access-controlled business accounts protected by multi-factor authentication. Access is limited to people who need it for the work.

Changes to this notice

We will update this notice when what we collect or how we use it changes. The date at the top shows when it was last revised. Our use of cookies is described separately in the cookie policy.