Privacy Policy

This policy explains what we do with personal data, why, how long we keep it, and what you can ask us to do about it. It is written to be read rather than to be complied with, and if anything in it is unclear you can write to us and get an answer from a person.

1. Who we are

This website and the services described on it are operated by Formalus Limited, a company registered in England & Wales (company number 10374580), with registered office at 20–22 Wenlock Road, London N1 7GU, United Kingdom. TechGrowth Strategy & Insights is a trading name of that company.

Formalus Limited is the data controller for the personal data described in this policy.

2. What data we collect

2.1 Data you provide directly

• Identity data — name, job title and company, where you provide them.
• Contact data — email address and telephone number, where you provide them.
• Booking data — the information you enter when booking a Growth Review, and anything you tell us about your business in advance of it.
• Correspondence — emails and messages you send us.

2.2 Data collected automatically

• Technical data — IP address, browser type, device information and time zone.
• Usage data — pages visited, links clicked and session duration.
• Cookies — see section 9 and our Cookie Notice.

3. Why we process your data

• To arrange and deliver a Growth Review — performance of a contract, or steps taken at your request before entering one.
• To respond to enquiries — our legitimate interest in replying to messages you send us.
• To send email updates, where you have asked for them — consent, which you can withdraw at any time.
• To improve this website and our services — our legitimate interest in operating and improving the business.
• To meet legal and accounting obligations — legal obligation.

4. How long we keep it

• Growth Review records — 90 days from the conversation, after which the personal record is deleted. Anonymised summary notes may be retained for benchmarking.
• Enquiries and correspondence — three years from your last contact with us, then deleted unless an active engagement requires us to keep it longer.
• Email subscribers — until you unsubscribe. We keep a suppression record (email address only) indefinitely so that we honour your opt-out.
• Client engagement records — six years after an engagement closes, in line with UK statutory record-keeping obligations under the Companies Act 2006, HMRC business-record requirements and the Limitation Act 1980.

5. Who we share it with

We share personal data only with the suppliers needed to run the business, each under a data processing agreement:

• WP Engine — website hosting.
• Google Workspace — email correspondence and email updates.
• Google Analytics — anonymised website analytics.
• Calendly — scheduling Growth Reviews and holding the details you enter when booking.
• Professional advisers — where required for legal, tax or accountancy purposes.

We do not sell personal data, and we do not share it with third parties for their own marketing.

6. International transfers

Some of our suppliers are based outside the UK. Where that is the case, transfers are governed by an appropriate safeguard — the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or UK adequacy regulations where the destination country has been recognised as providing an adequate level of protection. A data processing agreement is in place before any transfer takes place.

7. Your rights

Under UK GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Rectification — ask us to correct anything inaccurate or incomplete.
• Erasure — ask us to delete it, subject to the retention obligations above.
• Restriction — limit how we process it.
• Portability — receive it in a portable format.
• Object — to processing based on legitimate interests, or to direct marketing.
• Withdraw consent — at any time, where consent is the basis.

To exercise any of these, write to privacy@formalus.com. We respond within one month.

You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

8. How we secure it

We use appropriate technical and organisational measures, including encryption in transit, access controls on storage systems, and data processing agreements with every third party that handles personal data on our behalf.

9. Cookies

This website uses cookies for basic functionality and for analytics. You can refuse non-essential cookies through the banner when you first visit, and change your mind at any time through your browser settings. Full details are in our Cookie Notice.

10. Changes

We update this policy when our processing changes. The date at the top shows when the current version took effect. Where we hold an appropriate email address, material changes will be notified.