1. Who We Are

Altiora Consulting is a business and operational transformation consultancy. We help SMEs identify and close revenue leakage, reduce operational waste, and scale their operations.

Our registered address

Altiora Business Development Ltd
5 Brayford Square
London
E1 0SG

Enquiries@AltioraBD.com altiorabd.com

We are registered with the Information Commissioner's Office (ICO) as a data controller. When we collect and use your personal data, we are responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data We Collect

Depending on how you engage with us, we may collect and process the following categories of personal data:

2.1 Identity and Contact Data

Full name
Job title and role
Business email address
Business telephone number
Business address

2.2 Business and Commercial Data

Company name and structure
Number of employees and staff headcount
Salary information (aggregate or individual, where relevant to an engagement)
Annual turnover and revenue data
Financial performance metrics and management accounts
Operational process documentation
Commercially sensitive business information shared as part of a diagnostic or consulting engagement

2.3 Technical and Website Data

IP address
Browser type and version
Pages visited and time spent on our website
Referring website or search query
Cookie identifiers (see Section 9)

2.4 Communications Data

Enquiries submitted via contact forms on our website
Email correspondence
Notes from meetings, calls, or discovery sessions

3. How We Collect Your Data

We collect personal data through the following means:

Direct engagement — when you contact us, request a proposal, or enter into a consulting engagement
Our website — through contact forms hosted on altiorabd.com
Web research — we may research publicly available information about your business prior to or during an engagement (for example, Companies House records, LinkedIn profiles, publicly available financial information)
Third-party referrals — when an existing contact refers you to us

4. Our Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

4.1 Contractual Necessity (Article 6(1)(b))

Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. This applies to all data processed as part of delivering a consulting engagement, proposal, or service agreement.

4.2 Legitimate Interests (Article 6(1)(f))

Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights. This includes business development activity, maintaining records of prospect interactions, and improving our services. We conduct legitimate interest assessments where required.

4.3 Legal Obligation (Article 6(1)(c))

Where processing is necessary to comply with a legal obligation, including financial record-keeping and tax compliance.

4.4 Consent (Article 6(1)(a))

Where you have given clear consent, for example to receive marketing communications from us. You may withdraw consent at any time by contacting us at Enquiries@AltioraBD.com.

5. How We Use Your Data

We use the personal data we collect for the following purposes:

To respond to enquiries and provide quotes or proposals
To deliver consulting and transformation services under a client engagement
To manage our client relationship, including onboarding, billing, and service delivery
To produce diagnostic reports, audits, and recommendations as part of our service
To comply with our legal and financial obligations (including tax and accounting records)
To send marketing communications where you have opted in or where we have a legitimate interest to do so
To improve our website and service offering

6. Who We Share Your Data With

We do not sell your personal data. We may share it with the following categories of third parties, strictly for the purposes described in this policy.

6.1 Technology and Platform Providers

We use the following third-party platforms to operate our business. Each acts as a data processor on our behalf:

Microsoft 365 — email, document storage, and communications (Microsoft Corporation, USA). Protected under the UK-US Data Bridge and Standard Contractual Clauses.
Supabase — database and backend infrastructure (Supabase Inc., USA). Protected under Standard Contractual Clauses.
PandaDoc — document creation and e-signature (PandaDoc Inc., USA). Protected under Standard Contractual Clauses.
Xero — accounting and invoicing (Xero Limited, New Zealand, subject to UK adequacy assessment).
Anthropic Claude (claude.ai) — AI-assisted analysis and content generation used internally in service delivery (Anthropic PBC, USA). Protected under Standard Contractual Clauses.
Lovable.dev — website hosting and development platform. Data is processed in accordance with Lovable's privacy terms.

We do not share client data with these platforms beyond what is strictly necessary for operational purposes.

6.2 Legal and Regulatory Disclosure

We may disclose personal data where required to do so by law, court order, or regulatory authority.

7. International Data Transfers

Several of our technology providers are based outside the United Kingdom, including in the United States. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including:

Transfers to countries with UK adequacy regulations in force
Standard Contractual Clauses (SCCs) approved by the ICO
The UK-US Data Bridge, where applicable

If you would like further information about the specific safeguards in place for any transfer, please contact us at Enquiries@AltioraBD.com.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are as follows:

Client engagement data (contracts, correspondence, reports): 12 months from the end of the engagement, in line with the Limitation Act 1980
Financial records (invoices, accounts): 6 years from the end of the relevant financial year, in line with HMRC requirements
Prospect and enquiry data (where no engagement is entered into): 24 months from last contact
Marketing contact data: until consent is withdrawn or the contact unsubscribes
Website analytics data: in accordance with the retention settings of the relevant analytics provider (typically 26 months)

At the end of the relevant retention period, data is securely deleted or anonymised.

9. Cookies and Tracking Technologies

Our website (altiorabd.com) may use cookies and similar tracking technologies. Cookies are small text files placed on your device when you visit our website. We may use the following types of cookies:

Strictly necessary cookies — required for the website to function. No consent is required for these.
Analytics cookies — used to understand how visitors use our site (for example, pages visited and time spent). We will seek your consent before placing these.
Marketing and advertising cookies — used to serve relevant advertising where we run paid campaigns. We will seek your consent before placing these.

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. We will update this section in full once our cookie management solution is implemented.

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. You can exercise any of these rights by contacting us at Enquiries@AltioraBD.com.

Right of access — request a copy of the personal data we hold about you (Subject Access Request)
Right to rectification — ask us to correct inaccurate or incomplete data
Right to erasure — ask us to delete your data in certain circumstances ('right to be forgotten')
Right to restrict processing — ask us to limit how we use your data
Right to data portability — request your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests or for direct marketing
Rights related to automated decision-making — we do not currently make automated decisions that have a legal or significant effect on individuals

We will respond to all verified requests within one calendar month. There is no charge for exercising your rights in most circumstances.

11. Marketing Communications

We may send you information about our services, insights, and resources where you have opted in or where we have a legitimate interest to do so as an existing or prospective client.

You can opt out of marketing communications at any time by:

Clicking the unsubscribe link in any marketing email
Emailing us directly at Enquiries@AltioraBD.com

Opting out of marketing will not affect our ability to contact you for the purposes of an active or ongoing engagement.

12. How We Protect Your Data

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or destruction. These measures include:

Secure cloud storage within the Microsoft 365 environment with access controls
Use of reputable third-party processors with their own security certifications
Restricted internal access — only those who need access to client data for service delivery can access it
Regular review of data handling practices

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly.

13. How to Raise a Concern or Complaint

If you have a concern about how we handle your personal data, please contact us in the first instance:

Enquiries@AltioraBD.com

Altiora Business Development Ltd, 5 Brayford Square, London, E1 0SG

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. When we do, we will update the 'Last updated' date at the top of this document. We encourage you to review this policy periodically.

Material changes that affect how we process your data will be communicated to you directly where we hold your contact details.