Privacy
Policy.

Who we are

Secucloud Limited ("Secucloud", "we", "us") is the data controller for personal data processed in connection with this website and our consulting services.

We are a UK consultancy registered in England & Wales. Contact: hello@secucloud.co.uk.

What we collect

We collect personal data in a small number of clearly-defined situations:

When you contact us

If you submit our enquiry form or email us directly, we collect your name, company, work email, role (if you provide it), and the content of your message. We do not collect anything you have not knowingly submitted.

When you take the Self-Assessment

If you complete the SAISF self-assessment, we collect your name, company name, and work email. Your answers to the diagnostic questions are processed in your browser to produce the results report; we receive the answers only if you complete the email-gated submission step.

When you visit the website

Like most websites, ours collects limited technical data: IP address, browser type, pages visited, and approximate location (country/city only). We use this to understand site usage in aggregate. See our Cookie Policy for details.

When we are engaged for consulting work

If you become a client, we will process additional information necessary to deliver the engagement — typically names and contact details of stakeholders, plus information about your environment. This is governed by the specific engagement contract.

Why we collect it

• To respond to enquiries and provide proposals
• To deliver consulting services to clients who have engaged us
• To send the results of the self-assessment you have explicitly requested
• To meet our legal, accounting, and tax obligations
• To understand site usage and improve the service we offer

We do not run marketing automation, profile site visitors, or sell data to third parties.

Lawful basis

Under UK GDPR, we process personal data under the following lawful bases:

• Legitimate interests — for responding to enquiries, delivering proposals, and understanding aggregate site usage.
• Contract — for any data processing necessary to deliver an agreed consulting engagement.
• Consent — for the self-assessment email submission, which is explicitly opt-in.
• Legal obligation — for record-keeping required by HMRC, Companies House, and other regulators.

Sharing your data

We share personal data only with a small set of carefully-chosen processors who help us run the business:

• Hosting & CDN — Cloudflare (for serving this website)
• Email — Google Workspace or equivalent (for handling correspondence)
• Form processing — Formspree or equivalent (for routing enquiry-form submissions to us)
• Accounting — FreeAgent and our appointed accountant (for invoicing and record-keeping)

We do not sell or rent personal data. We do not share it with advertising networks or data brokers.

How long we keep it

• Enquiry messages — kept for up to 2 years from last contact, then deleted unless a contractual relationship has formed.
• Self-assessment submissions — kept for up to 12 months for our own records, then deleted.
• Client engagement records — kept for 7 years after the engagement ends, in line with UK tax and contractual record-keeping requirements.
• Website analytics — aggregated only; no individual-level retention.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention obligations)
• Object to processing based on legitimate interests
• Withdraw consent at any time (where consent is the lawful basis)
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email hello@secucloud.co.uk. We respond within 30 days.

International transfers

Some of our processors (notably Cloudflare and Google) operate globally and may process data outside the UK and EEA. Where this happens, transfers are protected by appropriate safeguards — typically the UK International Data Transfer Addendum, Standard Contractual Clauses, or equivalent.

Changes & contact

If we make material changes to this policy, we will update the "Last updated" date and, where appropriate, notify clients directly.