Privacy Notice

Meganoesis Limited (“Meganoesis”, “we”, “us”) is an independent advisory and architecture consultancy registered in England and Wales, company number 16686645, with its registered office at 1 Breightmet Hill, Bailey Lane, Bolton, England, BL2 5EN.

For the purposes of data protection law, Meganoesis Limited is the controller of the personal data described in this notice, except where Section 5 states otherwise. We can be contacted about anything in this notice at privacy@meganoesis.com. We have not appointed a Data Protection Officer, as the law does not require one for our scale and activities; privacy matters are handled by the founding director.

This notice explains how we handle personal data across the whole of our practice:

• Website visitors – people who browse meganoesis.com;
• Enquirers and business contacts – people who contact us, and the individuals we deal with at clients, prospective clients, partners, and suppliers;
• Client engagement data – personal data we encounter in the course of advisory, architecture, and assurance engagements.

It does not cover data practices of other organisations, including any third-party sites we link to.

3.1 Website visitors

We have designed the website to collect as little as possible.

• Technical data. Our hosting provider processes the technical information a browser sends with every request – IP address, browser type, pages requested, and timestamps – in server logs, for the purposes of serving the site securely and diagnosing faults. Lawful basis: our legitimate interest in operating a secure, functioning website.
• Analytics. We use privacy-preserving analytics that do not use cookies and do not track individuals across sites. The data we see is aggregated – page views, referral sources, approximate country – and cannot be linked to you. Lawful basis: our legitimate interest in understanding, in aggregate, how the site is used.
• Cookies. The site sets no cookies requiring consent. Any strictly necessary cookies (for example, remembering a light or dark theme preference) store no personal data.

3.2 Enquirers

When you contact us by email, we receive your name, email address, and whatever you choose to tell us. We use this to respond to you, to assess whether and how we can help, and to maintain a record of our correspondence. Lawful basis: our legitimate interest in responding to enquiries and developing our business; where your enquiry leads towards an engagement, taking steps at your request prior to entering into a contract.

Enquiries marked for our confidential assurance route are handled with restricted internal access, read only by senior practitioners.

When you use our contact form, we collect the information the form requests (name, email address, organisation, and your message). Form submissions are transmitted encrypted and delivered to our email systems; they are not stored separately on the website.

3.3 Business contacts

In the ordinary course of business, we hold professional contact details and correspondence for the individuals we deal with at clients, prospective clients, partners, associates, and suppliers: typically name, role, organisation, business email address, business telephone number, and the history of our dealings. Lawful bases: performance of a contract (where you or your organisation are party to one with us); otherwise our legitimate interest in managing professional relationships and conducting business development proportionately. We do not send marketing to individuals who have not dealt with us or asked to hear from us, and any such communication includes a simple means of opting out.

3.4 Client engagement data

Our advisory, architecture, and assurance work sometimes brings us into contact with personal data held in client documents, systems, and interviews – for example, names of programme staff in the documentation we review, stakeholder interview records, or personal data incidentally present in datasets whose architecture we assess. Section 5 explains the distinct way this category is handled.

3.5 Data we do not collect

We do not knowingly collect special category data or data relating to children through the website, and we do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

Most personal data we hold comes directly from you. We may also receive it from your colleagues (for example, when you are named as a contact for an engagement), from your organisation, or from publicly available professional sources such as your organisation’s website or LinkedIn, used proportionately for business development.

The nature of our work requires precision here.

Where we act as controller. For the personal data we hold in order to run an engagement – our client contacts, correspondence, contracts, and our own working papers – we are the controller, and this notice applies.

Where we act as processor. Where an engagement requires us to process personal data within a client’s systems, documents, or datasets on the client’s instructions – as can occur in technical audits, data architecture work, or programme healthchecks – we act as a processor on behalf of that client, who remains the controller. That processing is governed by the engagement contract and the client’s own privacy notice, not by this one. Individuals whose data we encounter in this capacity should direct enquiries to the relevant client organisation; we will assist our client in meeting its obligations.

Our standing commitments in engagement work, in whichever role we act: we access personal data only to the extent the engagement genuinely requires; we operate under mutual confidentiality obligations as a default; our deliverables anonymise individuals wherever the finding permits; and we retain engagement materials only as long as Section 8 describes.

We do not sell personal data, and we do not share it with third parties for their own marketing. We share personal data only with:

• Service providers who process it on our instructions under contract: our website hosting and email provider 20i, and our analytics provider Plausible Insights (EU-hosted).
• Professional advisers – our accountants, insurers, and lawyers – where necessary and under duties of confidence;
• Associates and partner firms engaged on a specific piece of work for you, under confidentiality and data protection obligations no weaker than our own, and only with the client’s knowledge;
• Authorities where disclosure is required by law or by a regulator, or is necessary to establish, exercise, or defend legal claims.

We aim to keep personal data in the United Kingdom or the European Economic Area. Some of our service providers may process data in other countries, including the United States; where they do, we rely on UK adequacy regulations or on recognised safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Details of the safeguard applying to any particular transfer are available on request via privacy@meganoesis.com.

We keep personal data no longer than the purpose requires, and our working schedule is:

• Enquiries that do not lead to an engagement: up to 12 months from our last exchange, then deleted;
• Business contact and relationship records: for the life of the relationship and up to 2 years thereafter;
• Engagement records, contracts, and deliverables: 6 years from the end of the engagement, reflecting limitation periods for contractual claims and our professional indemnity obligations;
• Server logs and aggregated analytics: logs for up to 90 days; aggregated analytics contain no personal data;
• Records we must keep by law (for example, accounting records): for the statutory period.

We apply technical and organisational measures proportionate to the sensitivity of what we hold: encrypted transmission and storage, access restricted to those who need it, multi-factor authentication on our systems, segregated handling for confidential assurance enquiries, and contractual obligations on every processor and associate. No transmission over the internet is entirely secure, and we cannot guarantee security absolutely; we can and do treat it as an engineering discipline rather than a paragraph in a policy.

Under UK data protection law you have the right to: request access to the personal data we hold about you; have inaccurate data corrected; have data erased where there is no good reason for us to keep it; object to processing based on legitimate interests, and to any direct marketing; restrict processing in certain circumstances; receive certain data in a portable format; and withdraw consent at any time where consent is the basis we rely on.

To exercise any of these rights, contact privacy@meganoesis.com. We will respond within one month, and we do not charge for requests unless the law permits it. If you are dissatisfied with our handling of your personal data, you are entitled to complain to the Information Commissioner’s Office (ico.org.uk); we would welcome the opportunity to address your concern directly first.

Our site and our materials may link to other organisations’ websites. We are not responsible for their content or their privacy practices.

We review this notice at least annually and whenever our practices change. The effective date at the top records the current version; material changes will be flagged on this page.