Last updated: 15 October 2026
This Privacy Policy explains how BoardroomUK collects, uses, shares and protects personal data when you visit boardroomuk.com, contact us, send us a project brief, order our services or subscribe to our updates. It also explains the rights you have over your information and how to exercise them.
This policy is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025. If anything is unclear, please contact us using the details in section 15.
1. Who we are
BoardroomUK is a board advisory, governance and growth consultancy for small and medium-sized enterprises, scale-ups, family businesses and investor-backed companies. For the purposes of UK data protection law, BoardroomUK is the controller of the personal data described in this policy, which means we decide how and why it is processed.
| Detail | Information |
|---|---|
| Trading name | BoardroomUK |
| Website | https://boardroomuk.com |
| Postal address | Babarsari Sleman, No 23 Ruko Biru Kab. Sleman, London, United Kingdom |
| [email protected] | |
| Telephone | +44 824 – 2637 – 8823 / +44 813 – 3445 – 9349 |
| Registered company details | Available on request |
We have not appointed a statutory Data Protection Officer because we are not required to do so, but a named member of our team is responsible for data protection matters. You can reach them at support@boardroomuk.com with the subject line “Data Protection”.
2. Scope of this policy
This policy applies to personal data we process about:
- visitors to our website;
- people who contact us by email, telephone or through the forms on our website;
- prospective and current clients, and the individuals who work for them, including directors, founders, investors and their advisers;
- people who create an account on our website or place an order for our services;
- people who subscribe to our newsletter or other updates.
When we deliver advisory services, we may also process personal data that a client shares with us as part of an engagement (for example, board papers, data room contents or information about directors and employees). That processing is governed by the engagement terms we agree with the client, which will explain whether we act as a controller or as a processor in each case.
3. The personal data we collect
We collect only the information we need for the purposes described in this policy. The categories are set out below.
3.1 Contact forms and enquiries
Our contact form and project brief form are powered by the Contact Form 7 plugin for WordPress. When you submit one of these forms, we collect the information you enter, which typically includes your name, email address, telephone number, company name, job title and the content of your message. Form submissions are sent to us by email and may be stored in our mailbox and in our customer relationship management (CRM) records so that we can respond and follow up.
3.2 Project briefs
If you use our Start a project form, we may also collect details about your organisation, its size and sector, the services you are interested in, your timescales, an indicative budget and any background you choose to provide about your board, governance arrangements or plans. Please do not include special category data (such as health information) or confidential third-party information in a project brief unless we have asked for it.
3.3 Orders and accounts
Our website uses WooCommerce to manage orders for services. If you place an order or create an account, we collect your name, company name, billing address, email address, telephone number, the services ordered, order history and any notes you add. If you create an account, we also store your username and a securely hashed password.
Orders are placed using a “request an invoice” process. We do not collect or store payment card details on our website. We issue an invoice and you pay by the method shown on the invoice. We keep records of invoices and payments received for accounting and tax purposes.
3.4 Newsletter and updates
If you subscribe to our newsletter or updates, we collect your email address and, if you provide them, your name and areas of interest. We keep a record of when and how you subscribed and of any request to unsubscribe.
3.5 Technical and security data
When you visit our website, our web server and security software automatically process certain technical information, including your IP address, browser type and version, device type, operating system, the pages you request, the date and time of your visit and the referring page. Our site uses the Wordfence security plugin and WP Hide & Security Enhancer to protect against attacks. Wordfence processes IP addresses and request information to operate a firewall, detect malicious traffic, limit login attempts and block abusive activity.
3.6 Cookies and similar technologies
We use a small number of cookies and a local browser storage item. These include cookies needed for the shopping cart and checkout, login cookies for account holders, a security cookie for logged-in users and a cookie that records your cookie consent choices. Our SEO plugin does not set cookies on visitors’ devices. Full details are in our Cookie Policy.
We do not install Google Analytics or advertising pixels on our website by default. If we decide to add analytics or marketing tools in future, they will only run after you have given consent through our cookie banner, and we will update this policy and our Cookie Policy before doing so.
3.7 Information from other sources
We may receive information about you from other sources, such as a colleague who introduces you, the Companies House register or your organisation’s website. We use this only to understand who we are dealing with and prepare for conversations you have asked for.
4. How we use your personal data
We use personal data to:
- respond to enquiries and arrange consultations;
- review project briefs and prepare proposals or quotations;
- process orders, issue invoices, record payments and manage client accounts;
- deliver, manage and improve our advisory services;
- send service messages, such as order confirmations, invoices and changes to our terms;
- send newsletters and updates where you have subscribed or where the law otherwise allows;
- keep our website and systems secure, prevent fraud and detect misuse;
- remember your cookie choices and interface preferences;
- keep business, accounting and tax records;
- establish, exercise or defend legal claims and comply with our legal and regulatory obligations.
We do not sell your personal data, and we do not use it to make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects.
5. Our lawful bases for processing
Under UK GDPR we must have a lawful basis for each purpose for which we use personal data. The table below summarises them.
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Responding to contact form and email enquiries | Name, contact details, company, message | Legitimate interests (responding to people who contact us); or steps taken at your request before entering a contract |
| Reviewing project briefs and preparing proposals | Contact details, organisation details, project information | Steps taken at your request before entering a contract; legitimate interests where you act for a business |
| Processing orders, invoicing and managing accounts | Contact, billing and order details; account credentials | Performance of a contract |
| Delivering advisory services | Client contact details and engagement information | Performance of a contract; legitimate interests (where the contract is with your employer) |
| Keeping accounting and tax records | Invoices, payment and order records | Legal obligation |
| Sending newsletters to subscribers | Email address, name, preferences | Consent |
| Sending relevant updates to existing clients (where permitted by PECR) | Email address, name | Legitimate interests, relying on the PECR “soft opt-in” or business-to-business rules, with an easy opt-out in every message |
| Website security, firewall and fraud prevention | IP address, request and log data | Legitimate interests (protecting our website, users and systems) |
| Strictly necessary cookies (cart, login, security, consent record) | Cookie identifiers and settings | Legitimate interests; exempt from consent under PECR because they are strictly necessary |
| Optional analytics or marketing cookies (if introduced) | Cookie identifiers, usage data | Consent |
| Handling complaints, legal claims and requests from authorities | Any relevant information | Legal obligation; legitimate interests (defending our legal position) |
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms. You can ask us for more information about this assessment, and you have the right to object (see section 11).
6. Who we share your personal data with
We share personal data only where necessary and with organisations that are required to protect it. The categories of recipient are:
- Website hosting provider: our website and its database are hosted by a third-party hosting company, which stores the data on our behalf.
- Email and productivity provider: form submissions and correspondence are held in our business email and productivity systems.
- CRM and business software providers: tools we use to manage client relationships, proposals, invoicing and accounting.
- Security service providers: providers of security software and threat intelligence that help protect our website.
- Consent management provider: the provider of our cookie consent banner, which records your choices.
- Professional advisers: our accountants, lawyers, insurers and auditors, where needed for them to advise us or to meet our obligations.
- Associates and subcontractors: where an engagement involves an approved associate, such as a non-executive director or fractional director introduced through us, we share only what is needed for that engagement and with your organisation’s agreement.
- Authorities and regulators: HMRC, law enforcement agencies, courts and regulators, where we are legally required to do so or where it is necessary to prevent fraud or protect rights.
- Business transferees: a prospective buyer or successor if we sell or restructure all or part of our business, subject to appropriate confidentiality protections.
Our service providers act as processors on our instructions under written contracts that require them to keep personal data secure and use it only for the services they provide to us.
7. International transfers
Some of our service providers may store or access personal data outside the United Kingdom. Where personal data is transferred outside the UK, we make sure it is protected by one of the following safeguards:
- the destination is covered by UK adequacy regulations (sometimes called “data bridges”), which recognise that the country, territory or framework provides an adequate level of protection;
- we use the International Data Transfer Agreement (IDTA) issued by the Information Commissioner; or
- we use the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses (the “Addendum”).
Where we use the IDTA or the Addendum, we carry out a transfer risk assessment and put in place any additional measures needed. You can contact us for more information about the safeguards that apply to a particular transfer.
8. How long we keep your personal data
We keep personal data only for as long as necessary for the purposes for which we collected it, including to meet legal, accounting and reporting requirements. Typical retention periods are set out below.
| Type of data | Retention period |
|---|---|
| General enquiries that do not lead to an engagement | Up to 24 months after our last contact |
| Project briefs and proposals that do not proceed | Up to 24 months after the proposal date |
| Client records and engagement files | The duration of the engagement plus 6 years, to cover the limitation period for legal claims |
| Orders, invoices and accounting records | 6 years from the end of the financial year to which they relate |
| Website account data | Until you close your account, then up to 12 months unless linked to orders we must retain |
| Newsletter subscriptions | Until you unsubscribe; we keep a minimal suppression record so we do not contact you again |
| Security and firewall logs | Usually up to 90 days, or longer where needed to investigate a security incident |
| Cookie consent record | 12 months in your browser, after which we ask again |
| Complaints and legal claims | Up to 6 years after the matter is closed |
When retention periods end, we delete or securely destroy the data or anonymise it so that it can no longer identify you.
9. How we keep your data secure
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse and alteration. These include:
- encrypting traffic to and from our website using HTTPS;
- a web application firewall, login protection and malware scanning provided by our security plugins;
- hardening measures that reduce the visibility of our website’s underlying configuration to attackers;
- strong passwords and multi-factor authentication for administrative access where available;
- restricting access to personal data to people who need it for their role;
- keeping our software, themes and plugins up to date;
- regular backups.
No method of transmission over the internet is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commission (ICO) within 72 hours where required, and we will tell you without undue delay if the breach is likely to result in a high risk to you.
Tip: When sharing confidential board papers or transaction documents with us, ask about using a secure data room rather than email attachments. We will be happy to agree the most appropriate method.
10. Marketing communications
We send newsletters only to people who have subscribed, and we may send relevant updates to existing clients and business contacts where PECR allows. Every marketing email includes a link to unsubscribe, and you can also opt out at any time by emailing support@boardroomuk.com. Opting out of marketing does not affect service messages about orders or engagements you have with us.
11. Your rights
Under UK data protection law you have the following rights. Some rights apply only in certain circumstances.
11.1 Right of access
You can ask for a copy of the personal data we hold about you, together with information about how we use it. This is often called a subject access request.
11.2 Right to rectification
You can ask us to correct personal data that is inaccurate or to complete data that is incomplete.
11.3 Right to erasure
You can ask us to delete your personal data where, for example, it is no longer needed or you have withdrawn consent. We may need to keep some information to meet legal obligations or to deal with legal claims.
11.4 Right to restriction of processing
You can ask us to limit how we use your data, for example while we check its accuracy or consider an objection.
11.5 Right to data portability
Where we process data you have provided to us on the basis of consent or a contract, and the processing is automated, you can ask us to provide it in a structured, commonly used, machine-readable format or to transmit it to another organisation.
11.6 Right to object
You can object to processing based on our legitimate interests. You have an absolute right to object to direct marketing, and we will stop when you ask.
11.7 Right to withdraw consent
Where we rely on consent, you can withdraw it at any time, for example by unsubscribing from our newsletter or changing your choices through the “Cookie Settings” link on our website. Withdrawing consent does not affect processing carried out before you withdrew it.
11.8 Rights relating to automated decision-making
You have rights in relation to decisions made solely by automated means that have legal or similarly significant effects on you. We do not make such decisions, but if that changes we will tell you and explain your rights to human intervention and to challenge the decision.
11.9 How to exercise your rights
To exercise any of these rights, email support@boardroomuk.com with the subject line “Data Protection Request” or write to us at our postal address. We may need to verify your identity before responding. We will respond within one month of receiving your request, or within one month of receiving any information we need to verify your identity. If your request is complex or you have made several requests, we may extend this by up to two further months and will tell you why. We do not usually charge a fee.
12. How to complain
If you have a concern about how we handle your personal data, please contact us first so that we can try to resolve it. We will acknowledge your complaint within 30 days of receiving it, as the Data Protection Act 2018 requires, investigate it without undue delay and tell you the outcome.
You also have the right to complain to the Information Commission, which replaced the Information Commissioner on 30 September 2026 and is still known as the ICO. It is the UK supervisory authority for data protection. You can contact the ICO through its website at ico.org.uk or by calling its helpline on 0303 123 1113.
13. Children
Our website and services are intended for businesses and adults acting in a professional capacity. They are not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
14. Links to other websites
Our website links to other websites. We are not responsible for their privacy practices, so please read their privacy notices before providing personal data.
15. Changes to this policy and contact details
15.1 Changes
We may update this policy to reflect changes in the law, our services or our technology. The “Last updated” date shows when it was last revised. We will highlight significant changes, such as introducing analytics cookies, on our website or tell you directly where appropriate.
15.2 Contact us
If you have any questions about this policy or how we handle personal data, please contact us:
- Email: support@boardroomuk.com (subject line “Data Protection”)
- Telephone: +44 824 – 2637 – 8823 or +44 813 – 3445 – 9349
- Post: BoardroomUK, Babarsari Sleman, No 23 Ruko Biru Kab. Sleman, London, United Kingdom
You can also use our contact page. Please read this policy alongside our Terms & Conditions and Cookie Policy.