Built for scale. Designed for humans.Governance
This Privacy Policy describes how Black Opal Solutions Ltd ("Black Opal", "we", "us", or "our") collects, uses, stores, and discloses personal data in connection with our website, products, and professional services. This policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other applicable data protection legislation.
By accessing our website or engaging our services, you acknowledge that you have read and understood this policy. If you do not agree with the terms set out herein, you must cease use of our services immediately.
This Privacy Policy describes how Black Opal Solutions Ltd ("Black Opal", "we", "us", or "our") collects, uses, stores, and discloses personal data in connection with our website, products, and professional services. This policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and any other applicable data protection legislation.
By accessing our website or engaging our services, you acknowledge that you have read and understood this policy. If you do not agree with the terms set out herein, you must cease use of our services immediately.
This is our Privacy Policy — it explains what personal information we collect about you, why we collect it, and what we do with it. We've written it to be as clear as possible alongside the full legal version.
We follow UK data protection law (UK GDPR). If you use our website or work with us, this policy applies to you.
We collect and process the following categories of personal data:
Where you choose to contact us via our website contact form, we collect:
We do not collect contact information unless you actively provide it.
We process technical data under our legitimate interests (Article 6(1)(f) UK GDPR) to operate and secure our website infrastructure. You may object to this processing at any time.
We collect and process the following categories of personal data:
Where you choose to contact us via our website contact form, we collect:
We do not collect contact information unless you actively provide it.
We process technical data under our legitimate interests (Article 6(1)(f) UK GDPR) to operate and secure our website infrastructure. You may object to this processing at any time.
Here's a plain-English breakdown of what information we collect about you.
We only collect your personal details if you choose to reach out via our contact form:
That's it. We don't collect your phone number, and we don't collect anything about you passively.
We use this to keep the website running properly and understand how it's used in aggregate. Our analytics are fully anonymous — we never identify individual visitors.
We use personal data only for the purposes described below, and only to the extent necessary:
Where you contact us via our website, we use the information you provide solely to respond to your enquiry. We do not add you to mailing lists or use this for marketing without your explicit consent.
Where you have consented, we may send service-related communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
To unsubscribe from any marketing communications, click the unsubscribe link in any email or contact us directly at [email protected].
We use PostHog (PostHog Inc.) to collect anonymised usage data about how visitors interact with our website. Our analytics implementation does not link visitor activity to any personal identity. PostHog processes all data on EU-based infrastructure and does not use this data for advertising. Analytics requests are proxied through our own domain to reduce third-party exposure. PostHog acts as a data processor on our behalf under a Data Processing Agreement.
For more detail, see our Cookie Policy.
To comply with legal obligations, including financial record-keeping requirements, and to exercise or defend legal claims.
We use personal data only for the purposes described below, and only to the extent necessary:
Where you contact us via our website, we use the information you provide solely to respond to your enquiry. We do not add you to mailing lists or use this for marketing without your explicit consent.
Where you have consented, we may send service-related communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
To unsubscribe from any marketing communications, click the unsubscribe link in any email or contact us directly at [email protected].
We use PostHog (PostHog Inc.) to collect anonymised usage data about how visitors interact with our website. Our analytics implementation does not link visitor activity to any personal identity. PostHog processes all data on EU-based infrastructure and does not use this data for advertising. Analytics requests are proxied through our own domain to reduce third-party exposure. PostHog acts as a data processor on our behalf under a Data Processing Agreement.
For more detail, see our Cookie Policy.
To comply with legal obligations, including financial record-keeping requirements, and to exercise or defend legal claims.
We keep this simple — we only use your data for the reasons below, and nothing else.
If you contact us through our website, we use the information you gave us to reply. That's all. We won't add you to a mailing list or use it for anything else without asking first.
If you've opted in, we may occasionally send you updates about our work. You can unsubscribe any time — no hard feelings.
Every marketing email has an unsubscribe link at the bottom. One click and you're off the list. You can also email us at [email protected].
We use PostHog to understand how people use our site in aggregate. Our setup is fully anonymous — we never identify individual visitors or build profiles. All data stays on EU servers and isn't used for advertising. See our Cookie Policy for the full picture.
Sometimes we're legally required to keep certain records — like financial documents. We have to hold onto those whether we like it or not.
We retain personal data for no longer than is necessary for the purposes set out in this policy:
| Category | Retention Period |
|---|---|
| Client engagement records | 7 years from end of engagement |
| Prospective client enquiries | 2 years from last contact |
| Website analytics (PostHog) | 13 months rolling (cookie lifetime) |
| Legal correspondence | 6 years from resolution |
Where personal data is no longer required for its original purpose, we apply pseudonymisation or erasure in accordance with our internal data lifecycle procedures.
We retain personal data for no longer than is necessary for the purposes set out in this policy:
| Category | Retention Period |
|---|---|
| Client engagement records | 7 years from end of engagement |
| Prospective client enquiries | 2 years from last contact |
| Website analytics (PostHog) | 13 months rolling (cookie lifetime) |
| Legal correspondence | 6 years from resolution |
Where personal data is no longer required for its original purpose, we apply pseudonymisation or erasure in accordance with our internal data lifecycle procedures.
We don't keep your data forever. Here's roughly how long we hold different types:
| Category | How long |
|---|---|
| Client records | 7 years after we finish working together |
| Enquiries that didn't lead to work | 2 years |
| Website analytics (PostHog) | 13 months |
| Legal correspondence | 6 years |
Once we no longer need your data, we delete or anonymise it. We don't hoard information.
Under UK GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you (a Subject Access Request, or SAR). We will respond within one calendar month. Where processing is carried out by automated means on the basis of your consent or a contract, you have the right to receive your data in a structured, commonly used, machine-readable format.
You have the right to request correction of inaccurate personal data and, in certain circumstances, to request its erasure. Erasure requests are subject to our legal retention obligations.
The right to erasure does not apply where we are required to retain data under a legal obligation, such as statutory financial record-keeping requirements under the Companies Act 2006.
You may object to processing based on legitimate interests or direct marketing, and may request that we restrict processing whilst we verify the accuracy of your data or consider an objection.
Under UK GDPR, you have the following rights regarding your personal data:
You have the right to request a copy of the personal data we hold about you (a Subject Access Request, or SAR). We will respond within one calendar month. Where processing is carried out by automated means on the basis of your consent or a contract, you have the right to receive your data in a structured, commonly used, machine-readable format.
You have the right to request correction of inaccurate personal data and, in certain circumstances, to request its erasure. Erasure requests are subject to our legal retention obligations.
The right to erasure does not apply where we are required to retain data under a legal obligation, such as statutory financial record-keeping requirements under the Companies Act 2006.
You may object to processing based on legitimate interests or direct marketing, and may request that we restrict processing whilst we verify the accuracy of your data or consider an objection.
You have real rights over your personal data. Here's what you can ask us to do.
You can ask us what data we hold about you — this is called a Subject Access Request. We'll get back to you within a month. You can also ask for a copy in a format you can use elsewhere (like a CSV or JSON file).
If something is wrong, we'll fix it. If you want your data deleted and we don't have a legal reason to keep it, we'll delete it.
We sometimes can't delete your data even if you ask — for example, if we're legally required to keep financial records. We'll always tell you why if this applies to you.
Don't want us using your data for a particular reason? You can object. You can also ask us to put a hold on processing while we sort something out.
Black Opal Solutions Ltd is the data controller for personal data processed in connection with our website and services. Registered in England and Wales (company number 17156967) and registered with the UK Information Commissioner's Office under reference C1917828.
Contact: [email protected]
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your personal data has been processed unlawfully.
We encourage you to contact us directly before lodging a formal complaint — most issues can be resolved quickly and informally. We aim to respond to all privacy enquiries within 5 business days.
Black Opal Solutions Ltd is the data controller for personal data processed in connection with our website and services. Registered in England and Wales (company number 17156967) and registered with the UK Information Commissioner's Office under reference C1917828.
Contact: [email protected]
You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your personal data has been processed unlawfully.
We encourage you to contact us directly before lodging a formal complaint — most issues can be resolved quickly and informally. We aim to respond to all privacy enquiries within 5 business days.
Black Opal Solutions Ltd is responsible for your data. We're registered in England and Wales (company number 17156967) and registered with the ICO under reference C1917828.
Email us: [email protected]
If you think we've mishandled your data, you can complain to the ICO (Information Commissioner's Office) at ico.org.uk. They're the UK's data watchdog.
Most issues are easy to sort out directly. Drop us an email and we'll aim to get back to you within 5 working days — no need to involve the ICO unless things go wrong.
Generated at — on —
This document reflects the policy as it stands at the time of download and may be updated at any time without notice. You are responsible for checking this page regularly for the latest version.