Legal

Privacy Policy

How we collect, use, and protect your personal data.

Last updated: 1 June 2026

1. Who We Are

RP Advisory Ltd (trading as RPL) is the data controller responsible for your personal data collected via this website. We are registered in England and Wales under company number 06918359.

For any queries relating to this Privacy Policy or your personal data, you can contact us at suzy@rpltd.co.uk.

2. What This Policy Covers

This Privacy Policy explains how we collect and use personal data from individuals who interact with our website (rpltd.co.uk). It covers data collected through:

  • Our contact enquiry form.
  • Our newsletter sign-up forms.
  • General website usage and analytics.

This policy does not cover personal data processed in the course of our professional services engagements with clients, which is governed by separate contractual arrangements and data processing agreements.

3. What Personal Data We Collect

3.1 Contact Form

When you submit an enquiry via our contact form, we collect:

  • Your full name.
  • Your email address.
  • Your company name.
  • Your selected service of interest.
  • The content of your message.

3.2 Newsletter Sign-up Forms

When you subscribe to our newsletter, we collect:

  • Your email address.

3.3 Website Usage Data

When you visit our website, we may automatically collect certain technical and behavioural information, including:

  • Your IP address (anonymised before storage in our analytics system).
  • Browser type and version.
  • Operating system and device type.
  • Pages visited and time spent on each page.
  • Referring website or search terms that brought you to our site.
  • Date and time of your visit.

This data is collected via Google Analytics cookies and does not directly identify you by name. Please see our Cookie Policy for further details.

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

4.1 Responding to Enquiries

We use the information submitted through our contact form to respond to your enquiry and, where relevant, to provide you with information about our services. We may also retain a record of this correspondence to manage our client relationships.

Legal basis: Legitimate interests — responding to enquiries is a necessary part of operating a professional services business.

4.2 Sending the Newsletter

If you subscribe to our newsletter, we will use your email address to send you deal updates and sector insights that we believe may be of interest to you. You can unsubscribe at any time by clicking the unsubscribe link in any newsletter email or by contacting us directly at suzy@rpltd.co.uk.

Legal basis: Consent — you provide consent when you submit your email address through the newsletter form.

4.3 Improving Our Website

We use anonymised website usage data collected via Google Analytics to understand how visitors use our website and to make improvements to its content, structure, and performance.

Legal basis: Legitimate interests — analysing website performance to improve our online presence.

5. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. The lawful bases we rely on are:

  • Consent (Article 6(1)(a)): For newsletter subscriptions and for analytics cookies (where consent is required).
  • Legitimate interests (Article 6(1)(f)): For responding to enquiries, maintaining business records, and improving our website. We have assessed that our legitimate interests are not overridden by your interests or rights in these contexts.

6. How Long We Retain Your Data

We retain your personal data only for as long as is necessary for the purposes for which it was collected, as follows:

  • Contact form submissions: We retain correspondence for up to 3 years from the date of submission, or longer if required for the purposes of an ongoing business relationship or legal obligation.
  • Newsletter subscriptions: We retain your email address for as long as you remain subscribed. If you unsubscribe, we will remove your address from our mailing list promptly and retain only a suppression record to ensure you are not contacted again.
  • Website analytics data: Google Analytics data is retained for 26 months by default. Raw session data held by Google is subject to Google’s own retention policies.

When data is no longer required, it is securely deleted or anonymised.

7. Who We Share Your Data With

We do not sell, rent, or trade your personal data to third parties. We may share your data with the following trusted third-party service providers, who process it on our behalf and only as necessary to provide us with their services:

  • Netlify, Inc. — Our website hosting provider and form processing platform. When you submit a form on our website, your data is processed and transmitted via Netlify’s infrastructure. Netlify is headquartered in the United States and processes data in accordance with standard contractual clauses and applicable data protection legislation. For more information, see Netlify’s GDPR page.
  • Google LLC — Provider of Google Analytics, used to collect anonymised website usage statistics. For more information, see Google’s Privacy Policy.

We may also disclose your personal data if required to do so by law, by a court order, or by a regulatory authority, or if we believe in good faith that such disclosure is necessary to protect our rights or the rights of others.

8. International Transfers

Some of our third-party service providers are based outside the United Kingdom. Where we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place, such as the use of the UK International Data Transfer Agreement (IDTA) or adequacy decisions issued by the Secretary of State.

9. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access: You have the right to request a copy of the personal data we hold about you.
  • Right to rectification: You have the right to ask us to correct personal data that is inaccurate or incomplete.
  • Right to erasure: You have the right to ask us to delete your personal data in certain circumstances (also known as the “right to be forgotten”).
  • Right to restriction of processing: You have the right to ask us to restrict how we process your data in certain circumstances.
  • Right to data portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
  • Right to object: You have the right to object to processing carried out on the basis of our legitimate interests. Where you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
  • Right to withdraw consent: Where we rely on consent as the legal basis for processing, you may withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing prior to withdrawal.

These rights are not absolute and may be subject to exemptions under applicable law. We will respond to all valid requests within one calendar month of receipt.

10. How to Exercise Your Rights

To exercise any of the rights listed above, or to make any other data protection-related enquiry, please contact us at suzy@rpltd.co.uk.

We may need to verify your identity before responding to your request. We will not charge a fee for handling your request unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act on the request.

11. Right to Complain to the ICO

If you are not satisfied with how we have handled your personal data or your rights request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection matters.

  • Website: ico.org.uk
  • Telephone: 0303 123 1113
  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the opportunity to address your concerns before you contact the ICO, so please do get in touch with us in the first instance.

12. Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include the use of HTTPS encryption for all data transmitted via this website and secure access controls for any data we store.

While we take every reasonable step to protect your data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security, but we will notify you and any applicable regulator of any data breach where we are legally required to do so.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The revised policy will be published on this page with an updated “Last updated” date. We encourage you to review this page periodically. Where changes are material, we will take reasonable steps to bring them to your attention.

14. Contact Us

For any questions or concerns about this Privacy Policy or about how we handle your personal data, please contact us at suzy@rpltd.co.uk.