Last updated: 9 October 2026
This policy explains how Adelie Sustainability Ltd collects, uses and protects personal data, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.
1. Who we are
Adelie Sustainability Ltd (“Adelie”, “we”, “us”) is the controller of the personal data described in this policy. We are a company registered in England and Wales (company number 15997857) at Stable Cottage, Manor Court, Follifoot, Harrogate, HG3 1UB, United Kingdom.
For any question about this policy or your personal data, contact us at contact@adelie.eco or by post at the address above, marked “Data Protection”.
This policy covers website visitors, people who contact us or book a meeting, and contacts at our clients, prospective clients, suppliers and partners. When we process personal data on a client’s behalf as part of an engagement, the client is the controller and our contract with them governs that processing.
2. Personal data we collect
We collect only business-related personal data, mostly directly from you.
People who use our contact forms: Name, email address, organisation, job title, phone number (if given), message content; You
People who book a meeting: Name, email address, meeting time and any notes you add; You, via our booking tool
Clients and prospective clients: Name, job title, organisation, business contact details, correspondence, meeting notes; You, your colleagues, public sources such as company websites and LinkedIn
Suppliers and partners: Name, job title, business contact details, correspondence, payment and invoicing details for the business; You or your organisation
Website visitors: Pages visited, referring site, device and browser type, approximate location (country or city), interaction data. Collected only if you accept analytics cookies; Your browser
We do not intentionally collect special category data (such as health information) and ask you not to include it in messages to us.
3. How we use personal data and our lawful basis
Responding to enquiries and arranging meetings: Legitimate interests: replying to people who contact us
Preparing proposals and tender responses: Legitimate interests: developing our business; or steps at your request before entering a contract
Delivering services to clients and managing the relationship: Performance of a contract; or legitimate interests where the contract is with your organisation rather than with you
Managing suppliers and partners, invoicing and payments: Performance of a contract; legitimate interests
Keeping accounting, tax and business records: Legal obligation
Sending occasional updates relevant to existing business contacts: Legitimate interests (PECR soft opt-in for existing contacts). You can opt out at any time
Understanding how our website is used: Consent, given through our cookie banner
Establishing, exercising or defending legal claims: Legitimate interests
Where we rely on legitimate interests, we have considered your rights and balanced them against our interests. You can ask us for details. We do not sell personal data, and we do not use it for automated decision-making that has legal or similarly significant effects on you.
4. Cookies and analytics
We use analytics cookies, provided by a third-party analytics service, only if you accept them in our cookie banner. Until you do, analytics cookies are not set. We keep analytics data for no longer than 14 months.
You can change or withdraw your choice at any time through Cookie Settings in the website footer. Our Cookie Policy (link to /cookie-policy) explains the cookies we use and how to manage them.
5. Who we share personal data with
We share personal data only with service providers that process it on our instructions under a written contract, and only as far as needed for the purposes above.
These service providers fall into the following categories:
website hosting and form providers
email, document and file storage providers
workflow automation and integration tools
client relationship and project management systems
meeting scheduling tools
website analytics providers (with your consent only)
IT, security and communications providers
A list of our current service providers is available on request.
We may also share personal data with professional advisers (such as accountants and lawyers), with partner firms where you have asked us to involve them in a project, with a buyer or successor if our business is reorganised or sold, and with authorities where the law requires it.
6. International transfers
Some of our service providers access personal data from outside the UK. We transfer personal data outside the UK only where it is protected by one of these safeguards:
UK adequacy regulations. These cover the European Economic Area, among others.
The UK Extension to the EU-US Data Privacy Framework. This applies to US providers certified under it.
The UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We use these, with a transfer risk assessment, for all other transfers.
You can ask us for more information about the safeguard that applies to a particular transfer.
7. How long we keep personal data
We keep personal data only as long as we need it for the purposes above. Retention periods run from our last contact or engagement, so data about people we are actively working with is kept while that relationship continues. At the end of the period we delete the data or anonymise it so it no longer identifies anyone.
Enquiries that do not lead to work: 2 years from our last contact
Business contacts receiving our updates: Until you opt out, or 2 years without any interaction
Client and project records: 6 years after the engagement ends
Supplier, partner and financial records: 6 years from the end of the financial year they relate to
Website analytics data: Up to 14 months
We may keep data longer where the law requires it or to deal with a legal claim.
8. How we protect personal data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include:
encryption in transit and at rest
multi-factor authentication on all business accounts
access limited to staff who need it
confidentiality obligations and data protection training for our team
contracts with our service providers that require equivalent protection
If a personal data breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell you without undue delay where required.
9. Your rights
Under UK data protection law you have the right to:
access the personal data we hold about you
have inaccurate data corrected
have your data erased
restrict how we use your data
object to processing based on legitimate interests, and to direct marketing at any time
receive your data in a portable format, where processing is based on consent or contract
withdraw consent at any time, without affecting earlier processing
To exercise any of these rights, email contact@adelie.eco. We will respond within one month, and there is normally no charge. We may need to confirm your identity first.
10. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint or on 0303 123 1113.
11. Changes to this policy
We will update this policy when our processing changes and revise the date at the top. Significant changes will be highlighted on our website.
