Privacy at a glance
Privacy notice
This notice explains what personal information Elite Insight uses, why we use it, who it may reach and the choices and rights available to you.
- Effective
- 9 October 2026
- Last reviewed
- 9 October 2026
Who is responsible.
Elite Insight Limited is the controller responsible for the personal information described in this notice. We are registered in England and Wales under company number 06309876. Our registered office is Unit 4 Hurricane Drive, Speke, Liverpool, England, L24 8RL.
For privacy questions, rights requests or data-protection complaints, contact:
- Info@eliteinsight.co.uk
- Post
- Privacy, Elite Insight Limited, Unit 4 Hurricane Drive, Speke, Liverpool, England, L24 8RL
Who this notice applies to.
This notice applies when you:
- visit the Elite Insight website;
- contact us or ask us to consider potential work;
- are a client, prospective client or contact at a client organisation;
- introduce yourself for potential work through the Elite Insight consultant network;
- work with us as a consultant, supplier, professional adviser or delivery partner; or
- otherwise communicate with us in a business capacity.
The website and our services are intended for organisations and adults acting in a professional capacity. They are not directed at children, and we do not knowingly collect children's personal information through the website. Contact us if you believe a child has provided information to us.
When Elite Insight handles personal information solely on a client's documented instructions during an engagement, the client will normally be the controller and Elite Insight will act as a processor. The client's privacy information then explains that use. We remain a controller for our own relationship, administration, security, legal and professional records.
What information we use.
| Context | Information | Where it comes from |
|---|---|---|
| Website use | IP address, device and browser information, requested pages, date and time, referring page, security events, and privacy choices | Your browser or device; website hosting, security and consent systems |
| Contact enquiry | First name, last name, work email, organisation if supplied, message and subsequent correspondence | You; your organisation or an authorised colleague |
| Client relationship | Business contact details, role, meeting and correspondence records, proposals, contracts, instructions, delivery records, billing and payment information | You; your organisation; authorised colleagues; professional advisers |
| Consultant-network introduction | First name, last name, work email, location and working reach, experience and outcomes, professional-profile address if supplied, correspondence and review notes | You; the professional profile you identify; information you make public professionally |
| Supplier, adviser or delivery relationship | Business contact details, role, correspondence, contracts, due-diligence information, billing and payment records | You; your organisation; authorised colleagues; public or commercial sources where verification is necessary |
| Rights request or complaint | Contact details, the request or concern, identity or authority evidence where reasonably necessary, correspondence and outcome | You; a person authorised to act for you; our relevant records |
Please do not send confidential client information, special-category information or criminal-offence information through the Contact or Join Our Network forms. Special-category information includes information about health, race or ethnicity, religious or philosophical beliefs, political opinions, trade-union membership, genetics, biometrics used for identification, sex life or sexual orientation.
If you provide information about another person, you must be entitled to do so and, where appropriate, make this notice available to them.
We may receive business contact details from your organisation, an authorised colleague, a professional adviser, a public professional profile or another legitimate business source. Where Article 14 of the UK GDPR requires us to notify you directly, we will do so within a reasonable period and no later than one month after obtaining the information, or earlier at our first communication with you or first disclosure to another recipient, unless a legal exception applies.
How and why we use it.
We use personal information only where we have a lawful basis. The basis depends on the purpose and the relationship involved.
| Purpose | Information normally used | Lawful basis |
|---|---|---|
| Respond to an enquiry and discuss possible work | Contact details, organisation, message and correspondence | Steps requested before entering a contract where that applies; otherwise our legitimate interests in understanding and responding to relevant business enquiries |
| Prepare, enter into and manage an engagement | Contact, proposal, contract, instruction, delivery, billing and payment records | Contract where you are personally party to it; our legitimate interests in managing an engagement with an organisation; legal obligation for required records |
| Maintain client and professional relationships | Business contact details, role, correspondence and relationship records | Our legitimate interests in managing professional relationships, understanding relevant needs and communicating about active or potential work |
| Assess a consultant-network introduction | Introduction information, professional profile, correspondence and review notes | Our legitimate interests in assessing relevant expertise and maintaining a proportionate network of potential independent specialists |
| Manage suppliers, advisers and delivery partners | Contact, due-diligence, contract, delivery, billing and payment records | Contract where applicable; our legitimate interests in procuring and managing services; legal obligation for required records |
| Operate, protect and troubleshoot the website and systems | Technical, usage and security information | Our legitimate interests in providing a functioning service, preventing misuse and protecting systems and information |
| Meet legal, accounting, regulatory and professional requirements | Relevant relationship, transaction, request and incident records | Legal obligation; our legitimate interests in establishing, exercising or defending legal rights and maintaining appropriate governance |
| Handle rights requests and data-protection complaints | Request, identity or authority evidence where necessary, correspondence and outcome | Legal obligation; our legitimate interests in investigating concerns and demonstrating an appropriate response |
Our legitimate interests
Where we rely on legitimate interests, the interests are to:
- respond to relevant business enquiries;
- develop and manage client, consultant, supplier and professional relationships;
- identify the independent expertise that may be relevant to future client work;
- operate and protect our website, communications and business systems;
- administer the business and maintain appropriate records; and
- establish, exercise or defend legal and contractual rights.
We use legitimate interests only where the processing is necessary and our interests are not overridden by your rights and interests. We record that assessment and apply proportionate limits, access controls and opt-out routes. You can object to processing based on legitimate interests; see Your rights.
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal. We do not use a form acknowledgement as consent to marketing.
If information is not provided
You are not required to submit either website form. If you do not provide information marked as required, we may be unable to receive or respond to the enquiry or assess the consultant-network introduction. Where information is needed for a contract or legal obligation, we will explain that requirement and the likely consequence at the relevant time.
Consultant-network introductions.
The Join Our Network route is for experienced independent consultants and specialists. It is not an application for employment or a current vacancy.
We use the information you submit to assess whether your experience could be relevant to future client work, make proportionate review notes and contact you where there appears to be a relevant fit. Sending an introduction does not guarantee inclusion in the network or an assignment.
We do not ask for a CV, identity documents, right-to-work evidence, references, day rate, criminal-record information or special-category information at the initial-introduction stage. If a specific opportunity later requires additional due diligence, we will explain the information, purpose, lawful basis, recipients and retention before collecting it.
We may review the professional-profile address you provide and other professional information you have made public. We do not use solely automated decision-making to accept or reject network introductions.
Website technology.
Our Cookie Notice identifies the cookies and other storage or access technologies found on the production website, what each one does, its provider and duration, and how you can consent, withdraw consent or object where applicable.
Where consent is required, the technology remains off until you agree. Where a PECR exception applies, we document why its conditions are met and provide any required objection route. A PECR exception is not itself a UK GDPR lawful basis for processing personal information.
Elite Insight does not make decisions about you that have legal or similarly significant effects solely by automated means.
Who information may reach.
We do not sell personal information.
We share it only where necessary and proportionate with:
- website hosting, security, form-delivery, email, collaboration, document-management and other technology providers that support our operations;
- accountants, lawyers, insurers and other professional advisers;
- consultants, suppliers and delivery partners where access is necessary for authorised work and subject to appropriate confidentiality and data-protection terms;
- a client or prospective client where this is necessary to consider or deliver authorised work and you have been told about the context;
- public authorities, regulators, courts or law-enforcement bodies where disclosure is required or legally permitted; and
- parties and advisers involved in a proposed sale, investment, restructuring or transfer of the business, subject to appropriate protections.
Service providers may use information only to provide the contracted service or as otherwise permitted by law. We apply access limits and contractual safeguards appropriate to the information and purpose.
Service providers
| Provider or category | Service and purpose | Information involved | Role | Location and transfer mechanism |
|---|---|---|---|---|
| Website host and content-delivery or security provider: Hostinger International Ltd | Deliver and protect the website; create necessary technical and security logs | IP, device, request and security information | Processor | United Kingdom |
| Form-delivery provider: Formspree, Inc. | Validate and deliver Contact and Join Our Network submissions | Submitted form content and technical delivery data | Processor | United States, under Standard Contractual Clauses |
| Email and collaboration provider: Microsoft (Microsoft 365) | Receive, respond to and retain relevant communications and working records | Contact, correspondence and relationship records | Processor | United Kingdom |
| None. The website’s own privacy control | Record and honour your analytics choice | Your choice, the notice version and the date, stored in your browser | Not applicable | Your device only |
| Analytics provider: Google (Google Analytics 4) | Produce website statistics, only where you have accepted analytics | Randomly generated browser and visit identifiers (the _ga and _ga_6GXK6F8JJN cookies), the pages you view, the referring page, the time of your visit, device, browser and operating-system details, and an approximate location derived from your IP address. Google signals and advertising personalisation are turned off. | Processor | United States, under the UK Extension to the EU–US Data Privacy Framework |
| Anti-abuse provider: Formspree, Inc., as part of form delivery | Detect and limit automated or spam submissions | Submitted form content and technical submission data, such as IP address and browser details | Processor | As for the form-delivery provider above |
International transfers.
Some providers may store or access personal information outside the United Kingdom. Where this is a restricted transfer, we use a lawful transfer mechanism. This may be UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, together with the required transfer assessment and supplementary measures. Contact us for further information about the safeguard relevant to your information.
How long information is kept.
We keep personal information only for as long as it is reasonably needed for the purpose described, including applicable legal, accounting, contractual, security and dispute requirements. We then delete or anonymise it securely, subject to controlled backup cycles and any legal hold.
| Record | Period or criterion |
|---|---|
| Contact enquiry that does not become an engagement | 24 months after the last meaningful contact |
| Proposal or prospective-client record | 24 months after the proposal closes or the last meaningful contact, unless a longer period is needed for an active dispute or recorded business reason |
| Client contract, delivery, billing and material correspondence | 6 years after the engagement and final account close, or longer where a legal, regulatory, insurance or dispute requirement applies |
| Consultant-network introduction not retained for future fit | 12 months after the review decision or last meaningful contact |
| Active consultant-network record | Review at least every 24 months; delete 24 months after the last meaningful contact unless continued retention is confirmed and justified |
| Consultant or delivery-partner engagement record | 6 years after the engagement and final account close, subject to longer legal, insurance or dispute requirements |
| Supplier contract, billing and material correspondence | 6 years after the relationship and final account close |
| Website and security logs | 90 days, unless an event requires restricted retention for investigation or legal claims |
| Form-transmission logs that do not contain the message body | 30 days after confirmed delivery, unless needed to investigate delivery or abuse |
| Consent, withdrawal and objection evidence | Your privacy choice is stored in your browser for 180 days, and Elite Insight does not keep a separate copy. |
| Rights-request and data-protection complaint file | 6 years after closure, unless a shorter period is shown to meet accountability and legal-claim requirements |
| Analytics information | Google Analytics keeps event-level data for 2 months. Aggregated reports are kept by Google Analytics until the property is deleted. |
| Backups | Overwritten through the verified backup cycle; information subject to deletion is isolated from ordinary use and deleted when the cycle completes |
We consider the amount, sensitivity, purpose, risk, legal requirements and need to establish or defend claims when setting or reviewing a retention period.
How information is protected.
We use proportionate organisational and technical measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. These include limiting access to people who need it for an authorised purpose, applying confidentiality obligations, protecting systems and communications, managing suppliers and maintaining processes for incidents and data-subject requests.
No transmission or storage method can be guaranteed completely secure. If a personal-data breach creates a legal notification duty, we will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to affected people, we will also tell them without undue delay.
Your rights.
Depending on the circumstances, you may have the right to:
| Right | What it means |
|---|---|
| Be informed | Receive clear information about how we use your personal information |
| Access | Ask for a copy of the personal information we hold about you |
| Rectification | Ask us to correct inaccurate information or complete incomplete information |
| Erasure | Ask us to delete information in circumstances where the right applies |
| Restriction | Ask us to limit how information is used in circumstances where the right applies |
| Object | Object to processing based on legitimate interests and object at any time to direct marketing |
| Portability | Receive certain information you provided in a structured, commonly used, machine-readable format, or ask us to transmit it, where the right applies |
| Withdraw consent | Withdraw consent at any time where consent is the lawful basis |
| Challenge solely automated decisions | Ask for human intervention and challenge a decision where the relevant automated-decision right applies |
To exercise a right, contact Info@eliteinsight.co.uk. You do not normally have to pay a fee. We may request only the information reasonably needed to confirm your identity, authority and the scope of the request.
We respond without undue delay and normally within one calendar month after receiving the request or any reasonably required identity information. The law may allow up to two additional months for a complex request or several requests; if so, we will explain the extension within the first month. Rights are subject to legal conditions and exceptions, which we will explain if relevant.
Ask a question or raise a concern.
Contact Info@eliteinsight.co.uk if you have a question, want to exercise a right or are concerned about how we have handled personal information.
You can make a data-protection complaint through the same email or postal address. We will:
- acknowledge receipt within 30 days;
- take appropriate steps to investigate it without undue delay;
- keep you informed about progress; and
- explain the outcome without undue delay.
You can also complain to the Information Commissioner's Office, the UK supervisory authority. You can use its current complaint route at ico.org.uk/make-a-complaint or call 0303 123 1113. We would welcome the opportunity to consider the concern first, but you do not have to contact us before approaching the ICO.
If you are outside the UK, another local supervisory authority may also be relevant.
Changes to this notice.
We review this notice when our processing, providers or legal obligations change. The effective and last-reviewed dates appear at the top of the page. Where a change materially affects how we use existing personal information, we will bring it to the attention of affected people before the new use begins where required.