Privacy Policy

Effective date: 27 August 2025
Version: 1.0

This notice explains how Tetra Consulting Limited (“Tetra”, “we”, “us”) collects and uses personal data when you visit www.tetraconsulting.co.uk or interact with our online services (the “Site”). It also explains your privacy rights and how UK law protects you.

1) Who we are and how to contact us

• Controller: Tetra Consulting Limited (Company No. 03557123)
• Registered office: 8 Bloomsbury Street, Bloomsbury, London, WC1B 3SR
• Privacy contact: privacy@tetraconsulting.co.uk
• Data Protection Officer (DPO): Neil Burman, dpo@tetraconsulting.co.uk
• ICO registration: ZA862300

If you have any questions about this notice or how we handle your data, please contact the privacy team or our DPO using the details above. You also have the right to complain to the ICO (see Section 12).

2) What data we collect

We collect and process the following categories of personal data:

1. a) Data you provide to us
   – Contact/enquiry forms: first name, last name, email, phone, your message.
   – Newsletter sign‑ups: email and marketing preferences.
   – Event & webinar registrations: contact details and registration information (including via WebinarGeek).
   – Payments: billing details and transaction metadata (card details are processed by our payment processor; we do not store full card numbers).
2. b) Data collected automatically
   Device and usage data (IP address, browser type, pages viewed, interactions) and online identifiers through cookies/trackers. Non‑essential analytics/advertising cookies only run with your consent (see Section 7).
3. c) Data from third parties
   Lead/marketing tools (e.g., HubSpot), analytics providers (Google Analytics 4, Microsoft Clarity), event platforms (WebinarGeek), and form tools (Typeform).
4. d) Special category data
   Our website is not intended to collect special category data (e.g., health). Please avoid including such information in free‑text fields. If you do, we will only use it to respond and will minimise/delete it.
5. e) Recruitment
   When you apply for a role via Sage HR, your information is handled under our separate Recruitment Privacy Notice, which you will see during the application process.

3) Why we use your data and our lawful bases

We only use your personal data when the law allows us to. The table summarises our purposes, lawful bases (UK GDPR), and typical retention.

Purpose	Lawful basis	Typical data	Retention
Respond to enquiries and provide quotes/proposals	Legitimate interests(to operate our business and respond to requests) and/or Contract(pre‑contract steps)	Contact details; message	18 months from last contact
Register you for events/webinars and send joining info/follow‑ups	Contract (providing the event) and/or Legitimate interests	Contact details; registration details	18 months from last interaction
Send B2B marketing about our services (including soft opt‑in where applicable)	Legitimate interests(UK soft opt‑in where conditions are met). You can opt out at any time.	Contact details; preferences	Until you opt out
Newsletter subscription	Consent	Email; preferences	Until consent is withdrawn
Website analytics (GA4, MS Clarity, HubSpot analytics)	Consent (PECR)	Online identifiers; usage data	As set in the Cookie Policy
Advertising/retargeting (Google Ads, Bing, YouTube)	Consent (PECR)	Online identifiers; usage data	As set in the Cookie Policy
Payment processing and invoicing	Contract; Legal obligation(accounts/tax)	Billing details; transaction metadata	Financial records 7 years
Security, diagnostics and fraud prevention (including server/log files)	Legitimate interests; Legal obligation	IP address; device/usage data; logs	90 days for standard logs
CRM management and sales pipeline via HubSpot	Legitimate interests	Contact details; interactions	18 months from last contact

Where we rely on legitimate interests, we balance our interests against your rights and expectations. You can object at any time (see Section 11).

4) Who we share data with

We share personal data with trusted processors who help us deliver the Site and our services, under written contracts that require confidentiality and appropriate security. These include:

– Hosting and infrastructure:SiteGround (UK), and related cloud/security providers.
– CRM/marketing & email: HubSpot.
– Analytics & measurement: Google Analytics 4, Microsoft Clarity, HubSpot analytics.
– Advertising/retargeting: Google Ads, Bing, YouTube.
– Events & webinars: WebinarGeek.
– Forms: Typeform.
– Payments: PCI‑DSS‑compliant payment processor (card details handled by the processor, not by Tetra).

We share data with authorities, courts or regulators where required by law. We do not sell personal data. We do not share website data with group companies.

5) International transfers

Some providers are located outside the UK. Where a transfer is a restricted transfer under UK GDPR, we use appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. For eligible US providers, we may rely on the UK‑US Data Bridge (if the recipient is certified). Details of the relevant safeguard for each provider are available on request.

6) Data retention

We keep personal data only for as long as necessary for the purposes described above, including to satisfy legal, accounting or reporting requirements. We apply the retention periods set out in Section 3 and securely delete or anonymise data when no longer needed.

7) Cookies and similar technologies (PECR)

We use essential cookies to make our Site work. With your consent, we also use analytics and advertising cookies. Our CookieYes banner lets you Accept all / Reject all / Customise non‑essential cookies, and you can change your choices at any time via the cookie settings link in the footer. Full details (cookie types, purposes, providers and lifetimes) are set out in our Cookie Policy.

Non‑essential cookies will not run unless and until you give consent.

8) Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, logging, vendor due diligence, and staff training. While no system is completely secure, we aim to reduce risks of unauthorised access, alteration or loss.

9) Children

Our Site is aimed at business users and is not intended for children. We do not knowingly collect data relating to children through the Site.

10) Automated decision‑making

We do not make decisions producing legal or similarly significant effects based solely on automated processing via the Site.

11) Meetings, recording and transcription

Some Tetra meetings held in Microsoft Teams are recorded or transcribed. This happens only when a participant chooses to turn it on, and Microsoft Teams notifies everyone present. If you would prefer not to be recorded, you are welcome to say so, to ask for it to be turned off, or to leave the meeting.

If a transcript is produced, TetraBot, our internal Microsoft Teams assistant, may summarise it automatically. Microsoft Azure OpenAI carries out summarisation within the European Union. Meeting content is not used to train any artificial intelligence model.

A summary sets out what was discussed, the decisions taken and the actions agreed. TetraBot sends summaries only to Tetra colleagues who took part in the meeting and who have chosen to receive them; it does not send them to anyone outside Tetra. As with any meeting notes, a colleague may afterwards share a summary with others — including clients — where appropriate. Recipients can correct an inaccurate summary, and the original is retained alongside any correction.

Transcripts are held within our Microsoft 365 environment and are deleted automatically 120 days after the meeting. We delete summaries automatically 90 days after the meeting.

We rely on our legitimate interests in keeping an accurate record of our work and in supporting colleagues who took part in a meeting. No decision producing legal or similarly significant effects is made solely by automated means. If you would like a summary of a meeting you attended to be deleted, or you wish to object to this processing, please contact our Data Protection Officer at dpo@tetraconsulting.co.uk.

12) Your rights and how to exercise them

Under UK GDPR you have rights to access, rectify, erase, restrict or object to processing (including objections to direct marketing), data portability, and to withdraw consent where we rely on consent. You also have the right to complain to the ICO.

We aim to respond within one month. We may request proof of identity where appropriate.

How to request deletion (erasure)

If you would like us to remove your personal data, please email privacy@tetraconsulting.co.uk or dpo@tetraconsulting.co.uk with:

1) Your name and the email address(es) you used with us;
2) A brief description of the data or interaction (e.g., newsletter, enquiry, event); and
3) Proof of identity if we ask for it.

We will erase data where the right applies. We may retain limited information as required by law (e.g., financial records) or to maintain a suppression list so that we don’t contact you again by mistake.

13) How to complain

You can raise concerns with us using the contact details in Section 1. You also have the right to complain to the Information Commissioner’s Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; 0303 123 1113; https://ico.org.uk/make-a-complaint/

14) Changes to this notice

We may update this notice from time to time. Significant changes will be highlighted on this page and, where appropriate, notified to you by email. Please check back regularly for updates.

Related policies

• Cookie Policy (explains non‑essential cookies and your choices)