Privacy Policy

Last updated: 1 October 2025

1. Introduction

Mercury3 Consult Ltd (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, store, share, and protect your personal data when you use our website or engage with our services, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller & Contact Details

Mercury3 Consult Ltd is the data controller responsible for your personal data.

• Company Registration No: 11044789
• Registered Address: 148 Rose Bowl, Portland Crescent, Leeds, LS1 3HB, England
• Data Protection Officer: Glen Middleton
• Email: HR@m3consult.co.uk

3. Data We Collect

We may collect and process the following categories of personal data:

• Identity and contact data: name, job title, organisation, email address, telephone number, postal address
• Demographic data: postcode, preferences, interests
• Technical and usage data: IP address, browser type, device information, website usage statistics, analytics data (via Google Analytics)
• Marketing and communication data: preferences in receiving communications and newsletters
• Data may be collected directly when you complete a contact form or newsletter sign-up form (stored securely in SharePoint with restricted access) or indirectly through website analytics.

4. Purposes and Lawful Bases

We process your personal data for the following purposes:

5. Data Sharing

We may share your personal data with:

• Service providers acting as processors, including OpenCRM (CRM system), Google Analytics (website analytics), Outlook (email marketing), and Microsoft SharePoint (data storage)
• Legal or regulatory bodies when required by law

We do not sell or share data with affiliates or third-party marketing partners.

6. International Transfers

Some providers (such as Outlook and Google Analytics) may transfer data outside the UK. Where this occurs, we ensure adequate safeguards are in place, such as UK Standard Contractual Clauses or reliance on adequacy decisions.

7. Data Retention

We retain personal data only as long as necessary:

• Enquiry data: up to 12 months
• Marketing subscriber data: consent reviewed every 2 years or until you opt out
• Other data: retained as long as legally required or until anonymisation/deletion is appropriate

8. Your Rights

You have the following rights under UK GDPR:

• Right to access your personal data
• Right to rectification of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to object to processing, including for direct marketing
• Right to data portability
• Right to withdraw consent at any time (without affecting prior lawful processing)

To exercise these rights, please contact us using the details in Section 2.
If you are dissatisfied, you may complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

9. Cookies

We use cookies and similar technologies. Some cookies are essential for site functionality. Others (such as analytics) help us understand how the site is used. Our cookie banner allows you to accept or reject non-essential cookies. For more detail, see our [Cookie Policy].

10. Security

We use appropriate technical and organisational measures to protect your personal data, including access controls, encryption, staff training, and regular security audits.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or significant effects on you.

12. Updates to this Policy

We may update this policy from time to time. The “Last updated” date will reflect the most recent version. Substantive changes will be notified via our website or by email if appropriate.