Privacy

Data controller

North Principle Ltd, registered in England and Wales, company number 17469992

How to reach us about privacy

info@northprinciple.co.uk

We have not appointed a data protection officer, and we are not required to. Privacy questions go to the address above and are answered by a person.

The site sets no cookies and stores nothing in your browser. We use Vercel Web Analytics to count visits. It sets no cookies, stores nothing on your device and does not identify you. There is no advertising or remarketing pixel, no chat widget, no embedded video and no third-party script. Our typeface is served from our own domain, so loading a page here does not tell anyone else that you visited.

There are three ways we end up holding information about you.

If you send an enquiry, we receive your name, your email address, your company or organisation if you give one, and what you wrote. The company field is optional. We do not ask for anything else, and there is no hidden field collecting more.

If you simply visit, our host records the ordinary technical details every web server records — the address of the request, which page was asked for, the time, and your browser’s user-agent string. Your IP address is personal information. We do not build a profile from it, and we do not use it to recognise you on a later visit.

We contact your business first. If we think we can help a business, we may note the contact details it publishes on its own website and the names of its directors from the public Companies House register, and write to it. See Contacting businesses.

The enquiry form also applies a short-lived rate limit, which counts recent submissions against the requesting IP address for ten minutes and then forgets them. It is held in memory, never written to a database.

• Answering your enquiry, and deciding whether we can help. Our legitimate interests, and yours: you asked us a question and you want a reply. If the conversation turns into a project, the same information is then held to take the steps leading to a contract with you.
• Keeping the site working and secure, including server logs and the rate limit. Our legitimate interest in running a site that stays up and is not abused. We use the smallest amount of information that achieves it — the rate limit counts, it does not identify.
• Keeping business and tax records once you become a client. Compliance with our legal obligations.
• Legitimate interests, for contacting businesses we think we can help (see Contacting businesses). You can object at any time and we will stop.

We do not run a newsletter, mailing list or automated email sequence, and we do not bundle a marketing permission into the enquiry form. If you contact us through this site, we will not send you marketing email unless you have separately said yes. We do sometimes write individually to businesses we think we can help, as described under Contacting businesses.

Nothing here involves automated decision-making or profiling. A person reads every enquiry.

We sometimes email or phone businesses we think we could help. We use contact details the business has published itself or that appear on the public Companies House register: company name, a published business email address or phone number, and directors’ names. We only email limited companies and LLPs. Our customer records system may also add publicly available information about the business, such as its size, logo and social media pages.

Our lawful basis is legitimate interests (finding new clients). We keep a record of who we contacted and what was said, and delete it after 12 months if the business does not become a client.

To stop hearing from us, reply to any message or email info@northprinciple.co.uk and we will not contact you again. We keep a minimal record of your request (the business name and email address) so that we don’t.

We do not sell personal information and we do not share it for anyone else’s marketing. We do use service providers, and they necessarily handle it on our behalf:

Vercel

Hosts this website and runs the function that receives the enquiry form. Holds the server logs described above, and provides the Web Analytics that counts visits.

Resend

Delivers the enquiry to our inbox as an email. Your address is set as the reply-to.

Google Workspace

Our email. Once an enquiry arrives, it is a message in our mailbox like any other.

Attio

Our customer records system. It connects to our mailbox, so it holds copies of enquiries and of our emails with businesses we have contacted.

Each of them acts on our instructions under a contract, not for their own purposes. We would also disclose information if the law required it, which has not happened.

Information reaches the United States. Vercel, Resend and Google are US companies. Attio is a UK company (Attio Limited), but some of the services it relies on are in the United States; for those, Attio uses the EU Standard Contractual Clauses with the UK Addendum, set out in its data processing addendum. Where that happens we rely on the transfer safeguards in our contract with the provider — the UK International Data Transfer Addendum, or the UK extension of the EU–US Data Privacy Framework where the provider is certified under it. If you want the position for a particular provider, ask and we will tell you which applies.

Enquiries that do not become work

Twelve months from our last exchange, then deleted. Long enough that we remember the conversation if you come back, short enough that we are not sitting on a pile of old enquiries.

Enquiries that become work

Kept with the client record for six years after the end of the engagement. Six years is how long a contract claim can be brought, and how long tax records must be available.

Records of businesses we have contacted that did not become clients

12 months from our last contact, then deleted.

Do-not-contact list (business name and email address only)

Kept for as long as we contact businesses, so that we never contact you again after you ask us to stop.

Server logs

Held briefly by our host as part of running the platform, and not copied anywhere by us.

Rate-limit counts

Ten minutes.

Under UK data protection law you can ask us to:

• tell you what we hold about you, and give you a copy
• correct it if it is wrong
• delete it
• stop or restrict what we do with it
• hand it over in a portable form, where that right applies

You can also object to anything we do on the basis of legitimate interests, including holding your enquiry at all. Tell us and we will stop unless we have a compelling reason not to — and for an enquiry we will not, so it will be deleted.

Email info@northprinciple.co.uk. There is no charge. We will normally need to be confident we are talking to the right person before we send anything out, which usually means replying from the address the enquiry came from. We answer within one month.

If you are unhappy with how we have handled your information, tell us first at info@northprinciple.co.uk and put “complaint” in the subject line. We will acknowledge it within 30 days and deal with it as quickly as we can.

You do not have to come to us first, and coming to us does not cost you the right to go elsewhere. You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113 at any point.

The site is served only over HTTPS. The enquiry form is validated on the server as well as in the browser, rate limited, and protected against automated submissions. Our email credentials are held as server-side secrets and are never sent to the browser. Access to the inbox and the hosting account is limited to people who need it and protected by two-factor authentication.

We will not tell you your data is completely safe, because nobody can honestly say that. If something does go wrong and it puts your rights at risk, we will report it to the ICO within 72 hours of finding out and tell you if the risk to you is high.

We will update this page when what we do changes, and the date at the top will change with it. If a change matters to you — a new provider, a new purpose, anything that needs your consent — we will not make it quietly.

This notice covers northprinciple.co.uk. It does not cover anything else we run — a product that handles different information in a different way needs its own notice, published where you actually use it, not a paragraph here.