What happens to what you tell us.

Circus Consulting Limited, company number 06517274, registered office c/o Ukmal, Unit 7, 3-5 Little Somerset Street, London, E1 8AH. You can reach us about anything in this policy at hello@circusconsulting.co.uk.

• Enquiries. When you use the contact form we collect your name, email address, and anything else you choose to put in the form, such as your business name, phone number and a description of what you need.
• Technical data. Our servers and our content delivery provider record standard request information: IP address, browser type, the pages requested and the time of the request. This is used to keep the site available and secure.
• Advertising measurement. If you arrive from a Google Ads advertisement, the link may carry a click identifier that lets us see which advertisement produced an enquiry. We store that identifier alongside the enquiry.
• Email and the visit that follows it. If you have asked to hear from us, we record whether our emails were opened and which links were clicked, and, where you follow one of those links here, which pages you then read on this site. That is held against your email address rather than anonymously — clause 05 explains why and for how long.

• To reply to your enquiry and to discuss work with you. Lawful basis: steps taken at your request before entering a contract.
• To run and secure this website, and to understand which advertisements bring in enquiries. Lawful basis: our legitimate interest in operating and improving our business, balanced against your interests.
• To meet legal and accounting obligations where a project goes ahead. Lawful basis: legal obligation.

This site sets a session cookie that is necessary for the contact form’s security check, and, if you arrive here by clicking a link in one of our emails, a second cookie that records which pages you read on this site during that visit — see clause 05. We do not set advertising cookies on this site, and we do not use third-party analytics that track you across other websites. Fonts are loaded from Google Fonts, which means your browser makes a request to Google’s servers when a page loads; Google receives your IP address as part of that request.

If you have asked to hear from us, our emails record whether the message was opened and which links in it were clicked. Where you follow one of those links to this website, we also record which pages you go on to read during that visit, for up to 30 days, and we hold that alongside your email address — so it is information about an identified person, not anonymous statistics. We do this to understand which of the things we write about are useful, and to avoid sending you more of what you ignore. Our lawful basis is legitimate interests (Article 6(1)(f)): our interest in knowing whether our own mail is worth sending, weighed against the fact that this is limited to our own website, is never combined with data from anywhere else, and is never sold or shared. It stops the moment you unsubscribe, and every email carries a one-click unsubscribe link. You may object to it at any time, or ask us to delete what we hold, using the address in clause 08.

We do not sell personal information and we do not share it for anyone else’s marketing. We use a small number of service providers who process information on our behalf under contract: our hosting is on our own infrastructure in the United Kingdom, our content delivery and security layer is Cloudflare, and enquiry email is delivered through Amazon Web Services. Where a provider processes data outside the United Kingdom, that transfer is covered by the UK addendum to the standard contractual clauses or an equivalent safeguard.

Enquiries that do not become projects are deleted within two years. Records relating to work we have carried out are kept for seven years, which is the period our accounting and tax obligations require. Server logs are kept for up to 90 days. A visit recorded after an email click (clause 05) closes after 30 days, and everything we hold about you stops being collected the moment you unsubscribe.

You have the right to ask us for a copy of the personal information we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to receive it in a portable form. Where we rely on legitimate interests, you can object at any time. Email hello@circusconsulting.co.uk and we will respond within one month.

If you are not satisfied with our response you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.

Separately from this website, some of our work requires us to connect to accounting software operated by our clients — currently QuickBooks Online, through Intuit’s Accounting API. In that work the client is the data controller and Circus Consulting Limited acts as data processor: we process those records only on the client’s documented instruction, and never for our own purposes.

Access is granted by the client through Intuit’s own authorisation screen, and can be withdrawn by them at any time from Apps → Connected apps inside QuickBooks Online. Withdrawal stops all further access immediately.

What we read: accounting transactions, including invoices, bills, payments, expenses, deposits, transfers, credit notes and journal entries; contact records for customers, suppliers and employees, including names, addresses, telephone numbers and email addresses; reference data such as the chart of accounts, products, services and tax codes; and reports derived from these.

The connection is read-only. It cannot create, alter or delete anything in a client’s books. We do not access banking credentials, card numbers or payment instruments, we do not use client accounting data to train machine-learning models, and we do not share it with anyone for their own purposes.

Extracts are held on Circus Consulting managed equipment in the United Kingdom, encrypted at rest. Authorisation tokens are held in the operating system keychain and are never committed to source control. Extracts are kept for the same seven-year period as other project records, unless the client asks us to delete them sooner.

Individuals whose personal data appears in a client’s records should direct requests to that client, as controller. If such a request reaches us first we will pass it on promptly and help the client answer it.

If we change this policy we will update the date at the top of this page. Material changes affecting existing clients will be notified by email.