Legal

Privacy Policy

Last updated: 9 August 2026 Controller: Formalus Limited

1. Who we are

This website (formalus.com) and the Executive AI Opportunity Assessment are operated by Formalus Limited, a company registered in England & Wales (company number 10374580), with registered office at 20–22 Wenlock Road, London N1 7GU, United Kingdom.

Formalus Limited is the data controller for the personal data described in this policy.

2. What data we collect

2.1 Data you provide directly

  • Identity data — name, job title, organisation, where you provide them
  • Contact data — email address, telephone number, where you provide them
  • Booking data — the details you enter when booking an Executive AI Opportunity Assessment, including anything you write in the booking form
  • Enquiry data — sector, enquiry type and message, where you use the contact form
  • Session notes — notes we make during or after a session, about your business and what was discussed
  • Correspondence — emails and messages you send us

2.2 Data collected automatically

  • Technical data — IP address, browser type, device information, time zone
  • Usage data — pages visited, links clicked, session duration (via GA4)
  • Cookies — see our separate Cookie Notice

3. Why we process your data (legal bases)

  • To arrange and deliver the Executive AI Opportunity Assessment — legal basis: performance of a contract, or steps taken at your request before entering one
  • To respond to enquiries — legal basis: your consent, given through the contact form tick box, and our legitimate interest in responding to messages you send us
  • To deliver paid engagements — legal basis: performance of a contract
  • To send marketing communications, where you have subscribed — legal basis: consent, which you can withdraw at any time
  • To improve the website and our services — legal basis: legitimate interest in operating and improving our business
  • To comply with legal obligations — legal basis: legal obligation

4. How long we keep your data

  • Assessment booking and session data — 90 days from the session, after which the personal record is deleted. Anonymised summary information may be retained for research and benchmarking.
  • Contact enquiries — 3 years from your last contact with us, after which the record is deleted unless an active engagement requires us to retain it longer.
  • Newsletter subscribers — until you unsubscribe. We retain a suppression record (email address only) indefinitely, so that we can honour your opt-out.
  • Client engagement records — 6 years after the engagement closes, in line with UK statutory record-keeping obligations under the Companies Act 2006, HMRC business-record requirements and the Limitation Act 1980.

5. Who we share your data with

We share personal data only with the processors required to run the business and deliver our services. Each is bound by a Data Processing Agreement and may not use your data for its own purposes.

  • WP Engine — website hosting
  • Google Workspace — email, calendar and document storage
  • Google Analytics — website analytics, where you have accepted analytics cookies
  • Calendly — scheduling. Holds the details you provide when booking a session
  • Usebasin — contact form processing
  • Make — routing form submissions into our customer records
  • Pipedrive — customer relationship records, holding enquiry and engagement history
  • Professional advisers — where required for legal, tax or accountancy purposes

We do not sell personal data. We do not share data with third parties for their own marketing purposes.

6. Information about your business, and your people

During a paid engagement — an Executive AI Briefing, an AI Accelerator or AI Value Orchestration — we will see information about how your organisation operates. That sometimes includes personal data relating to your staff, suppliers or customers.

Where that happens, you remain the data controller and Formalus Limited acts as your processor, under the terms of the engagement contract rather than under this policy.

We may use anonymised, aggregated findings from engagements to strengthen our evidence base and emerging benchmark of AI adoption across the UK mid-market. This never includes anything that identifies your organisation, your people or your customers, and we ask for written consent in the engagement terms before doing so.

7. International transfers

Some of our processors are based outside the UK and EEA. Where this is the case, transfers are governed by one or more of the following safeguards, as appropriate to the destination jurisdiction:

  • The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
  • UK adequacy regulations, where the destination has been recognised by the UK Government as providing an adequate level of data protection
  • Other appropriate safeguards under Article 46 of the UK GDPR

Each processor we engage is subject to an appropriate safeguard mechanism, and a Data Processing Agreement is in place before any transfer takes place.

8. Your rights under UK GDPR

You have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — ask us to correct inaccurate or incomplete data
  • Erasure — ask us to delete your data, subject to legal retention obligations
  • Restriction — limit how we process your data
  • Portability — receive your data in a portable format
  • Object — to processing based on legitimate interests, or to direct marketing
  • Withdraw consent — at any time, where consent is the legal basis

To exercise any of these rights, contact us at privacy@formalus.com. We respond within one month.

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk.

9. How we secure your data

We use appropriate technical and organisational measures to protect personal data, including TLS encryption in transit, access controls on storage systems, and Data Processing Agreements with all third-party processors that handle personal data on our behalf.

10. Changes to this policy

We update this policy when our processing changes. The “last updated” date above shows when the current version took effect. Material changes will be communicated where we hold an appropriate email address.

11. Contact

Questions, complaints or rights requests: privacy@formalus.com, or write to Formalus Limited, 20–22 Wenlock Road, London N1 7GU, United Kingdom.