Privacy Policy

1. Who we are

zentfunharbr Ltd is a data, analytics, and AI advisory practice operating throughout the United Kingdom. For the purposes of data protection law, we act as the data controller for personal data collected through this website and for the administration of our client relationships.

2. Scope of this notice

This notice applies to:

• Visitors to zentfunharbr.cfd and any subpages of this website.
• Individuals who submit an enquiry using our contact form.
• Representatives of prospective, current, and former client organisations.
• Suppliers, subcontractors, and professional contacts who provide us with contact details.

Where we process personal data on behalf of a client as part of an engagement, we act as a processor, and the client's own privacy notice and our written processing terms will govern that activity. See section 11.

3. Information we collect

3.1 Information you give us directly

• Identity data: your name and, where volunteered, your job title.
• Contact data: your email address and any telephone number or postal address you choose to include.
• Organisation data: your organisation type (for example SME, consultancy, service business, or regional operator) and the improvement area you select.
• Enquiry content: the free-text message you write to us, including any details about your systems, reporting challenges, or timescales.

3.2 Information collected automatically

• Technical data: IP address, browser type and version, device type, operating system, and screen resolution — typically recorded in standard server logs by our hosting provider.
• Usage data: pages viewed, referring page, and time spent on the site, where non-essential analytics have been consented to.
• Preference data: your cookie consent choice, stored locally in your browser as described in our Cookie Policy.

3.3 Information we do not seek

We do not ask for, and request that you do not submit, special category data (such as health, ethnicity, religious beliefs, or biometric data), payment card details, passwords, or confidential third-party records through the website contact form.

4. How we use your information

• To read, assess, and respond to your enquiry.
• To prepare a proposal, scope of work, or indicative timetable at your request.
• To administer an engagement, including scheduling, invoicing, and record keeping.
• To maintain the security, availability, and integrity of this website.
• To understand — in aggregate — how the website is used, so that we can improve navigation and content.
• To comply with legal, accounting, and regulatory obligations.

We do not use your details for automated profiling, and we do not sell your personal data under any circumstances.

5. Lawful bases for processing

Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interests do not override your rights and freedoms. You may object to this processing at any time (see section 13).

6. Cookies and website analytics

We use a small number of strictly necessary technologies to make the site function, plus optional analytics where you have consented. Your consent decision is stored in your browser's local storage under the key zentfunharbr_cookie_consent so that we do not repeat the request on every visit. Full details, including how to withdraw consent, are set out in our Cookie Policy.

7. Form-data handling

When you complete the contact form, the details you submit are transmitted over an encrypted connection and reviewed by a member of our advisory team. Enquiries are triaged manually. We do not use the content of enquiries to train machine learning models, and we do not forward enquiry content to third-party marketing platforms.

If your enquiry is unrelated to our services, or is identified as unsolicited bulk messaging, the submission is deleted without a response.

8. Sharing and disclosure

We do not sell, rent, or lease personal information. We may share limited personal data with:

• Hosting and infrastructure providers who operate the servers on which this website runs.
• Email and productivity providers used to receive and manage correspondence.
• Professional advisers such as accountants, auditors, and insurers where necessary.
• Subcontracted specialists engaged on a project, always under written confidentiality and processing terms.
• Regulators, law enforcement, or courts where we are legally required to disclose information.

All processors acting on our behalf are bound by contract to process personal data only on our documented instructions and to apply appropriate technical and organisational measures.

9. International transfers

We aim to keep personal data within the United Kingdom or the European Economic Area. Where a supplier processes data outside these areas, we rely on UK adequacy regulations or the International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You may request further information about a specific transfer using the contact details in section 18.

10. Data retention

We hold personal data only for as long as necessary for the purpose it was collected, or to satisfy legal, accounting, or reporting requirements. Our standard schedule is:

At the end of a retention period, records are securely deleted or irreversibly anonymised for statistical purposes.

11. Client data during engagements

During a data audit, BI planning exercise, or AI readiness assessment, we may be given access to systems containing personal data belonging to your customers, staff, or suppliers. In these circumstances:

• We act as a processor and the client remains the controller.
• Processing takes place only under a written agreement that sets out subject matter, duration, purpose, and categories of data.
• We strongly recommend the use of anonymised, pseudonymised, or sample datasets wherever an assessment can be completed without live personal data.
• Access is limited to named personnel, revoked at the end of the engagement, and logged.

12. Security measures

We apply proportionate technical and organisational measures, including encrypted transport (HTTPS/TLS), access control on the basis of least privilege, multi-factor authentication on business accounts, device encryption, regular software patching, and confidentiality obligations for all personnel and subcontractors. We maintain an internal procedure for identifying, containing, and reporting personal data breaches, including notification to the Information Commissioner's Office within 72 hours where the breach is reportable.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security of data sent over the internet.

13. Your rights under UK GDPR

Subject to conditions and exemptions in law, you have the right to:

• Be informed about how your data is used — this notice serves that purpose.
• Access a copy of the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data where there is no continuing lawful reason to hold it.
• Restrict processing in certain circumstances, for example while accuracy is disputed.
• Data portability for data you provided to us under consent or contract.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent where consent is the lawful basis, without affecting prior processing.

To exercise a right, contact us using the details in section 18. We will respond within one calendar month, which may be extended by up to two further months for complex requests. We may ask for reasonable proof of identity before disclosing information. There is normally no fee.

14. Automated decisions and AI

We do not make decisions about individuals using solely automated processing that produce legal or similarly significant effects. Where AI tools are discussed or planned as part of an engagement, we advise that outputs remain subject to human review and that they should not be treated as legal, security, or compliance advice.

15. Children's data

Our website and services are directed at businesses and professionals. We do not knowingly collect personal data relating to children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

16. Complaints

If you are dissatisfied with how we have handled your personal data, please raise it with us first so we can attempt to resolve the matter. You also have the right to lodge a complaint with the UK supervisory authority:

17. Changes to this notice

We review this notice at least annually and whenever our processing activities change materially. Updated versions are published on this page with a revised effective date. Where a change significantly affects your rights, we will take reasonable steps to bring it to your attention.

18. How to contact us

For any privacy question, rights request, or concern, write to the Data Protection Contact at zentfunharbr Ltd, Ground Floor, Bishopsgate House, 27 Colston Street, Bristol BS1 5AP, United Kingdom, or use our contact form.

Version 2.0 — Last updated: January 2026.