Privacy Notice

DATA PROTECTION · HF-DP-01

Privacy Notice
How Hubflow Consulting collects, uses and protects personal data, and the rights
you hold over it.

  Document                Charlotte Mortimer, Director               Classification      Public
  owner

  Version                 1.8                                        Effective from      6 September 2026

  Approved by             Charlotte Mortimer, Director               Next review         6 September 2027

  Applies to              Website visitors, prospective clients, clients, suppliers and contacts

This notice explains how Hubflow Consulting handles personal data when you visit our website, enquire
about our services, engage us, or otherwise deal with us. It is written to meet the transparency requirements
of Articles 13 and 14 of the UK GDPR.

1. Who we are
Hubflow Consulting, the trading name of Hubflow Consultants Ltd, is an independent HubSpot consultancy
based in Malmesbury, Wiltshire. We are not a HubSpot partner, reseller or affiliate; we provide
implementation and consultancy services to organisations that use HubSpot. We provide portal audits,
onboarding, implementation, optimisation, workflow and automation builds, data cleansing, AI enablement
workshops and strategic CRM consultancy to small and medium enterprises, non-profit organisations and
growing teams.

For the personal data described in this notice we act as the data controller. Where we work inside a client's
CRM or handle data supplied by a client, we act as a data processor on that client's instructions; that
relationship is governed by our Data Processing Agreement (HF-CM-02) rather than by this notice.

   DETAIL VALUE

Controller Hubflow Consulting, the trading name of Hubflow Consultants Ltd

Company number 15752967

Registered office 9 Orwell Close, Malmesbury, Wiltshire, SN16 9UB

Data protection contact Charlotte Mortimer, Director · charlotte@hubflowconsulting.com

2. The personal data we collect

   CATEGORY WHAT IT INCLUDES WHERE IT COMES FROM

Identity and contact Name, job title, employer, email You, directly address, telephone number, postal
address

Enquiry content Details of your CRM estate, You, directly requirements, budget indications, free-text
messages and quiz or quote-builder responses

Engagement records Proposals, statements of work, You and us, during an engagement correspondence,
meeting notes, deliverables, project decisions

Financial Billing contact, purchase order You and our accounting software references, invoice and payment
records, VAT details

Technical IP address, browser and device type, Automatically, where you consent to pages viewed, referring
source, time analytics cookies on page

Marketing Subscription status, email opens and You, directly clicks, content downloads, consent records

Recruitment or partnership CV, professional history, availability, You, directly rates

Business prospecting data Name, job title, employer, business Third-party business contact email address,
business telephone databases, including Apollo.io, and number, company size and sector publicly available
business sources such as company websites and LinkedIn

Meeting recordings and transcripts Voice, image where video is on, and Recorded with notice and consent
the transcript of what was said during client and prospect meetings

   IF YOU WERE CONTACTED BY US AND NEVER GAVE US YOUR DETAILS

We obtain business contact information from third-party business databases and public sources in order
to make relevant business-to-business approaches. Where we hold your data on that basis and have not
obtained it from you, we tell you so within one month of obtaining it or at the point of first contact,
whichever is earlier. You can object at any time by replying to any message or emailing
charlotte@hubflowconsulting.com, and we will suppress your details permanently. The lawful basis, and the
balancing test behind it, is set out in our Legitimate Interests Assessment (HF-DP-10), available on request.

We do not deliberately collect special category data (health, race, religion, political opinion, trade union
membership, biometric or genetic data, sexual life or orientation) or criminal offence data about our own
contacts. Where a client's CRM contains such data we handle it strictly as a processor under the Data
Processing Agreement.

3. Why we use it, and our lawful basis

   PURPOSE LAWFUL BASIS

Responding to an enquiry and preparing a proposal or Steps taken at your request prior to entering a
contract (Art. quotation 6(1)(b))

Delivering the services set out in an engagement Performance of a contract (Art. 6(1)(b))

Invoicing, credit control and maintaining accounting Legal obligation (Art. 6(1)(c)) and legitimate interests
records

Keeping records of decisions, scope and advice given, Legitimate interests in managing professional risk
(Art. 6(1)(f)) to defend against future claims

Sending relevant business updates to existing business Legitimate interests, relying on the soft opt-in under
PECR reg. clients about similar services 22

Sending marketing emails to prospects who have Consent (Art. 6(1)(a)) and PECR reg. 22 subscribed

Business-to-business outbound approaches to Legitimate interests (Art. 6(1)(f)), assessed in HF-DP-10. PECR
corporate contacts at limited companies and other reg. 22 does not apply to corporate subscribers, but the
right corporate bodies to object does

Recording meetings for note-taking and accuracy of Consent (Art. 6(1)(a)), obtained before recording
begins record

Operating non-essential website cookies and analytics Consent (Art. 6(1)(a)) and PECR reg. 6

Securing our systems, preventing fraud and Legitimate interests in protecting the business and its clients
investigating incidents (Art. 6(1)(f))

Complying with tax, company law and regulatory Legal obligation (Art. 6(1)(c)) duties

Where we rely on legitimate interests we have carried out a balancing assessment and concluded that our
interest does not override your rights and freedoms. You may ask for a summary of any assessment at any
time.

4. Marketing and your choices
We send marketing only where you have subscribed, or where you are an existing business client and the
message concerns services similar to those we have already provided. Every marketing email carries a
working unsubscribe link. Unsubscribing takes effect promptly and always within 48 hours. We will continue
to send you service and administrative messages relating to a live engagement, because those are
necessary to perform the contract.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

5. Who we share it with
We share personal data only where it is necessary, and only with providers bound by written terms that
impose confidentiality and security obligations. Our current suppliers are listed in our Sub-processor
Register (HF-DP-08), which is available on request. The categories are:

• Software and hosting providers operating our CRM, email, file storage, website, meeting, note-taking and
  accounting systems.

• Professional advisers including our accountant, and where necessary our insurer or solicitors.

• Subcontractors engaged on a specific project, where we have told you in advance and they are under
  equivalent written obligations.

• Regulators, HMRC and law enforcement, where we are legally required to disclose.

If the business is ever sold or restructured, personal data may transfer to the acquiring entity; you would be
notified and this notice would continue to apply until replaced.

6. International transfers
Some of our suppliers are headquartered outside the United Kingdom, most commonly in the United States.
Where personal data is transferred outside the UK we rely on the UK extension to the EU Standard
Contractual Clauses (the UK Addendum), the International Data Transfer Agreement, or an adequacy
regulation, and we carry out a transfer risk assessment before onboarding the supplier. Our International
Data Transfers Policy (HF-DP-09) sets out the detail.

7. How long we keep it
We keep personal data no longer than we need it. In summary: enquiries that do not convert are deleted
after 24 months; engagement and contract records are kept for six years from the end of the engagement,
matching the limitation period under the Limitation Act 1980; accounting records are kept for six full
financial years as required by the Companies Act 2006 and HMRC; and marketing consent records are kept
for as long as the subscription runs plus two years. Client data held as a processor is returned or deleted at
the end of the engagement in line with the Data Processing Agreement. Our full Data Retention and
Disposal Schedule (HF-DP-05) is available on request.

8. How we protect it
We apply the controls described in our Information Security Policy (HF-IS-01). In summary: multi-factor
authentication on every business account, a password manager with unique credentials, full-disk
encryption on all devices, least-privilege access, encrypted transit and storage, no client data on
removable media or personal devices, and a documented breach response procedure.

9. Your rights
Under the UK GDPR you have the right to:

• Be informed about how your data is used, which is the purpose of this notice.

• Access a copy of the personal data we hold about you.

• Rectification of data that is inaccurate or incomplete.

• Erasure of your data where there is no overriding reason for us to keep it.

• Restrict processing while a dispute about accuracy or legitimate interests is resolved.

• Data portability, receiving data you provided in a structured, commonly used, machine-readable format.

• Object to processing based on legitimate interests, and an absolute right to object to direct marketing.

• Withdraw consent at any time where consent is the basis we rely on.

• Not be subject to solely automated decision-making producing legal or similarly significant effects. We
  do not carry out such decision-making.

To exercise any right, email charlotte@hubflowconsulting.com. We respond within one calendar month,
extendable by two further months for complex requests, and we will tell you if an extension applies. There is
no charge unless a request is manifestly unfounded or excessive.

10. Complaints
If you are unhappy with how we have handled your data, please raise it with us first at
charlotte@hubflowconsulting.com so we can put it right. You also have the right to complain to the
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303
123 1113, ico.org.uk.

11. Changes to this notice
We review this notice at least annually and whenever our processing changes materially. The version and
effective date are shown in the control table above. Where a change materially affects you we will notify
you directly.

www.hubflowconsulting.com
General enquiries: charlotte@hubflowconsulting.com · Existing client support: support@hubflowconsulting.com · Data protection: charlotte@hubflowconsulting.com