Privacy policy.

Who I am

GNU Consulting Ltd is a one-person consultancy run by Simon Brothwood. In this policy, "I", "me" and "my" mean GNU Consulting Ltd. I am the data controller for the personal data described here.

GNU Consulting Ltd is registered in England and Wales, company number 12523479, with its registered office at Kemp House, 160 City Road, London, EC1V 2NX. For anything to do with your data, email hello@gnu.consulting.

What I collect, and why

When you send an enquiry. The enquiry form asks for your name, email address and a short message, and optionally your company and phone number. It also records which of the three starting points you chose. I use this only to reply to you and to arrange a conversation about your enquiry. My lawful basis is legitimate interests: you have asked me to get in touch, and replying is the obvious reason you gave me the details.

When we work together. If an enquiry becomes work, I keep the contact details and correspondence needed to deliver it, invoice it and support it. The lawful basis is the contract between us, plus my legal obligations (for example, keeping financial records).

When you email or phone me. I keep the correspondence so I have a record of what was discussed, on the basis of legitimate interests.

I do not sell your data, share it for anyone else's marketing, or add you to a mailing list.

Keeping the form free of spam

The enquiry form may use Cloudflare Turnstile to check that it is being filled in by a person rather than an automated program. To do that, Cloudflare processes technical information about your browser and connection. It is used only for that check. See Cloudflare's own privacy policy for details.

Who else handles your data

I use a small number of trusted providers who process data on my behalf, under contract and only on my instructions:

• Microsoft, for email and for hosting this website and my business systems (Microsoft 365 and Microsoft Azure).
• Cloudflare, for the spam check on the enquiry form and for domain services.
• Anthropic, whose AI tools I use to help me read, summarise and prioritise enquiries and correspondence. Every decision about how to respond is made by me; nothing about you is decided automatically.
• Intuit QuickBooks and GoCardless, for invoicing and payments if we work together.

I may also share data where the law requires it.

Where your data is held

Some of the providers above may process data outside the UK. Where that happens, it is covered by the safeguards UK data protection law requires, such as the UK International Data Transfer Agreement or adequacy regulations.

How long I keep it

• Enquiries that don't lead to work: up to 24 months, then deleted.
• Client records and correspondence: for as long as we work together, and then as long as needed to support what I delivered.
• Financial records: six years, as required by HMRC.

Your rights

Under UK data protection law you can ask me to:

• give you a copy of the personal data I hold about you;
• correct anything that's wrong;
• delete your data, where I'm not required to keep it;
• restrict or object to how I use it;
• give you your data in a format you can take elsewhere.

Email hello@gnu.consulting to make a request. There's no charge, and I'll respond within one month.

If you're unhappy with how I've handled your data, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Cookies

This website doesn't use cookies for analytics or advertising. See the cookie policy for details.

Changes to this policy

I'll update this page if anything changes, and the date at the top will show when it was last revised.