Privacy notice

SHADOWROOT CONSULTANCY LTD ("Shadowroot", "we", "us") is a private limited company registered in England and Wales, company number 16851458, registered office Office 15684, 182-184 High Street North, East Ham, London, England, E6 2JA. We are the data controller for personal data collected through this website.

For any data protection question or request, contact us at info@shadowroot.co.uk.

We only collect the information you choose to give us. If you complete the enquiry form, that is your name, work email address, organisation, the area of support you select and the description you write.

For security and abuse prevention we also record the time of submission, your browser's user-agent string, and a one-way hashed value derived from your IP address. We do not store your IP address itself.

We do not ask for special category data, and you should not include sensitive operational detail, credentials or client-identifiable security findings in an initial enquiry.

We use enquiry details solely to understand your requirement, respond to you and, where relevant, scope a potential engagement.

Our lawful bases are your consent when you submit an enquiry, and our legitimate interests in responding to business enquiries, preventing abuse of the form and operating a professional consultancy.

This website does not set advertising, analytics or tracking cookies, and we do not use third-party analytics. Only cookies and equivalent storage strictly necessary to serve and secure the site are used.

We do not sell personal data. Enquiries submitted through this website are stored in a private database provided by our hosting and backend platform, Lovable (which uses Supabase for database hosting and Cloudflare for content delivery and application hosting). These providers act as processors on our instructions under written terms.

Enquiry records are stored in the platform's hosted infrastructure and may be processed in the United Kingdom, the European Economic Area or the United States. Where data leaves the UK, transfers rely on the UK International Data Transfer Addendum or equivalent safeguards.

We also use business email to correspond with you, and may share details with professional advisers where we are legally required to do so.

Enquiries that do not lead to an engagement are retained for up to 12 months so we can handle follow-up correspondence, and are then deleted.

Where an engagement follows, records are retained for the period required by the engagement contract and applicable UK legal, tax and professional obligations.

Enquiry records are held in a private database table that is not readable by website visitors; access is restricted to authorised Shadowroot personnel and trusted server-side code. Data is encrypted in transit.

We apply proportionate technical and organisational measures, including access control and least-privilege handling of client information.

Under UK data protection law you have rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent at any time.

To exercise a right, email info@shadowroot.co.uk. We will respond within one month.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

We may update this notice as our services or providers change. The current version is always published on this page, with the date it was last updated shown above.