Privacy notice

This notice explains how THEFOCUS LTD ("THEFOCUS", "we", "us") handles personal data collected through the website thefocus.solutions. THEFOCUS LTD is a private limited company registered in England and Wales under company number 14154101, with its registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

THEFOCUS LTD is the controller of the personal data described here. For any privacy question or request, email info@thefocus.solutions or write to us at the registered office address above, marking the letter "Privacy".

We have not appointed a data protection officer because the law does not require one for the processing we carry out. Requests sent to the address above reach the person responsible for data protection at THEFOCUS.

This notice covers the website thefocus.solutions and the enquiry form on it. It does not cover the separate websites of products and services operated under other names, such as LocalBoostHQ or FuelVeriq, which have their own notices, or websites run by other organizations that we link to.

When we work with a client under a contract, personal data handled in that engagement is governed by the contract and the notices that apply to it, not by this website notice.

When you submit the enquiry form we receive the information you enter:

• your name;
• your work email address;
• the name of your organization;
• your role (optional);
• your country (optional);
• the area of interest you select;
• your message and anything you choose to include in it;
• your acknowledgement that you have read this notice.

The form also sends some context with your submission so we can see where the enquiry started: the page you were on and, where relevant, the capability, industry or product that page relates to.

Please do not include special category data (for example health information) or information about criminal offences in your message. We do not need it to respond to a business enquiry.

To deliver pages to your browser and protect the site from abuse, our hosting provider (Netlify) and our DNS and network provider (Cloudflare) process technical data about each request, including your IP address, browser type, the page requested and the time of the request. They process this on our behalf to run and secure the service.

THEFOCUS does not store raw IP addresses in its own records and does not use device fingerprinting. We do not try to identify individual visitors from browsing data.

If you accept analytics cookies, we use Google Analytics 4 to measure how the site is used. We receive this as aggregated reports, for example the number of visits to a page, how visitors arrived and approximate location at country or region level. The Cookie policy explains this in detail, including how to change your choice.

Under the UK GDPR we must have a lawful basis for each use of personal data. Ours are:

• Responding to your enquiry, discussing whether and how we could work together, and keeping a record of that correspondence: our legitimate interests in handling business enquiries and developing our business. Where you ask us to prepare a proposal or take other steps before entering into a contract with you or your organization, we may also rely on those steps being necessary for a contract.
• Analytics through Google Analytics 4: your consent, which you give or refuse through the cookie banner. Consent is also what the Privacy and Electronic Communications Regulations 2003 (PECR) require for these cookies as we use them.
• Keeping the website secure, preventing spam and misuse of the enquiry form, and diagnosing technical faults: our legitimate interests in operating a secure website.
• Keeping records an engagement requires if one follows, such as contract, invoicing and tax records: compliance with our legal obligations.
• Establishing, exercising or defending legal claims and handling complaints: our legitimate interests, and our legal obligations where they apply.

Where we rely on legitimate interests, we have weighed those interests against your rights and expectations. A person who contacts a business through its website about work would reasonably expect that business to read the message, reply and keep a record of the exchange. You can ask us for more detail on this assessment.

We do not add you to a marketing mailing list because you sent an enquiry. We do not sell personal data, and we do not use it for automated decision-making that has legal or similarly significant effects on you.

We share personal data only with service providers that process it on our instructions, and only to the extent each needs:

• Netlify, Inc.: website hosting and the Netlify Forms service, which receives and stores enquiry submissions. Netlify checks submissions for spam using Akismet, a service of Automattic Inc.
• Cloudflare, Inc.: DNS, content delivery and security for the website.
• Google LLC and Google Ireland Limited: Google Tag Manager and Google Analytics 4, only after you accept analytics cookies.
• Our email service provider: enquiry submissions are sent to THEFOCUS by email so we can reply.
• Namecheap, Inc.: hosting for the customer relationship management (CRM) system that THEFOCUS runs itself, where we may record your enquiry and our correspondence with you.

THEFOCUS delivers engagements with independent specializt partners. If answering your enquiry would require sharing your details with a partner, we will tell you first and share only what is needed.

We may also disclose personal data to professional advisers (such as lawyers and accountants) under duties of confidentiality, to a buyer or successor if the business or its assets are transferred, or where the law requires it, for example in response to a valid request from a regulator, court or law enforcement body.

Some of our service providers are based in, or use infrastructure in, the United States and other countries outside the UK. People who work on THEFOCUS's behalf may also access enquiry data from outside the UK. Where personal data is transferred outside the UK, we rely on a transfer mechanism recognized by UK data protection law. Depending on the provider, this is:

• UK regulations that allow transfers to US organizations certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), where the provider holds that certification; or
• the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission's standard contractual clauses, as included in the provider's data processing terms.

You can ask for more information about the safeguards for a particular provider by emailing info@thefocus.solutions.

• Enquiries that do not lead to an engagement: up to 24 months from our last contact with you, then deleted from Netlify Forms, our mailbox and the CRM.
• Enquiries that lead to an engagement: kept with the client records for as long as the engagement lasts and afterwards for the periods UK company and tax law requires, generally six years from the end of the accounting period they relate to.
• Submissions flagged as spam: deleted when we review them and in any case within the same 24-month limit.
• Analytics: Google Analytics keeps event-level data for 14 months, after which only aggregated reports remain.
• Your cookie choice: stored in your browser for 12 months, as described in the Cookie policy.

We may keep data for longer where we need it to deal with a complaint or a legal claim, and only for as long as that need lasts.

The website is served only over HTTPS, so data you submit is encrypted in transit. Access to enquiry submissions, the mailbox and the CRM is limited to people who need it to respond to you and is protected by individual accounts and multi-factor authentication where the service supports it. We choose service providers that offer contractual data protection commitments.

No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO, and you where the law requires.

Under UK data protection law you have the right to:

• be informed about how we use your personal data, which is the purpose of this notice;
• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased in certain circumstances;
• restrict how we use your data in certain circumstances;
• object to processing we carry out on the basis of legitimate interests, and to any use of your data for direct marketing;
• receive data you provided to us in a portable format where we process it on the basis of consent or a contract;
• withdraw your consent to analytics cookies at any time through the cookie settings link in the site footer, without affecting processing that took place before you withdrew it.

To exercise a right, email info@thefocus.solutions. We may ask for information to confirm your identity. We will respond without undue delay and within one month of receiving your request, or of receiving the information we need to confirm your identity. Where a request is complex, or you send several, we may extend this by up to two further months and will tell you why within the first month. When you ask for access, we will carry out a reasonable and proportionate search for your data. There is normally no fee.

If you are unhappy with how we have handled your personal data, please complain to us first at info@thefocus.solutions. We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay and tell you the outcome.

You also have the right to complain to the UK's data protection regulator, the Information Commission, which continues to operate as the ICO (formerly the Information Commissioner's Office). You can do this at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.

This website is intended for businesses and other organizations. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

We will update this notice when the way we handle personal data changes, for example if we add a new service provider or a new type of cookie. The date at the top of the page shows when it was last updated. If a change materially affects how we use data we already hold about you, we will tell you directly where we can.