What happens to what you tell us.

Circus Consulting Limited, company number 06517274, registered office c/o Ukmal, Unit 7, 3-5 Little Somerset Street, London, E1 8AH. You can reach us about anything in this policy at hello@circusconsulting.co.uk.

• Enquiries. When you use the contact form we collect your name, email address, and anything else you choose to put in the form, such as your business name, phone number and a description of what you need.
• Technical data. Our servers and our content delivery provider record standard request information: IP address, browser type, the pages requested and the time of the request. This is used to keep the site available and secure.
• Advertising measurement. If you arrive from a Google Ads advertisement, the link may carry a click identifier that lets us see which advertisement produced an enquiry. We store that identifier alongside the enquiry.
• Email and the visit that follows it. If you have asked to hear from us, we record whether our emails were opened and which links were clicked, and, where you follow one of those links here, which pages you then read on this site. That is held against your email address rather than anonymously — clause 05 explains why and for how long.

• To reply to your enquiry and to discuss work with you. Lawful basis: steps taken at your request before entering a contract.
• To run and secure this website, and to understand which advertisements bring in enquiries. Lawful basis: our legitimate interest in operating and improving our business, balanced against your interests.
• To meet legal and accounting obligations where a project goes ahead. Lawful basis: legal obligation.

This site sets a session cookie that is necessary for the contact form’s security check, and, if you arrive here by clicking a link in one of our emails, a second cookie that records which pages you read on this site during that visit — see clause 05. We do not set advertising cookies on this site, and we do not use third-party analytics that track you across other websites. Fonts are loaded from Google Fonts, which means your browser makes a request to Google’s servers when a page loads; Google receives your IP address as part of that request.

If you have asked to hear from us, our emails record whether the message was opened and which links in it were clicked. Where you follow one of those links to this website, we also record which pages you go on to read during that visit, for up to 30 days, and we hold that alongside your email address — so it is information about an identified person, not anonymous statistics. We do this to understand which of the things we write about are useful, and to avoid sending you more of what you ignore. Our lawful basis is legitimate interests (Article 6(1)(f)): our interest in knowing whether our own mail is worth sending, weighed against the fact that this is limited to our own website, is never combined with data from anywhere else, and is never sold or shared. It stops the moment you unsubscribe, and every email carries a one-click unsubscribe link. You may object to it at any time, or ask us to delete what we hold, using the address in clause 08.

We do not sell personal information and we do not share it for anyone else’s marketing. We use a small number of service providers who process information on our behalf under contract: our hosting is on codanomiq, our own platform, which runs on Amazon Web Services in the United Kingdom, our content delivery and security layer is Cloudflare, and enquiry email is delivered through Amazon Web Services. Where a provider processes data outside the United Kingdom, that transfer is covered by the UK addendum to the standard contractual clauses or an equivalent safeguard.

Enquiries that do not become projects are deleted within two years. Records relating to work we have carried out are kept for seven years, which is the period our accounting and tax obligations require. Server logs are kept for up to 90 days. A visit recorded after an email click (clause 05) closes after 30 days, and everything we hold about you stops being collected the moment you unsubscribe.

You have the right to ask us for a copy of the personal information we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to receive it in a portable form. Where we rely on legitimate interests, you can object at any time. Email hello@circusconsulting.co.uk and we will respond within one month.

If you are not satisfied with our response you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.

Separately from this website, some of our work requires us to connect to systems our clients operate — QuickBooks Online through Intuit’s Accounting API, a CRM such as Zoho, or the client’s own Google Ads account. In that work the client is the data controller and Circus Consulting Limited acts as data processor: we process those records only on the client’s documented instruction, and never for our own purposes. How that data is handled on our platform is also set out in the codanomiq privacy notice.

Access is granted by the client and can be withdrawn by them at any time: for QuickBooks Online through Intuit’s own authorisation screen, withdrawn from Apps → Connected apps inside QuickBooks Online; for Google Ads by linking their account to our manager account, withdrawn by unlinking it; and for any other system from that system’s own settings. Withdrawal stops all further access immediately.

What each connection reads and writes:

• QuickBooks Online reads only: accounting transactions, including invoices, bills, payments, expenses, deposits, transfers, credit notes and journal entries; contact records for customers, suppliers and employees, including names, addresses, telephone numbers and email addresses; reference data such as the chart of accounts, products, services and tax codes; and reports derived from these. It cannot create, alter or delete anything in a client’s books.
• Zoho, where an engagement includes it, creates enquiry or quote records from enquiries made on the client’s website, and reads their status.
• Google Ads reads the account’s reporting, and writes only the limited management changes described on our Google Ads page and, where an engagement includes it, the results of enquiries as conversions.

We do not access banking credentials, card numbers or payment instruments, we do not use client data to train machine-learning models, and we do not share it with anyone for their own purposes.

Extracts are held on Circus Consulting managed equipment in the United Kingdom, encrypted at rest, and authorisation tokens for QuickBooks Online are held in the operating system keychain and are never committed to source control. Extracts are kept for the duration of the engagement, then deleted or returned to the client, unless the client agrees otherwise or the law requires us to keep them.

Individuals whose personal data appears in a client’s records should direct requests to that client, as controller. If such a request reaches us first we will pass it on promptly and help the client answer it.

If we change this policy we will update the date at the top of this page. Material changes affecting existing clients will be notified by email.