Privacy Policy

1. Who We Are

GIVE Analytics Limited ("we", "us", "our") is a financial modelling and analytics consultancy registered in England and Wales (Company No. 12270662). Our registered office address is Brook House, Brook Farm Close, Buckingham, Buckinghamshire, MK18 4FE, United Kingdom.

We work with a range of institutional and professional clients, including investment funds, corporations, and government bodies, and our analytical outputs are frequently used in consequential capital and legal contexts. We take our data protection obligations seriously and handle personal data with the same discipline we apply to our professional work.

We are the data controller for the personal data described in this policy. If you have any questions or wish to exercise your rights, please contact us at privacy@giveanalytics.com.

2. What Personal Data We Collect

We collect and process the following categories of personal data:

• Contact enquiries: first name, last name, company name (optional), email address, subject (optional), and the content of your message, submitted via our contact form.
• Newsletter subscriptions: email address only, when you subscribe to GIVE Analytics Insights. We use a double opt-in process: you submit your email, we send a confirmation link, and the address is only added to the list when you click it. Each issue carries a one-click unsubscribe link.
• Technical data: IP address, browser type and version, time zone, operating system, and pages visited, collected automatically via server logs when you access our website.
• Cookie data: a preference cookie (ga_consent) recording your cookie consent decision, and a session cookie (PHPSESSID) required for security features including CSRF protection. No tracking or advertising cookies are used.

We do not collect sensitive personal data (as defined under UK GDPR Article 9) and we do not carry out automated decision-making or profiling.

3. How We Use Your Personal Data

Purpose	Data used	Lawful basis
Responding to your enquiry	Name, email, message content	Legitimate interests (Article 6(1)(f)): responding to a contact request you initiated
Sending you a copy of your message (if requested)	Name, email, message content	Consent (Article 6(1)(a)): you check the box explicitly requesting a copy
Newsletter delivery (GIVE Analytics Insights)	Email address	Consent (Article 6(1)(a)): you provided your email and confirmed via the double opt-in link
Website security and fraud prevention	IP address, session data	Legitimate interests (Article 6(1)(f)): protecting the integrity of our systems
Server log analytics (aggregate, non-identified)	IP address, browser/OS, pages visited	Legitimate interests (Article 6(1)(f)): understanding website usage to improve our service

4. How Long We Keep Your Data

• Contact enquiries: retained for up to 2 years to allow us to follow up or resolve any related matter, then securely deleted.
• Newsletter subscribers: retained for as long as the subscription is active. Confirmation-pending records that are not confirmed within 24 hours are deleted. On unsubscribe, the address is retained in unsubscribed status for 12 months to prevent accidental re-addition, then deleted.
• Server logs: retained for up to 90 days for security monitoring, then automatically deleted.
• Session cookies: expire when you close your browser or after 2 hours of inactivity.
• Consent cookie: stored for 365 days.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We may share it with the following third parties solely to deliver our services:

• IONOS SE: email delivery infrastructure (SMTP relay). Your message content is transmitted over TLS to deliver your enquiry to us.
• Google LLC (reCAPTCHA): reCAPTCHA v3 provides invisible spam protection on our contact form. Google's reCAPTCHA collects hardware and software information including device and application data and sends it to Google for analysis. Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.
• Google LLC (Analytics): Google Analytics 4 provides aggregate website usage statistics. Analytics is loaded only after you explicitly accept analytics cookies via our cookie banner; if you decline or take no action, no analytics data is sent to Google. IP addresses are anonymised before processing, and advertising features (Google Signals, ad personalisation) are disabled. See our Cookie Policy for the specific cookies set, and Google's Privacy Policy.

All third-party processors are subject to data processing agreements and are required to process your data only on our documented instructions.

6. International Transfers

IONOS SE is headquartered in Germany and processes data within the UK and EEA under an adequacy decision and standard contractual clauses where applicable. Google LLC transfers data to the United States; this transfer is made under the EU-US Data Privacy Framework (UK Extension) and/or Standard Contractual Clauses approved by the Information Commissioner's Office.

7. Your Rights

Under UK GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data where there is no compelling reason for us to continue processing it.
• Restriction: ask us to restrict processing of your data in certain circumstances.
• Objection: object to processing based on legitimate interests.
• Portability: receive your data in a structured, machine-readable format where processing is automated and based on consent or contract.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please email privacy@giveanalytics.com. We will respond within one calendar month.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

8. Client Engagement Confidentiality

This Privacy Policy governs personal data collected through this Website (contact enquiries, technical data, and cookies). It does not govern data shared with us in the context of a professional engagement.

Information disclosed to us during a client engagement, including business plans, financial data, commercial strategies, transaction details, and the identity of the client or any related parties, is treated as strictly confidential. Such information is handled solely for the purpose of delivering the relevant instruction and is not disclosed to any third party except as expressly authorised by the client or as required by law.

Where an engagement requires a formal non-disclosure agreement, one is put in place before any confidential information is exchanged. Even where no separate NDA is in place, our standard confidentiality obligations apply in full from the outset of any instruction. Client identities are never disclosed publicly or to any third party without explicit consent.

Engagement-specific data handling obligations are set out in our terms of engagement, which govern each instruction.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include TLS encryption for all data in transit, CSRF and rate-limit protections on our contact form, and access controls on our server infrastructure.

10. Links to Other Websites

Our website contains links to third-party websites (including the GIVE Foundation and GIVE Consultancy). We are not responsible for the privacy practices of those sites and encourage you to read their respective privacy policies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Where changes are material, we will take reasonable steps to bring them to your attention.