Privacy policy

What this policy covers

This policy covers this website only - what happens when you browse it, send us a message, or complete the readiness assessment.

It does not cover the information we handle while doing work for a client. That is governed by the engagement letter and the confidentiality terms agreed with that client, which are more specific than anything on a website could be.

What we collect, and why

Everything in this section is something you chose to type. There is one thing that is not, and it is set out under Cookies and measurement below - none of it happens unless you agree to it first, and refusing changes nothing else about the site.

When you use the contact form. Your name and email address, which we need in order to reply. Optionally your phone number and company, and whether you want a call or have a question. Plus whatever you write in the message. We also record which page of this site you sent it from, and - if you arrived from one of the service pages - which service you were reading about, so that the reply answers the question you were actually looking at.

The optional questions after you send a message. Turnover band, financial year end, who currently handles your finances, which accounting software you use, roughly how many sales invoices you raise a month, when you need support, and how you heard about us. Every one is optional, and they exist so we can reply with something useful rather than a list of questions. Turnover and invoice volume are two of the things a monthly fee depends on, which is why we ask.

When you complete the readiness assessment. Your email address, optionally your name and company, your answers to the seven questions, your financial year end, and which page you took it from. From those we work out and keep the result itself: a score out of the maximum available, a readiness percentage, a maturity level, how many weeks remain to your year end, the written observations, a short summary and the recommendation that follows from it, the main challenge your answers point at and what we would suggest about it, a rating for each part of your finance function, and the level of support that fits. We use this to send your result and, where it looks like we can help, to follow up.

Your copy of the assessment. The email carrying your result also links to the same report as a web page, so it can be printed or saved. That link is the only way to reach the page: it carries a long random code, is not listed anywhere, and tells search engines not to index it - but it is not password protected either, so anybody you forward it to can open it. It lasts as long as we keep the assessment, and goes when that goes.

Technical information. Our host keeps standard server logs, which include IP addresses, for security and diagnostics. When you submit a form we also briefly hold a one-way hash of your IP address - not the address itself - purely to stop the same source submitting dozens of times in an hour.

Our lawful basis

For replying to an enquiry or sending an assessment result, our basis is legitimate interests: you asked us to get in touch, and responding is what you would expect. Where we later contact you about our services, we rely on legitimate interests for business contacts and consent where consent is required.

You can tell us to stop at any time and we will, without needing a reason.

Who else sees it

We do not sell your information, and we do not share it for advertising. It reaches other organisations only because they run the systems we use:

• WP Engine hosts this website, so anything you submit passes through and is stored on their infrastructure.
• Google Workspace carries the notification email that tells us an enquiry has arrived, and holds our replies.
• Microsoft runs the measurement, if you agreed to it. The replay of your visit is held by them and processed on our behalf. Refuse, and nothing about your visit reaches them at all.
• Cloudflare runs the check on our forms that tells a person from an automated script. It sets no cookie and is not used to advertise to you or to recognise you elsewhere; it exists so that the forms are usable by people and not by spam.
• Slack is where our team is told an enquiry has arrived. The alert carries your name, your email address and the first line or two of your message, so that whoever is free can pick it up.
• Professional advisers where we are required to disclose something by law or a regulator.

We load no advertising scripts and no social media widgets, and nothing here is shared for advertising. The measurement described below is the only thing reported to anyone, it runs solely because you agreed to it, and refusing means nothing you do here leaves this site.

Where it goes

Our providers operate internationally, so your information may be processed outside the UK. Where that happens it is protected by the safeguards UK data protection law requires, such as the International Data Transfer Agreement or an adequacy decision.

How long we keep it

Enquiries and assessment results are kept for two years from your last contact with us, then deleted. If you become a client, engagement records are kept for the longer periods our professional and legal obligations require, and those are set out in the engagement letter rather than here.

You can ask us to delete an enquiry sooner and we will, unless we are required to keep it.

Cookies and measurement

Two cookies are set whatever you decide, and neither is used to track you: our host places a security cookie that helps it tell real visitors from automated traffic, and we store your answer to the question below so you are not asked it on every page. Both are strictly necessary, which is why they do not require consent.

WordPress sets additional cookies only if you log in to administer the site, which does not apply to visitors.

Beyond those we would like to use Microsoft Clarity, which set cookies of their own and record how the site is used. Nothing from them is loaded, requested or stored until you agree - not the script, not the cookie. Refusing is one click, in the same place and the same size as agreeing, and the site behaves identically either way.

Your answer is remembered for six months. You can change it at any time from Cookie settings at the foot of any page, and if you withdraw consent we delete what those cookies stored.

If your browser sends a Global Privacy Control signal we take it as a refusal and do not ask.

What Microsoft Clarity records is worth being specific about: it replays a visit as a session - pointer movement, clicks, how far each page was scrolled - and aggregates those into heatmaps. It masks what you type, so the contents of the enquiry form and the assessment are not in the recording. The recordings sit with Microsoft, who process them on our behalf and may do so outside the UK under the safeguards described above.

We also use Google Search Console, which tells us which searches showed this site, which pages Google has indexed and where they rank. It works from Google’s own records of its search results rather than from your visit: it sets no cookie, runs no script on these pages, and gives Google nothing about you that it did not already have. What we see is counts and averages across everyone, never a person.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of what we hold about you
• correct anything that is wrong
• delete it
• restrict what we do with it
• provide it in a portable format
• stop using it, including for any marketing

Email sales@ozriaconsulting.com and we will respond within one month. There is no charge.

If you are not satisfied with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you raised it with us first, but you do not have to.

Changes to this policy

If we change how we handle information, we will update this page and change the date at the top. Where a change materially affects you, we will say so rather than leaving you to notice.