Privacy notice

ON Consulting Limited (company number 14937288, registered in England and Wales) is the data controller for the information described in this notice. Our registered and postal address is c/o Inni Accounts, Unit 1 Derwent Business Centre, Clarke Street, Derby DE1 2BU.

You can reach us about anything in this notice at hello [at] on-consulting.uk.

Three forms on this site collect personal data: the general enquiry form on /contact, the referral-partner enquiry on /partners, and the sub-consultant enquiry on /join-on. Each is described below. Nothing else on this site - no account, no login, no e-commerce - asks you for personal information.

The general enquiry form (/contact) asks for your name, email address, company name, what your enquiry is about, your timing, a short written brief, and whether you would rather we called you.

The referral-partner form (/partners) asks for your name, email address, firm name, the type of firm you are, and where you think the overlap is.

The sub-consultant form (/join-on) asks for your name, email address, discipline, how you would like to work with us, a LinkedIn or website link, and two deals you have led.

Every form also carries a signed render timestamp to reject altered submissions and offer a fresh attempt if the form was sent too quickly or is out of date. Every form carries a field that is invisible to a real visitor and left blank by one - it exists only to catch automated spam, and a filled-in copy is discarded rather than acted on. We also use the IP address your submission came from to limit repeated submissions and verify that they are human. For the in-memory rate limit, it is converted into a one-way code, and only that code is held in the server's memory, for around an hour, so repeat submissions can be recognised. The code is not attached to your enquiry and never reaches the inbox your enquiry is sent to. That in-memory code is not stored in any database and does not survive the server restarting. Separately, Cloudflare Turnstile checks your browser and device signals, and we send Cloudflare your verification token and IP address to validate the check. We do not send Cloudflare the name, email address or message you enter in the form.

We collect this information because you have chosen to send it to us, in order to have a conversation about instructing us, referring work to us, or working with us. Our lawful basis under UK GDPR is legitimate interests (Article 6(1)(f)): responding to a business enquiry that you initiated is a reasonable and expected use of the information you gave us for exactly that purpose, and it does not override your own interests or rights.

Your submission is sent as an email, via Resend (an email-delivery service we use as a data processor), to an ON Consulting inbox that our team monitors. Your email address is set as the reply-to address, so whoever picks up your enquiry can reply to you directly rather than the message going anywhere else first.

We do not store your enquiry in a database of our own. If sending fails, we log that it failed together with your name and email address only, so we can follow up manually - never the content of what you wrote.

We keep enquiry emails, and documents we hold digitally, for as long as we may need them. In a professional practice that is a long time. We may have to show what we advised and when, years after a matter has closed, and a claim can be brought long after the work itself is finished. We do not set an automatic deletion date for either.

If you want us to delete what we hold about you, ask us and we will, unless we are required to keep it. See "Your rights" below.

Resend (our email-delivery data processor), Cloudflare (our human-verification data processor, through its Turnstile service), and the ON team member who handles your enquiry. We do not sell your data. Cloudflare receives technical verification information, not your enquiry text.

This site does not use cookies to identify you. See our Cookies page for what the site's analytics does collect.

Under UK GDPR you can ask us to confirm what personal data we hold about you, to correct it, to delete it, to restrict how we use it, to object to our use of it, or to receive a copy of it in a portable format. Email hello [at] on-consulting.uk and we will deal with your request.

If you are unhappy with how we have handled your personal data, tell us first - see our Complaints page. You can also complain directly to the UK's data protection regulator, the Information Commissioner's Office (ICO), at any time: ico.org.uk, or by telephone on 0303 123 1113.

We analyse enquiry content using an automated classifier, TypeSafe Jev, with processing in the United States, solely to filter spam and route your enquiry to the right person. We share your form type, enquiry choice, company, email domain (not the part before the @) and up to 4,000 characters of your enquiry text. TypeSafe does not use this information to train models and retains it for as long as reasonably necessary under its data terms. The classifier makes no decision with legal or similarly significant effect. A person reads every enquiry, including those marked as likely spam.