Privacy notice

Last updated: 1 May 2026

This privacy notice explains how Abacus Analysis Ltd. ("we", "us", "our") handles personal data when you visit our website, send us an enquiry, or engage us as a consulting client. It applies to any personal data we process as a data controller. When we process personal data on behalf of a client institution as part of a consulting engagement, we do so as a data processor under that client's instructions; the client's own privacy notice will apply to those activities.

1. Who we are

Abacus Analysis Ltd. is a private company limited by shares, registered in England and Wales under company number 03235896. Our registered office is Galla House, 695 High Road, North Finchley, London N12 0BT. We are registered with the Information Commissioner's Office under registration number ZC186209.

For any data protection enquiry, contact us at privacy@abac-an.com or by post at the address above.

2. What personal data we collect

We collect only what we need to respond to enquiries and run our practice.

Information you give us

• Your name, work email, organisation and role, when you submit the enquiry form or correspond with us by email.
• The content of any message you send us, including details of the situation you describe.
• Any contractual information needed to engage us, such as billing contact and purchase-order details.

Information collected automatically

• Aggregated, anonymised analytics about pages viewed on our website. Where we use Plausible Analytics, no cookies are set and no personal data is collected; visits are counted in aggregate only. See section 9 for details.
• Server logs collected by our hosting provider, used for diagnostic and security purposes only.

3. How we use your personal data

• To respond to your enquiry and have a relevant first conversation.
• To assess whether we are the right firm for the work you describe.
• To draft, negotiate and perform consulting engagements with clients.
• To send you a small number of follow-up messages directly related to your enquiry. We do not send marketing emails without your consent.
• To meet our own legal, tax and regulatory obligations.

4. Our lawful basis

• Legitimate interests — responding to enquiries that you have initiated, and running and protecting the firm.
• Contract — where processing is needed to take steps at your request before entering a contract, or to perform a contract with you or your organisation.
• Legal obligation — where we are required to retain or disclose data under UK law.
• Consent — for anything outside the above, such as adding you to a future mailing list.

5. Who we share your data with

We share personal data only where necessary and only with carefully chosen suppliers:

• Form processor — our enquiry form is processed through Formspree, who store submissions briefly so we can read them.
• Email and calendar — Google Workspace, used to send and receive email and schedule calls.
• Accounting — Xero, used to maintain our books and issue invoices.
• Analytics — Plausible Analytics, which provides aggregated, cookie-free statistics.
• Hosting — Google Firebase Hosting, who serve this website.
• Professional advisors — our accountants, auditors and legal advisors, where strictly necessary.

We do not sell personal data. We do not transfer personal data to third parties for their own marketing.

6. International transfers

Some of the suppliers listed above process data outside the United Kingdom. Where this happens, transfers are protected by the UK Government's adequacy regulations (for example, transfers to the European Economic Area), the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, depending on the destination.

7. How long we keep your data

• Enquiry messages — up to 24 months from your last contact, then deleted unless a client relationship has been formed.
• Client records — for the duration of the engagement and for six years afterwards, in line with UK tax and limitation periods.
• Marketing lists — until you unsubscribe.
• Server logs — typically retained for 30–90 days by our hosting provider.

8. Your rights

Under the UK GDPR you have the right to:

• Ask us what personal data we hold about you and receive a copy of it.
• Ask us to correct anything that is wrong.
• Ask us to delete your data, where there is no overriding legal reason for us to keep it.
• Object to processing based on legitimate interests.
• Restrict processing in certain circumstances.
• Receive your data in a portable format.
• Withdraw any consent you have given.

To exercise any of these rights, email privacy@abac-an.com. We will respond within one month.

9. Cookies and analytics

This website does not set tracking cookies. We use Plausible Analytics to count page views in aggregate; Plausible is privacy-friendly, sets no cookies, and does not collect personal data about visitors. Where third-party features (such as embedded video or font services) load on this site, those providers may set their own cookies or collect data under their own privacy notices; we list these in section 5 above.

10. Security

We take appropriate technical and organisational measures to protect personal data, including access controls, encrypted transport (HTTPS), strong authentication on supplier accounts, and limiting access to data on a need-to-know basis. No system is perfectly secure; if we ever believe your data has been compromised, we will tell you and the Information Commissioner promptly as required by law.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by phone on 0303 123 1113.

12. Changes to this notice

We may update this notice from time to time, for example when we change suppliers or processing activities. The "last updated" date at the top tells you when the current version took effect. Material changes will be announced on this page.