2. Data protection laws we follow

We mainly operate under the UK GDPR and the Data Protection Act 2018. For users in theEU, we will handle personal data in line with the core principles of the EU GDPR underRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

We have not appointed a Data Protection Officer, for all privacy matters, please contact ususing the email above.

3. What data we collect

We collect:

● Information you provide

For example your name, work email, company, country/region and any details you include when:

○ sending us a message through the contact form

○ booking a call (via Calendly)

○ emailing us directly

● Technical information

Basic information from your browser and our hosting provider, such as:

○ IP address

○ browser type and version

○ pages visited and time and date

○ referring site or link

This comes mainly from Webflow, which hosts our site, Calendly and Zoho that are used forbooking meetings and e-mail exchange.

Please do not send detailed customer data, ID documents or other sensitive information via the website forms. If we need that kind of material, we will agree a more appropriate channel with you.

4. How we use your data and legal bases

We use your data for:

● Enquiries and proposals

To read and respond to messages, arrange calls and prepare proposals.Legal basis: our legitimate interests in running and growing the business and, whererelevant, taking steps before entering into a contract.

● Providing services

To perform our obligations if you or your organisation engage us.Legal basis: contract.

● Operating and securing the website

To keep the site running, monitor basic usage and protect against misuse or attacks.Legal basis: our legitimate interests in operating a secure, reliable website.

● Marketing

If you sign up for updates, to send occasional news about our services or related content.
Legal basis: consent. You can withdraw this at any time using the unsubscribe link or by contacting us.

● Legal, tax and compliance

To keep records we are required to keep and to deal with legal or regulatory requests.
Legal basis: legal obligations and our legitimate interests in protecting our rights.

5. Cookies and analytics

Our site runs on Webflow, which uses cookies and similar technologies to deliver and securethe site.

If we add analytics, LinkedIn tags or other non-essential cookies, we will:

● show a clear cookie banner the first time you visit; and

● only use those cookies if you consent.

You can control cookies through your browser settings.

6. Who we share data with and where it goes

We do not sell your personal data.

We share data only with:

● Service providers who help us run the website and our business (for example Webflow for hosting, Calendly for scheduling, email and cloud storage providers).
● Professional advisers (for example lawyers or accountants) where needed.
● Authorities where we are legally required to do so or it is necessary to establish or defend legal claims.
● Potential buyers or investors if we ever sell or restructure our business, underappropriate confidentiality safeguards.

Some of our providers are based outside the UK and EEA (for example Webflow, Calendly and some email or storage services). Where personal data is transferred internationally, we use recognised safeguards such as adequacy regulations or standard contractual clauses.

7. How long we keep data

We keep personal data only for as long as we reasonably need it for the purposes above, or to meet legal and tax requirements. We do not delete individual records on a fixed day;instead we review and clear older data from time to time.

As a guide:

● Enquiries and prospects – normally up to three years after our last interaction, thendeleted or anonymised during periodic clean-ups unless needed longer for legal reasons.
● Client records – key emails, contracts and working papers for up to six years after the end of an engagement, to reflect typical limitation periods and our need to respond to later questions.
● Marketing contacts – until you unsubscribe or we remove long-inactive addresses.We keep a minimal record of unsubscribes so we do not contact you again bymistake.
● Technical logs – kept by our providers for limited periods appropriate for security and troubleshooting, in line with their own policies.

If you exercise your rights (for example ask us to erase or restrict data), we will adjust retention where the law requires it.

8. Security

We use reputable hosting, email and cloud providers, and restrict access to personal data topeople who need it for their role. While no system can be guaranteed 100% secure, we takereasonable steps to protect your information from loss, misuse and unauthorised access.

9. Children

Our site and services are aimed at professional adults and businesses. We do not knowinglycollect or use personal data from children under 16.

If you believe a child under 16 has provided us with personal data, please contact info@askmlro.co.uk and we will delete it as soon as reasonably possible.

10. Your rights and how to exercise them

Under data protection law, you have the right to:

● ask for access to the personal data we hold about you
● ask us to correct inaccurate or incomplete data
● ask us to erase your data, in some circumstances
● ask us to restrict how we use your data, in some circumstances
● object to our use of your data where we rely on legitimate interests, or for direct marketing
● ask for data portability in some cases
● withdraw consent where we rely on consent (for example for marketing)

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, or if you want to know more about how we use your data,email info@askmlro.co.uk.

You can also opt out of marketing emails at any time by using the unsubscribe link in those emails.

11. Complaints

If you have concerns about how we use your personal data, please contact us first.