Privacy notice

This notice explains what personal data Zeph handles, why, and what rights you have. Zeph is a business-to-business research practice: most of the information it works with concerns companies rather than individuals, but some of it — names, roles and business contact details of people at those companies — is personal data, and this notice covers that too.

Who the controller is

Zeph is an independent UK decision-intelligence practice and is not currently incorporated. The controller identity and service address are being confirmed and are not published here yet, because publishing details that have not been confirmed would be worse than publishing none. In the meantime, every request under this notice can be made to hello@zephdesk.io and will be handled as described below.

What Zeph processes, and why

1. Enquiries. If you contact Zeph or submit the request form, Zeph processes your name, business contact details and whatever you choose to tell it about your decision, in order to respond and to assess whether an engagement is appropriate. Lawful basis: legitimate interests in responding to a business enquiry, and steps taken at your request prior to a contract.
2. Client correspondence and delivery. For a contracted engagement, Zeph processes the business contact details of the people it works with in order to perform the engagement, deliver the work and keep records of it. Lawful basis: performance of a contract, and legitimate interests in maintaining engagement records.
3. Business and professional information in research.Research uses public records, regulatory registers, filed accounts and published company material. This can include the names, roles, appointment histories and publicly filed details of directors, officers and people with significant control. This information is used only to establish the corporate and ownership reality relevant to a client’s decision. Lawful basis: legitimate interests in conducting business research, balanced against the fact that the information is already published in official registers for exactly this kind of scrutiny.
4. Website analytics. Aggregate measurement of how the site is used, to understand which pages are useful. See the cookies page for what is set and how to refuse it.

What Zeph does not do

1. It does not sell or rent personal data.
2. It does not build or sell consumer profiles.
3. It does not make automated decisions producing legal or similarly significant effects.
4. It does not use client-confidential material in public case studies.

Who else may see it

Zeph uses a small number of service providers to run the practice — website hosting and analytics, database hosting, and email. They process data on Zeph’s instructions under contract. Zeph does not disclose enquiry or client information to anyone else except where required by law.

TODO(founder): the specific named processors and their locations are to be confirmed and listed here before this notice leaves draft.

International transfers

Some providers operate outside the UK. Where that is the case, transfers are made under the safeguards permitted by UK data protection law. The confirmed list of providers and transfer mechanisms will be published alongside the processor list above.

How long it is kept

1. Enquiries that do not become engagements: kept for up to 24 months, then deleted.
2. Engagement records and deliverables: kept for 6 years after the engagement ends, to meet legal, tax and professional record-keeping needs.
3. Research working material: kept for the life of the engagement record, because a conclusion that cannot be traced to its evidence is worthless.
4. Analytics: kept in aggregate only.

Your rights

You have the right to ask for a copy of your personal data, to have inaccurate data corrected, to ask for erasure, to restrict or object to processing — including objecting to processing based on legitimate interests — and to data portability where it applies. Requests go to hello@zephdesk.io and are answered within one month.

If you are a director or officer whose publicly filed information has appeared in research and you want to object, say so at the same address. Zeph will consider the objection on its merits and will tell you the outcome.

You can also complain to the Information Commissioner’s Office at ico.org.uk. Zeph would rather you raised it directly first.

Changes

This notice is dated at the top. It will be updated when the practice’s processing changes, and the outstanding items marked above will be completed before it leaves draft.