Privacy Notice

Last updated: 29 September 2026.

Organisation and Contact

Cole Valley Consulting Ltd is the data controller for personal information processed through this website and its consultation enquiry service. Contact ColeValleyEnquiries@convergedcommslab.work with privacy questions, information-rights requests or complaints.

Information Collected

The consultation enquiry form asks for your name, email address, company, service interest, message and an available consultation date and time. All online enquiries require a booking slot. We record the request, its reference, status, relevant timestamps and the website page from which it originated. Acceptance adds calendar-event and meeting information.

Hosting and API services process technical request information, including IP addresses, request times and operational errors. Abuse-prevention records include hashed identifiers, counters, expiry timestamps and form-token identifiers. These hashed identifiers are not treated as anonymous information.

Please provide only information needed for the enquiry. Do not include passwords, health information or other sensitive personal information in your message.

Purposes and Lawful Bases

We use your information to respond to consultation requests, check calendar availability, hold a requested time, obtain the organiser's decision and send service notifications or a calendar invitation. We use technical information to operate the service, investigate faults and protect the website, mailboxes and calendar from abuse.

We rely on legitimate interests for responding to business representatives, arranging business consultations and maintaining a secure, reliable service. We consider whether the information is necessary for these purposes and balance those interests against your rights and reasonable expectations.

Where you are personally entering a contract with us, or ask us to take necessary steps before entering that contract, we may instead rely on contract for that processing. A contract with your employer does not automatically make contract the lawful basis for using your personal details.

Submitting an enquiry does not subscribe you to a mailing list or authorise unrelated marketing. The website does not operate an advertising or marketing-subscription workflow.

Information Sharing

Authorised Cole Valley personnel use the enquiry mailbox and booking records to handle your request. Consultation details are shared with the organiser through Microsoft Teams approval notifications. If your request is accepted, Microsoft 365 creates a Teams calendar event and sends an invitation from the organiser to the email address supplied. Booking acknowledgements and other service notification emails are sent from the Cole Valley enquiry mailbox.

Microsoft and its service subprocessors provide website hosting, API execution, storage, email, calendar invitations, Teams approvals and operational telemetry. We do not publish your enquiry details on the public website.

Email-domain checks use DNS resolution to assess whether the domain can receive email. They do not verify that you control the supplied mailbox. We may also disclose information where required by law or where necessary to establish, exercise or defend legal claims.

Hosting and International Processing

The public website uses Azure Static Web Apps in West Europe, with globally distributed content. The application backend and booking storage are deployed in UK South. Email, calendar information and approval messages use Microsoft 365. These locations do not mean that every processing activity, support interaction or network connection remains in the UK.

Microsoft describes its data-protection commitments and international-transfer safeguards in the Microsoft Products and Services Data Protection Addendum and applicable service terms. Those commitments include contractual safeguards for relevant transfers, including Standard Contractual Clauses. Contact us for information about the safeguards relevant to your information and how to obtain a copy.

Retention and Deletion

Consultation records are normally eligible for deletion 365 days after the end of the requested slot. A daily retention process removes eligible records and reports requests that have become stuck or were never settled. A 48-hour provisional hold controls availability; it is not a promise to delete the request after 48 hours.

Before deleting consultation records, the service creates a recovery snapshot. Snapshots become eligible for automated deletion after 30 days. Azure processes lifecycle rules asynchronously, so deletion is not guaranteed at the exact 30-day boundary. After deletion, blobs and containers may remain recoverable for a further seven days under the configured soft-delete settings.

Security counters and single-use form-token records are removed by the daily cleanup after their enforcement windows have expired. A record that becomes active again during cleanup is preserved.

Approval queue messages are removed after a terminal processing result. Messages whose processing has not completed are retained for recovery and operational review rather than silently discarding an unresolved request. Their continued need is reviewed as part of resolving the failed request.

The application telemetry workspace has a 30-day default retention setting. Email, calendar entries, Teams approval messages and service-generated records have separate service retention arrangements. We retain business correspondence while needed to handle the enquiry, manage any resulting engagement or meet justified legal and record-keeping requirements, and review these copies for removal when that need ends. The booking-table deletion period does not automatically delete those separate copies.

Cookies and Similar Technologies

The website code does not add advertising trackers, analytics cookies or browser local-storage records. Fonts are served from the website's own hosting rather than Google Fonts. Short-lived form tokens and request checks help protect the enquiry service.

Separate Microsoft sign-in and Teams services have their own browser and service behaviour. We will update this notice if the website introduces tracking or other browser-storage features.

When a Cloudflare Turnstile human-verification widget is enabled and displayed on this form, Cloudflare processes browser and device signals to help distinguish visitors from automated submissions. Our server sends the resulting challenge token to Cloudflare for verification, not the contents of your enquiry. This verification does not require moving our website traffic through Cloudflare. See the Cloudflare Turnstile Privacy Addendum for its processing information.

Automated Checks and Human Review

Automated checks validate fields, screen likely automated submissions, limit repeated requests and check calendar availability. They may reject a request or make a slot unavailable. Consultation acceptance requires the organiser's decision. If a check prevents a genuine request, email the enquiry address for human assistance.

Information Rights

Depending on the lawful basis and circumstances, you may request access to your personal information, correction, erasure, restriction of processing or data portability. These rights are subject to applicable conditions and exceptions. Contact the privacy address above to exercise them.

Right to object: where we rely on legitimate interests, you may object to processing on grounds relating to your particular situation.

If we introduce a separate activity that relies on consent, we will explain how to withdraw that consent. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.

Complaints

You can raise a privacy concern with Cole Valley through the contact address above. You also have the right to complain to the UK's Information Commissioner's Office. See ico.org.uk/make-a-complaint.

Required Information and Notice Changes

You choose whether to contact us. The online service needs its required contact details, message and selected slot to process a consultation request. If you cannot provide those details or use the form, contact us by email for assistance. You are not required by law to use this website form.

We will review this notice when our use of personal information changes, including changes to service providers, retention or tracking. The date above identifies the latest published version.