Privacy and cookie policy.
The short version: we collect what you give us, we use it to talk to you, we don’t sell it, and you can make us delete it. The full version — the one that meets our obligations under UK GDPR — is below.
Effective date: 13 July 2026 · Version: 1.0
This policy explains how AddQual Ltd collects, uses, shares and protects personal data when you use this website, contact us, take our Quality Maturity Assessment, or subscribe to our newsletter. It is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
AddQual Ltd ("AddQual", "we", "us") is the data controller for the personal data described in this policy. That means we decide why and how your personal data is processed, and we are accountable for it.
- Company: AddQual Ltd
- Registered in: England & Wales
- Company registration number: 09876459
- VAT registration number: GB 234 449 994
- Registered address: Charlotte House, Stanier Way, The Wyvern Business Park, Derby, England, DE21 6BF
- Data protection contact: privacy@addqual.com
- General contact: sales@addqual.com · +44 1332 480109
We are not required to appoint a Data Protection Officer and have not appointed one. Responsibility for data protection sits with the Managing Director.
2. What we collect, why, and on what lawful basis
We only collect personal data you actively give us. We don’t buy contact lists, and we don’t scrape or enrich your details from third-party sources.
2.1 When you contact us
Data: name, work email, company, job title, audience type (if you tell us), and the content of your message.
Purpose: to respond to your enquiry, have a conversation, and — if it goes somewhere — manage the resulting business relationship.
Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)) — responding to a business enquiry you initiated. We have assessed that you would reasonably expect this and that it does not override your rights. Where you have separately consented (for example to marketing), that consent is the basis for that specific use.
2.2 When you take the Quality Maturity Assessment
Important: your assessment answers are scored entirely inside your own browser. They are not transmitted to us unless you choose, at the end, to request the emailed breakdown.
If you request the breakdown, we receive: your name, work email, company, job title, your overall score, your maturity band, the role you selected, your scores across the five dimensions, and your two largest identified gaps.
Purpose: to send you the report you asked for, and to tailor any subsequent conversation to your role and your actual situation rather than a generic pitch.
Lawful basis: Consent (Article 6(1)(a)) for sending the report, and legitimate interests (Article 6(1)(f)) for following up on a request you made. You can withdraw consent at any time.
2.3 When you subscribe to the newsletter
Data: your email address.
Purpose: to send you our newsletter — roughly one email a month.
Lawful basis: Consent (Article 6(1)(a)), collected on a double opt-in basis: you must confirm via a link we email you before we send anything else. Every newsletter has a one-click unsubscribe. We honour it immediately and we don’t email you to ask why.
2.4 When you use the website
Data: if — and only if — you accept analytics cookies, we collect pages visited, approximate location (country/region level), device and browser type, referring source, and interactions such as starting or completing the assessment.
Purpose: to understand which pages are useful and improve the site.
Lawful basis: Consent (Article 6(1)(a) and PECR Regulation 6). If you choose "Essential only", no analytics load at all — the scripts are never executed, not merely anonymised.
Our web host also processes server logs (including IP addresses) for security and to keep the site running. Lawful basis: legitimate interests — network security and fraud prevention.
3. Cookies and similar technologies
3.1 Strictly necessary (no consent required)
| Name | Purpose | Duration |
|---|---|---|
aq_cookie_consent | Remembers your cookie choice so we stop asking. Stored in your browser’s local storage. Does not track you. | Until you clear it |
3.2 Third-party embeds (loaded only when you ask)
Our booking calendar is provided by Calendly. It is not loaded when a page opens. It loads only if you press “Load the booking calendar” on the contact page or at the end of the assessment — at which point your IP address is shared with Calendly and Calendly may set its own cookies. If you never press it, nothing is shared.
3.3 Analytics (optional — only set if you accept)
What is running today: as at 19 September 2026 no analytics of any kind are installed on this site, and there is no newsletter sign-up form. The table below describes what we would use if and when analytics are added, and they will load only after you accept.
| Provider | Purpose | Duration |
|---|---|---|
| Google Analytics (GA4) | Page views, traffic sources and conversion events, so we can tell what’s working. | Up to 24 months |
| Plausible Analytics | Privacy-focused, cookieless traffic measurement. | No cookie set |
| HubSpot | Associates a website visit with an enquiry you submit, so we know what you looked at before getting in touch. | Up to 13 months |
3.4 Changing your mind
You can withdraw consent as easily as you gave it. Use the button below to reopen the cookie banner and change your choice.
4. Who we share your data with
We don’t sell your personal data. We don’t share it with advertisers or data brokers. Ever.
We share it only with service providers who process it on our behalf, under contract, on our written instructions, and who may not use it for their own purposes:
| Processor | What they do for us | Where |
|---|---|---|
| HubSpot, Inc. | Customer relationship management, forms, email | EU / US |
| Google (GA4) | Website analytics (only with your consent) | EU / US |
| Plausible Analytics | Privacy-focused analytics | EU |
| Cloudflare, Inc. | Website hosting, DNS and security | Global edge network |
| Microsoft Corporation | Email and business productivity | EU / UK |
We may also disclose personal data where legally required — to a regulator, a court, or in connection with our NADCAP or AS9100 accreditation obligations — or where necessary to establish, exercise or defend legal claims.
5. International transfers
Some processors are based in, or transfer data to, the United States. Where personal data leaves the UK, we ensure an appropriate safeguard is in place under Article 46 UK GDPR — normally the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it.
You can request a copy of the relevant safeguard by emailing privacy@addqual.com.
6. How long we keep it
| Data | Retention period |
|---|---|
| Enquiry and assessment data (where you don’t become a customer) | 24 months from your last contact, then deleted |
| Customer records | Duration of the relationship, plus 6 years (statutory, tax, contractual and accreditation obligations) |
| Newsletter subscription | Until you unsubscribe, then a suppression record so we don’t email you again by accident |
| Analytics data | Up to 24 months |
| Server / security logs | Up to 12 months |
7. Your rights
Under UK GDPR you have the following rights. All are free to exercise, and we’ll respond within one calendar month.
- Access — ask for a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data, where we have no overriding obligation to keep it.
- Restriction — ask us to pause processing while a concern is investigated.
- Portability — receive the data you gave us in a structured, machine-readable format.
- Object — object to processing based on legitimate interests. You can object to direct marketing at any time, and we must stop immediately — no questions, no exceptions.
- Withdraw consent — at any time, where we rely on consent. This doesn’t affect the lawfulness of what we did before you withdrew it.
- Complain — to the supervisory authority (section 10).
To exercise any of these, email privacy@addqual.com. We may ask you to verify your identity first — that’s to protect you, not to obstruct you.
8. Automated decision-making and profiling
The Quality Maturity Assessment produces a score and a maturity band from the answers you give. This is not automated decision-making with legal or similarly significant effects under Article 22 UK GDPR: it produces information for you, it doesn’t decide anything about you, and no decision affecting you is made on the basis of it without a human being involved.
We don’t carry out any other profiling.
9. Security
We apply appropriate technical and organisational measures, including encryption in transit (HTTPS/TLS enforced site-wide), least-privilege access controls, and processor agreements with everyone who handles data on our behalf.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we’ll notify the ICO within 72 hours, and tell you directly where the risk is high.
10. Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us first — privacy@addqual.com — and we’ll try to put it right.
You also have the right to complain directly to the UK supervisory authority at any time:
- Information Commissioner’s Office (ICO)
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline: 0303 123 1113
- ico.org.uk/make-a-complaint
11. Children
This website is aimed at business users. We don’t knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we’ll delete it.
12. Third-party links
This site links to third-party sites (LinkedIn, for example). We’re not responsible for their privacy practices. Read their policies before giving them your data.
13. Changes to this policy
If we make material changes we’ll update the version number and effective date at the top of this page, and — where the change materially affects data you’ve already given us — tell you directly.