Privacy and cookie policy.
The short version: we collect what you give us, we use it to talk to you, we don’t sell it, and you can make us delete it. The full version, the one that meets our obligations under UK GDPR, is below.
Effective date: 10 October 2026 · Version: 1.2
This policy explains how AddQual Ltd collects, uses, shares and protects personal data when you use this website, contact us, take our Quality Maturity Assessment, or subscribe to our newsletter. It is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
1. Who we are
AddQual Ltd ("AddQual", "we", "us") is the data controller for the personal data described in this policy. That means we decide why and how your personal data is processed, and we are accountable for it.
- Company: AddQual Ltd
- Registered in: England & Wales
- Company registration number: 09876459
- VAT registration number: GB 234 449 994
- Registered address: Charlotte House, Stanier Way, The Wyvern Business Park, Derby, England, DE21 6BF
- Data protection contact: privacy@addqual.com
- General contact: sales@addqual.com · +44 1332 480109
We are not required to appoint a Data Protection Officer and have not appointed one. Responsibility for data protection sits with the Managing Director.
2. What we collect, why, and on what lawful basis
We only collect personal data you actively give us. We don’t buy contact lists, and we don’t scrape or enrich your details from third-party sources.
2.1 When you contact us
Data: name, work email, company, job title, audience type (if you tell us), and the content of your message.
Purpose: to respond to your enquiry, have a conversation and, if it goes somewhere, manage the resulting business relationship.
Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)): responding to a business enquiry you initiated. We have assessed that you would reasonably expect this and that it does not override your rights. Where you have separately consented (for example to marketing), that consent is the basis for that specific use.
2.2 When you take the Quality Maturity Assessment
Important: your assessment answers are scored entirely inside your own browser. They are not transmitted to us unless you choose, at the end, to request the emailed breakdown.
If you request the breakdown, we receive: your name, work email, company, job title, your overall score, your maturity band, the role you selected, your scores across the five dimensions, and your two largest identified gaps.
Purpose: to send you the report you asked for, and to tailor any subsequent conversation to your role and your actual situation rather than a generic pitch.
Lawful basis: Consent (Article 6(1)(a)) for sending the report, and legitimate interests (Article 6(1)(f)) for following up on a request you made. You can withdraw consent at any time.
2.3 When you subscribe to the newsletter
How you subscribe: by ticking the optional newsletter box on our contact form or at the end of the Quality Maturity Assessment. The box is never ticked for you.
Data: your email address.
Purpose: to send you our newsletter, roughly one email a month.
Lawful basis: Consent (Article 6(1)(a)), collected on a double opt-in basis: you must confirm via a link we email you before we send anything else. Every newsletter has a one-click unsubscribe. We honour it immediately and we don’t email you to ask why.
2.4 When you use the website
Data: if, and only if, you accept analytics cookies, HubSpot’s tracking code records pages visited, approximate location (country/region level), device and browser type, referring source, and interactions such as the buttons, menu items, links and tabs you click, and starting or completing the assessment. It never records what you type into a form, or your answers to the assessment. If you then send us an enquiry, that visit history is linked to it.
Purpose: to understand which pages are useful and improve the site and, when you contact us, to see what you read first so we can reply to the point.
Lawful basis: Consent (Article 6(1)(a) and PECR Regulation 6). If you choose "Essential only", HubSpot’s analytics never load. The scripts are never executed, not merely anonymised.
Cookieless visitor counts: our host, Cloudflare, also counts page views and measures how quickly our pages load (Cloudflare Web Analytics). It sets no cookies, stores nothing on your device and does not identify you or follow you across sites. We see totals only, such as page views, countries, referring sites and load times, never an individual visitor. Because nothing is stored on your device, it is not part of the cookie choice above. Lawful basis: legitimate interests: knowing which pages are used and keeping the site fast.
Our web host also processes server logs (including IP addresses) for security and to keep the site running. Lawful basis: legitimate interests: network security and fraud prevention.
3. Cookies and similar technologies
3.1 Strictly necessary (no consent required)
| Name | Purpose | Duration |
|---|---|---|
aq_cookie_consent | Remembers your cookie choice so we stop asking. Stored in your browser’s local storage. Does not track you. | Until you clear it |
3.2 Third-party embeds (loaded only when you ask)
Our booking calendar is provided by Calendly. It is not loaded when a page opens. It loads only if you press “Load the booking calendar” on the contact page or at the end of the assessment, at which point your IP address is shared with Calendly and Calendly may set its own cookies. If you never press it, nothing is shared.
3.3 Analytics (optional, only set if you accept)
What is running today: HubSpot’s tracking code, and only after you press “Accept analytics”. It records the pages you visit and the buttons and links you click, never what you type. If you choose “Essential only”, it never loads and none of the cookies below are set. We do not use Google Analytics or Plausible at present; if we add either, we will list it here first and it will load only after you accept. Cloudflare Web Analytics (section 2.4) sets no cookies, so it does not appear in this table. The only way to join our newsletter is the optional tick box described in section 2.3.
| Name | Purpose | Duration |
|---|---|---|
__hstc | HubSpot’s main analytics cookie: when you first and last visited, and how many visits. | 6 months |
hubspotutk | An anonymous visitor ID. If you send us an enquiry, it links your earlier visits to it. | 6 months |
__hssc | Counts the pages in your current visit. | 30 minutes |
__hssrc | Tells HubSpot whether you have restarted your browser. | End of session |
__cf_bm, __cfruid, __cfuvid | Set by HubSpot’s network provider (Cloudflare) to block bots and limit abuse. Set only when HubSpot loads. | 30 minutes, or end of session |
HubSpot also keeps a short queue of page events in your browser’s storage (__hmpl, hublytics_events_53) until they are sent. HubSpot’s own cookie banner is switched off; ours is the only one you will see, and we pass your answer to HubSpot (analytics yes, advertising and functionality no).
3.4 Changing your mind
You can withdraw consent as easily as you gave it. Use the button below to reopen the cookie banner and change your choice. If you change to “Essential only”, we delete HubSpot’s cookies from your browser and the page reloads without them.
4. Who we share your data with
We don’t sell your personal data. We don’t share it with advertisers or data brokers. Ever.
We share it only with service providers who process it on our behalf, under contract, on our written instructions, and who may not use it for their own purposes:
| Processor | What they do for us | Where |
|---|---|---|
| HubSpot, Inc. | Customer relationship management, forms, email, and website analytics (only with your consent) | EU / US |
| Google (GA4) | Website analytics. Not in use at present | EU / US |
| Plausible Analytics | Privacy-focused analytics. Not in use at present | EU |
| Cloudflare, Inc. | Website hosting, DNS and security, and cookieless visitor counts and page-speed figures (Cloudflare Web Analytics) | Global edge network |
| Microsoft Corporation | Email and business productivity | EU / UK |
We may also disclose personal data where legally required (to a regulator, a court, or in connection with our NADCAP or AS9100 accreditation obligations) or where necessary to establish, exercise or defend legal claims.
5. International transfers
Some processors are based in, or transfer data to, the United States. Where personal data leaves the UK, we ensure an appropriate safeguard is in place under Article 46 UK GDPR. This is normally the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it.
You can request a copy of the relevant safeguard by emailing privacy@addqual.com.
6. How long we keep it
| Data | Retention period |
|---|---|
| Enquiry and assessment data (where you don’t become a customer) | 24 months from your last contact, then deleted |
| Customer records | Duration of the relationship, plus 6 years (statutory, tax, contractual and accreditation obligations) |
| Newsletter subscription | Until you unsubscribe, then a suppression record so we don’t email you again by accident |
| Analytics data | Up to 24 months |
| Server / security logs | Up to 12 months |
7. Your rights
Under UK GDPR you have the following rights. All are free to exercise, and we’ll respond within one calendar month.
- Access: ask for a copy of the personal data we hold about you.
- Rectification: have inaccurate or incomplete data corrected.
- Erasure: ask us to delete your data, where we have no overriding obligation to keep it.
- Restriction: ask us to pause processing while a concern is investigated.
- Portability: receive the data you gave us in a structured, machine-readable format.
- Object: object to processing based on legitimate interests. You can object to direct marketing at any time, and we must stop immediately. No questions, no exceptions.
- Withdraw consent at any time, where we rely on consent. This doesn’t affect the lawfulness of what we did before you withdrew it.
- Complain to the supervisory authority (section 10).
To exercise any of these, email privacy@addqual.com. We may ask you to verify your identity first. That’s to protect you, not to obstruct you.
8. Automated decision-making and profiling
The Quality Maturity Assessment produces a score and a maturity band from the answers you give. This is not automated decision-making with legal or similarly significant effects under Article 22 UK GDPR: it produces information for you, it doesn’t decide anything about you, and no decision affecting you is made on the basis of it without a human being involved.
We don’t carry out any other profiling.
9. Security
We apply appropriate technical and organisational measures, including encryption in transit (HTTPS/TLS enforced site-wide), least-privilege access controls, and processor agreements with everyone who handles data on our behalf.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we’ll notify the ICO within 72 hours, and tell you directly where the risk is high.
10. Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us first at privacy@addqual.com and we’ll try to put it right.
You also have the right to complain directly to the UK supervisory authority at any time:
- Information Commissioner’s Office (ICO)
- Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Helpline: 0303 123 1113
- ico.org.uk/make-a-complaint
11. Children
This website is aimed at business users. We don’t knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we’ll delete it.
12. Third-party links
This site links to third-party sites (LinkedIn, for example). We’re not responsible for their privacy practices. Read their policies before giving them your data.
13. Changes to this policy
If we make material changes we’ll update the version number and effective date at the top of this page and, where the change materially affects data you’ve already given us, tell you directly.