This Privacy Policy explains how Mitromo ("we", "us", "our") collects, uses, stores, and protects personal data when you interact with our website at Mitromo.com or engage with our services. We are committed to handling personal data responsibly and in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data Controller
Mitromo operates as the data controller for all personal data processed in connection with this website and our consulting services. Our registered address is 11 Stratford Road, London W8 6RF, United Kingdom. You can contact us regarding data protection matters at [email protected] or by telephone on +44 20 7937 3586.
We are registered with the Information Commissioner's Office (ICO) as required under the Data Protection Act 2018. Our processing activities are conducted in accordance with the six lawful bases set out in Article 6 of the UK GDPR.
2. Data We Collect
We collect personal data through the following channels and in the following categories:
Contact and enquiry data: When you submit an enquiry via our contact form, we collect your name, email address, telephone number, and the content of your message. This data is provided directly by you.
Website usage data: When you visit Mitromo.com, our web hosting infrastructure may automatically record technical information including your IP address, browser type and version, pages visited, time and date of access, and referring URL. This data is collected for security and performance purposes.
Cookie data: We use cookies to remember your preferences, including your cookie consent choice. Details of the specific cookies we use are set out in our Cookie Policy.
Engagement data: If you become a client, we collect business and financial information necessary to conduct the operational spending analysis. This is governed separately by our engagement letter and non-disclosure agreement.
We do not collect special category data (as defined under Article 9 of the UK GDPR) through this website.
3. Legal Basis for Processing
We process personal data on the following legal bases under Article 6 of the UK GDPR:
Legitimate interests (Article 6(1)(f)): We process website usage data and enquiry data to respond to your communication and to operate our business. We have conducted a legitimate interests assessment and determined that our interests in responding to enquiries and maintaining website security do not override your fundamental rights and freedoms.
Consent (Article 6(1)(a)): Where you have provided explicit consent — for example, by ticking the privacy checkbox on our contact form or accepting non-essential cookies — we process data on the basis of that consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Contract performance (Article 6(1)(b)): Where you enter into an engagement with Mitromo, we process data necessary to fulfil our contractual obligations.
Legal obligation (Article 6(1)(c)): We may process data where required by applicable law, including tax and accounting obligations under UK legislation.
4. How We Use Your Data
Personal data collected through this website is used for the following purposes:
Responding to enquiries submitted via the contact form. Processing and managing client engagements where a consulting relationship is established. Maintaining the security and performance of our website. Complying with legal and regulatory obligations applicable to our business in the United Kingdom.
We do not use personal data collected through this website for automated decision-making or profiling as defined under Article 22 of the UK GDPR. We do not use your data for direct marketing without your explicit consent.
5. Retention Periods
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law.
Enquiry data submitted through the contact form is retained for a period of twelve months from the date of submission, after which it is securely deleted unless an engagement has been established. In that case, engagement-related data is retained for six years from the end of the engagement in accordance with HMRC record-keeping requirements under the Taxes Management Act 1970.
Website usage logs are retained for up to ninety days for security monitoring purposes. Cookie preference data is retained for the duration specified in our Cookie Policy.
6. Data Sharing and Disclosure
We do not sell, rent, or trade personal data. We share personal data only in the following limited circumstances:
Service providers: We may share data with carefully selected third-party service providers who assist us in operating our website and business, including web hosting providers and email service providers. All such providers are required to process data only on our instructions and in accordance with a data processing agreement.
Legal requirements: We may disclose personal data where required by law, court order, or regulatory authority, including the Information Commissioner's Office or other competent authorities in the United Kingdom.
Business transfers: In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the relevant third party, subject to appropriate safeguards and notification to affected individuals where required.
7. International Data Transfers
Where we use service providers that process data outside the United Kingdom or the European Economic Area, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR. These safeguards may include the UK's International Data Transfer Agreement (IDTA), adequacy decisions made by the Secretary of State, or Standard Contractual Clauses approved for use under UK data protection law.
We will not transfer your personal data to countries or territories outside the UK without ensuring an adequate level of protection is in place.
8. Your Rights Under UK GDPR
As a data subject under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
Right of access (Article 15): You may request a copy of the personal data we hold about you, along with information about how it is processed.
Right to rectification (Article 16): You may request correction of inaccurate or incomplete personal data.
Right to erasure (Article 17): You may request deletion of your personal data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected.
Right to restriction (Article 18): You may request that we restrict processing of your personal data in certain circumstances.
Right to data portability (Article 20): Where processing is based on consent or contract, you may request a copy of your data in a structured, commonly used, machine-readable format.
Right to object (Article 21): You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month of receiving your request, as required under Article 12 of the UK GDPR. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data in accordance with applicable law.
9. Security Measures
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, in accordance with Article 32 of the UK GDPR. These measures include encrypted data transmission via HTTPS, access controls limiting data access to authorised personnel, and regular review of our security practices.
No transmission of data over the internet can be guaranteed as completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security of data transmitted to our website.
10. Cookies
Our website uses cookies to function correctly and to remember your preferences. A full explanation of the cookies we use, their purpose, and how to manage them is provided in our Cookie Policy. By using our website, you acknowledge that cookies may be placed on your device in accordance with your consent choices.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this document. We encourage you to review this policy periodically.
Continued use of our website following any update constitutes acknowledgement of the revised policy. Where changes are significant and affect your rights, we will take reasonable steps to notify you directly.
12. Contact Us
If you have questions about this Privacy Policy, wish to exercise your data subject rights, or have a concern about how we handle your personal data, please contact us:
By email: [email protected]
By telephone: +44 20 7937 3586
By post: Mitromo, 11 Stratford Road, London
W8 6RF, United Kingdom
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO). The ICO can be contacted at ico.org.uk or by calling 0303 123 1113.