Privacy Policy

Who we are

Janus Compliance Limited (company number 16583861) is the controller of the personal data described in this policy. We are an AI governance consultancy, and we build AI systems and provide data protection advisory services for businesses in Ireland, the United Kingdom and Nigeria.

Contact: If you have questions about this policy or your data, contact us through our contact form.

What data we collect

We collect the following personal data:

• Contact form submissions: Your name, email address, company name, role, service interest, timeline, and any additional information you provide in your message. Collected via Formspree.
• Breach assessment tool: If you choose to receive follow-up guidance, we collect your email address and assessment results. Collected via Formspree.
• Analytics data (consent-based): If you accept analytics cookies, we collect anonymous usage data including pages visited, time on site, device type, and approximate location. Collected via Google Analytics 4.
• Analytics data (cookie-free): We collect anonymous page view and visitor count data without cookies or personal identifiers. Collected via Vercel Web Analytics.
• Cookies: See our Cookie Policy for details.

We do not ask for sensitive personal data. If correspondence sent to us contains it, we handle it as described in When we act as an organisation's representative. We do not buy or sell personal data.

Why we collect it (legal basis)

Under GDPR Article 6, we process your data on the following bases:

• Consent: for analytics cookies (you can opt out at any time).
• Legitimate interest: for contact form data, to respond to your enquiry and provide you with relevant information about our services.
• Contract performance: if you become a client, to deliver the services you've engaged us for.

How we use your data

• To respond to your enquiry within 48 hours
• To provide a quote for services you've requested
• To deliver contracted services
• To improve our website and understand how visitors use it
• To comply with legal obligations

We will never use your data for automated decision-making or profiling.

Who we share it with

We share your data only with the following service providers:

• Formspree: processes contact form submissions. Data stored in the US under Standard Contractual Clauses.
• Google Analytics: processes anonymised usage data (consent-based only). Google LLC, US, which is certified under the EU-US Data Privacy Framework and its UK Extension, with Standard Contractual Clauses as the fallback.
• Vercel: hosts our website and provides cookie-free web analytics. Vercel Inc, US, under Standard Contractual Clauses.
• Google Workspace: hosts our email, so messages you send us, including contact form submissions forwarded by Formspree, are stored with Google.
• Anthropic: provides the AI assistant we use to help us read enquiries and correspondence and prepare replies. Anthropic is based in the United States, and information we process with its service is transferred there.

We do not share your data with any other third parties, advertisers, or data brokers.

International transfers

Some of the organisations listed above are based in the United States. For Formspree, Google Analytics and Vercel, the transfer is covered by the Standard Contractual Clauses approved by the European Commission with, for UK data, the UK Addendum, or by the recipient's certification under the EU-US Data Privacy Framework and its UK Extension. Personal data processed with Google Workspace and with Anthropic's service may also be transferred to the United States.

How long we keep it

• Contact form data: 2 years from last contact, then deleted.
• Client project data: 6 years after project completion (legal requirement).
• Analytics data: 14 months (Google Analytics default retention).

Your rights

Under GDPR and the UK Data Protection Act 2018, you have the right to:

• Access: request a copy of the data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: ask us to delete your data
• Restriction: ask us to limit how we use your data
• Portability: receive your data in a structured, machine-readable format
• Object: object to processing based on legitimate interest
• Withdraw consent: for any processing based on consent

To exercise any of these rights, contact us via our contact form. We will respond within one month of receiving your request.

Complaints

If you are not satisfied with how we handle your personal data, you have the right to complain to us under section 164A of the Data Protection Act 2018. You can do this through our contact form. We will acknowledge your complaint within 30 days of receiving it and respond to it without undue delay.

You also have the right to complain to the UK regulator, the Information Commission, which replaced the Information Commissioner on 30 September 2026, at ico.org.uk. If you are in the European Economic Area, you can complain to the data protection authority in the country where you live or work.

When we act as an organisation's representative

Some organisations based outside the United Kingdom appoint Janus Compliance Limited as their representative under Article 27 of the UK GDPR. Their privacy notices give our address so that individuals and the Information Commission can write to us about how the organisation handles personal data. In that role we hold three kinds of personal data: correspondence, the contact details of our clients' staff and each client's record of processing.

Correspondence about an organisation we represent

When you write to us about an organisation we represent, we forward your letter or email to that organisation within one working day of receiving it. For post, the working day runs from when the scanned copy reaches us. We forward it in full, with your name, your contact details and any documents you enclosed. Post sent to our correspondence address in London is opened and scanned there, and it reaches us as a scanned copy. We forward correspondence because it is addressed to the organisation, relying on our legitimate interest, and the organisation's, in correspondence reaching the organisation it concerns. If a letter contains information about someone other than the writer, we handle it in the same way.

The organisation remains responsible for answering you and for how it uses your information, and its own privacy notice explains that. We reply on its behalf only where it has instructed us to.

We keep a copy of your correspondence, with a record of the date we received it and the date we forwarded it. We keep them because we have a legitimate interest in being able to show that we carried out our role, and we hold them for as long as we represent the organisation and for six years afterwards. Correspondence sometimes contains special category data, such as information about a person's health. We keep our copy of that information for the same period under Article 9(2)(f) of the UK GDPR, because it is necessary for establishing, exercising or defending legal claims about how we carried out our role.

Our clients' staff

Each client names the people we should deal with. We hold their names, job titles, email addresses and telephone numbers, and we use them to forward correspondence, send invoices and renewal notices and manage the appointment. Where the client is an individual, we use these details to perform our contract with that person. In every other case we rely on our legitimate interest in communicating with a client through the people it has named. We keep the details for as long as we represent the client and for six years afterwards.

The record of processing

Where an organisation must keep a record of its processing activities, Article 30 of the UK GDPR also requires its representative to maintain one, and each client supplies us with that record. It normally includes the names and contact details of people at the client, such as its data protection officer. We hold the record on the organisation's instructions and because Article 30(1) requires us to, and we use it for no other purpose. We return or delete it within 60 days of the appointment ending, except for anything we need to keep as evidence that we met our own obligations, which we keep for six years after the appointment ends.

Who receives this information

• The organisation we represent receives the correspondence addressed to it.
• The Information Commission receives the record of processing if it asks for it, and any other information we are required to give when it asks for our cooperation.
• Google, which hosts our email (Google Workspace).
• Anthropic, which provides the AI assistant we use to help us read correspondence, prepare replies and keep our records. Anthropic is based in the United States, and information we process with its service is transferred there.

Your rights

You can exercise the rights described above against us for the information this section describes. If your request concerns how the organisation itself uses your information, we forward it to the organisation.

Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We will not reduce your rights under this policy without your explicit consent.