This policy explains how LimestoneGrey Limited handles personal data when you visit limestonegrey.com or get in touch with us through the site. It covers what we collect, why we hold it, who we share it with, and the rights you have under UK data protection law. It sits alongside our cookie policy and our AI policy.
It applies to visitors to this website and to people who make an enquiry. If you go on to become a client, the way we handle your information as a client is set out in a fuller privacy notice within your engagement documents, and that notice governs the work we do for you.
Who we are
LimestoneGrey Limited is the data controller for personal data processed through this website. We are a company registered in England and Wales (company number 10714268), with our registered office at 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA293972.
We have not appointed a separate data protection officer, as we are not required to. Responsibility for data protection sits with the firm, and you can reach us on any data protection matter at privacy@limestonegrey.com.
The data we collect
There are two kinds, depending on how you use the site.
Information you give us. When you complete the contact form or email us, we collect the details you choose to provide — typically your name, email address, telephone number, company name and the content of your message. We ask only for what we need to answer your enquiry.
When you send us a message through the contact form, it also carries a short record of that visit. That record covers the pages you looked at and how long after arriving you reached each one, the page you arrived on, the site that referred you where your browser provides it, and how long the visit lasted. If you used one of our tools during the visit, it names the tool you completed, and where you used the eligibility checker it also carries the verdict the checker gave you — the verdict itself, never the figures you entered. We use it to understand which pages lead people to get in touch. Nothing is stored on your device, nothing is sent unless you submit the form, and none of it is used to recognise you on any other website or on a later visit. It does, though, arrive as part of the enquiry you chose to send, so it is linked to that enquiry and to you.
Information collected automatically. When you visit the site, limited technical data is processed to serve the pages, keep the site secure and understand in aggregate how it is used. This includes your IP address, used transiently for security and bot protection rather than stored to profile you, and privacy-friendly analytics that set no cookies and do not track you across other websites. Our cookie policy sets out the detail.
We also keep anonymous, aggregate counts of a few actions on the site, so we can see which of our tools people find useful — completing one of the calculators, or reaching a verdict in the eligibility checker. What is counted is the type of action, the page it happened on and a short label such as the verdict reached. No identifier is attached to a count, nothing is stored on your device, and there is no way to trace a count back to a person, to a visit or to any of the figures you entered. These counts are a separate thing from the visit record described above, and the two work differently: a count is never linked to anyone, while the record that travels with a contact-form message is part of the enquiry you chose to send and is linked to it. You can switch the counting off at any time with the Site measurement switch described in our cookie policy.
We do not collect special category data — such as information about your health, ethnicity, religious beliefs or political opinions — through this website, and the site is not intended for children.
How and why we use your data
We use the personal data described above for a small number of clearly defined purposes, each with a lawful basis under UK data protection law:
- To respond to your enquiry and to hold the conversations that follow from it. Our lawful basis is our legitimate interest in answering people who contact us and pursuing potential client relationships.
- To run, secure and improve the website, including protecting the contact form from automated abuse and understanding in aggregate how the site is used. Our lawful basis is our legitimate interest in operating a safe, working website.
- To meet our legal and regulatory obligations, where the law requires us to keep or disclose certain information. Our lawful basis is compliance with a legal obligation.
We do not rely on consent for the processing described above, except where our cookie policy says otherwise. As a visitor or enquirer you are not entering into a contract with us, so we do not process your information on that basis; if your enquiry leads to an engagement, the position is governed by your engagement documents.
Who we share it with
We do not sell your personal data, and we do not share it for anyone else’s marketing.
To run the website and handle enquiries, we rely on a small number of service providers who act as our processors, handling data only on our instructions:
- Cloudflare hosts the website, runs the secure process that receives and passes on contact-form submissions, provides the bot protection on the form, and provides our cookieless analytics.
- Resend delivers contact-form submissions to us by email.
- Enquiries then arrive in our Microsoft 365 inbox, where we read and reply to them.
Handling an enquiry may also involve AI tools, in the categories set out in our AI policy: drafting, research and production support. We describe these as categories of tool rather than naming particular products, because the specific software changes as better tools appear. Whichever tool is in use, it is engaged on terms that require it to protect your information and that prevent your data being used to train the provider’s models.
We may also disclose personal data where we are required to by law or by our regulator, or where it is necessary to establish, exercise or defend legal claims. Each provider is engaged under terms that require it to protect your data and to use it only for the purpose we have set.
International transfers
Cloudflare, Resend and Microsoft are headquartered in the United States, so some of the data they process for us may be handled outside the United Kingdom. Where personal data is transferred outside the UK, we make sure that one or more of the following safeguards is in place:
- the recipient country is covered by an adequacy regulation made under the UK GDPR;
- the transfer is made under the UK International Data Transfer Agreement, or under the UK Addendum to the European Commission Standard Contractual Clauses; or
- another safeguard recognised under the UK GDPR applies.
The mechanism we rely on for these three providers is the second of those: the UK Addendum to the EU Standard Contractual Clauses, incorporated in the data processing agreement we hold with each of them. If you would like a copy of the transfer terms that apply to your data, email privacy@limestonegrey.com and we will send them to you.
How we use AI
We use AI tools in the ordinary course of running our practice. Where AI is involved in handling information from the website or from your enquiry, that information is processed under our usual confidentiality and security controls, and it is not used to train any third-party AI model: the tools we use are engaged on terms that prevent it. Every output we rely on is the product of professional judgement by a Chartered Tax Adviser, and no decision affecting you is made solely by automated means. You can ask us to limit our use of AI in handling your information. Our AI policy explains all of this in full.
How long we keep it
We keep enquiry and contact-form correspondence for up to 24 months, so we can pick up conversations where they left off and keep a record of what was discussed. If your enquiry becomes a client engagement, your information is then kept under our standard client-file retention period of six years from the end of the accounting period to which it relates. Technical data is different, and so are the counts. The technical data Cloudflare processes to serve and secure the site, including the IP address your request arrives with, is held by Cloudflare for a short period under its own retention terms and then deleted; we do not keep a copy. The anonymous counts described above are kept as daily totals for as long as we run the site, so that we can compare one period with another. A total is a number with no identifier attached to it, so there is nothing in it that relates to you.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct information that is inaccurate or incomplete;
- ask us to erase your data, or to restrict or object to how we use it, in the circumstances the law allows;
- ask us to transfer certain data to you or to another provider; and
- object to processing we carry out on the basis of our legitimate interests.
To exercise any of these, email privacy@limestonegrey.com. We aim to respond within one month, and there is normally no charge.
If you are unhappy with how we have handled your data, you have the right to complain to us directly, and we would like the chance to put it right: email privacy@limestonegrey.com and we will acknowledge your complaint within 5 working days. That right sits alongside your right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, which you can exercise whether or not you have raised the matter with us first.
Cookies
The site keeps its use of cookies and similar technologies to a minimum, and sets non-essential cookies only with your consent. Our cookie policy explains what we use and how to change your choices.
Changes to this policy
We keep this policy under review and may update it as the website or the law changes. We last reviewed it in September 2026.
Contact us
For any question about this policy or about how we handle your personal data, email privacy@limestonegrey.com. For anything else, contact hello@limestonegrey.com or call 0330 223 4 223. You can write to us at LimestoneGrey Limited, 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ.