This policy explains how LimestoneGrey Limited handles personal data when you visit limestonegrey.com or get in touch with us through the site. It covers what we collect, why we hold it, who we share it with, and the rights you have under UK data protection law. It sits alongside our cookie policy and our AI policy.
It applies to visitors to this website and to people who make an enquiry. If you go on to become a client, the way we handle your information as a client is set out in a fuller privacy notice within your engagement documents, and that notice governs the work we do for you.
Who we are
LimestoneGrey Limited is the data controller for personal data processed through this website. We are a company registered in England and Wales (company number 10714268), with our registered office at 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA293972.
We have not appointed a separate data protection officer, as we are not required to. Responsibility for data protection sits with the firm, and you can reach us on any data protection matter at privacy@limestonegrey.com.
The data we collect
There are two kinds, depending on how you use the site.
Information you give us. When you complete the contact form or email us, we collect the details you choose to provide — typically your name, email address, telephone number, company name and the content of your message. We ask only for what we need to answer your enquiry.
Information collected automatically. When you visit the site, limited technical data is processed to serve the pages, keep the site secure and understand in aggregate how it is used. This includes your IP address, used transiently for security and bot protection rather than stored to profile you, and privacy-friendly analytics that set no cookies and do not track you across other websites. Our cookie policy sets out the detail.
We do not collect special category data — such as information about your health, ethnicity, religious beliefs or political opinions — through this website, and the site is not intended for children.
How and why we use your data
We use the personal data described above for a small number of clearly defined purposes, each with a lawful basis under UK data protection law:
- To respond to your enquiry and to hold the conversations that follow from it. Our lawful basis is our legitimate interest in answering people who contact us and pursuing potential client relationships.
- To run, secure and improve the website, including protecting the contact form from automated abuse and understanding in aggregate how the site is used. Our lawful basis is our legitimate interest in operating a safe, working website.
- To meet our legal and regulatory obligations, where the law requires us to keep or disclose certain information. Our lawful basis is compliance with a legal obligation.
We do not rely on consent for the processing described above, except where our cookie policy says otherwise. As a visitor or enquirer you are not entering into a contract with us, so we do not process your information on that basis; if your enquiry leads to an engagement, the position is governed by your engagement documents.
Who we share it with
We do not sell your personal data, and we do not share it for anyone else’s marketing.
To run the website and handle enquiries, we rely on a small number of service providers who act as our processors, handling data only on our instructions:
- Cloudflare hosts the website, runs the secure process that receives and passes on contact-form submissions, provides the bot protection on the form, and provides our cookieless analytics.
- Resend delivers contact-form submissions to us by email.
- Enquiries then arrive in our Microsoft 365 inbox, where we read and reply to them.
We may also disclose personal data where we are required to by law or by our regulator, or where it is necessary to establish, exercise or defend legal claims. Each provider is engaged under terms that require it to protect your data and to use it only for the purpose we have set.
International transfers
Cloudflare and Resend are headquartered in the United States, so some of the data they process for us may be handled outside the United Kingdom. Where personal data is transferred outside the UK, we make sure that one or more of the following safeguards is in place:
- the recipient country is covered by an adequacy regulation made under the UK GDPR;
- the transfer is made under the UK International Data Transfer Agreement, or under the UK Addendum to the European Commission Standard Contractual Clauses; or
- another safeguard recognised under the UK GDPR applies.
How we use AI
We use AI tools in the ordinary course of running our practice. Where AI is involved in handling information from the website or from your enquiry, that information is processed under our usual confidentiality and security controls, and it is not used to train any third-party AI model. Every output we rely on is the product of professional judgement by a Chartered Tax Adviser, and no decision affecting you is made solely by automated means. You can ask us to limit our use of AI in handling your information. Our AI policy explains all of this in full.
How long we keep it
We keep enquiry and contact-form correspondence for up to 24 months, so we can pick up conversations where they left off and keep a record of what was discussed. If your enquiry becomes a client engagement, your information is then kept under our standard client-file retention period of six years from the end of the accounting period to which it relates. Technical and analytics data is retained only briefly and in aggregate form.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct information that is inaccurate or incomplete;
- ask us to erase your data, or to restrict or object to how we use it, in the circumstances the law allows;
- ask us to transfer certain data to you or to another provider; and
- object to processing we carry out on the basis of our legitimate interests.
To exercise any of these, email privacy@limestonegrey.com. We aim to respond within one month, and there is normally no charge.
If you are unhappy with how we have handled your data, we would like the chance to put it right, so please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Cookies
The site keeps its use of cookies and similar technologies to a minimum, and sets non-essential cookies only with your consent. Our cookie policy explains what we use and how to change your choices.
Changes to this policy
We keep this policy under review and may update it as the website or the law changes. We last reviewed it in July 2026.
Contact us
For any question about this policy or about how we handle your personal data, email privacy@limestonegrey.com. For anything else, contact hello@limestonegrey.com or call 0330 223 4 223. You can write to us at LimestoneGrey Limited, 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ.