Privacy notice
Effective date: 24 October 2026
Grasten Advisory takes the privacy of the people we work with seriously. This notice explains what personal data we collect through this website and in the course of our work, why we collect it, how long we keep it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Grasten Advisory is an independent data and AI governance consultancy based in the United Kingdom. Grasten Advisory is the trading name of Stephen Appiah-Kubi, a sole trader, who is the controller of the personal data described in this notice. In this notice, “we”, “us” and “our” mean Grasten Advisory.
For any question about this notice or your personal data, contact us at step.appiah@grastenadvisory.co.uk.
2. The information we collect
Information you give us. When you book a call, send an enquiry or become a client, we collect:
- your name, job title or role, and the organisation you work for;
- your work email address and organisation size;
- your preferred call date and time;
- anything you choose to include in your message; and
- for clients, the contact, contract and billing details needed to deliver our services.
Information collected automatically. When you visit this website, our hosting provider processes technical data such as your IP address, browser type and the pages requested. This is used to deliver the website securely and to protect it against abuse. We do not use analytics or advertising tools to track you.
We do not ask for, and ask you not to send us, special category data such as health information.
3. How we use your information
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry and arranging the call you asked for | Steps taken at your request before entering into a contract; and our legitimate interest in responding to business enquiries |
| Delivering our services, managing the engagement and invoicing | Performance of a contract |
| Keeping financial and accounting records | Legal obligation |
| Following up after a call about relevant services | Legitimate interests. You can opt out at any time. |
| Operating and securing this website | Legitimate interests |
We do not sell your personal data, and we do not make decisions about you using solely automated means.
4. Who we share it with
We share personal data only with trusted service providers who process it on our behalf and under contract:
- Cloudflare: website hosting, security and email forwarding;
- Google: email inbox (Gmail) and website fonts;
- Brevo: sending our outgoing business email;
- FormSubmit: delivery of booking form submissions to our inbox.
We may also share information with our professional advisers, such as accountants, or where required by law.
5. International transfers
Some of our service providers process data outside the United Kingdom, including in the European Union and the United States. Where this happens, the transfer is protected by appropriate safeguards recognised under UK law, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Addendum.
6. How long we keep it
- Enquiries that do not lead to an engagement: deleted within 12 months of our last contact.
- Client records: kept for 6 years after the engagement ends, to meet accounting and tax requirements.
- Website technical logs: kept by our hosting provider for a short period in line with its own retention policies.
7. How we protect it
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access-controlled accounts with multi-factor authentication, and limiting access to those who need it.
8. Your rights
Under UK data protection law you have the right to:
- access a copy of the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to processing based on our legitimate interests, including follow-up contact; and
- receive your data in a portable format.
To exercise any of these rights, email step.appiah@grastenadvisory.co.uk. We will respond within one month. There is normally no charge.
9. Complaints
If you have a concern about how we handle your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Cookies
This website does not use advertising, analytics or tracking cookies. Our hosting provider may set strictly necessary cookies to protect the website from bots and abuse. These do not identify you and do not require your consent.
11. Changes to this notice
We may update this notice from time to time. The effective date at the top shows when it was last changed.