- PRIVACY POLICY
What we do with your data, and the rights you have over it.
Written in plain English. Compliant with UK GDPR and the Data Protection Act 2018.
- CONTENTS
1. Who we are
Obsessed Ltd is the data controller for this website. We decide what data to collect from you, why, and what we do with it.
Registered office: 71-75 Shelton Street, London, WC2H 9JQ
Company number: 17143772
ICO data protection registration number: ZC153675
If you want to contact us about anything in this policy – how we use your data, your rights, or a complaint – email legal@obsessed.co.uk.
2. How to contact us about your data
If you want to ask about your data, exercise any of your rights under data protection law, or raise a concern about how we’ve handled your data, email legal@obsessed.co.uk.
If you’re not happy with how we respond, you can complain to the Information Commissioner’s Office (ICO) – the UK’s data protection regulator:
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We’d rather you came to us first so we can put things right. But you don’t need our permission to go to the ICO. It’s your right.
3. What personal data we collect
We only collect what we need to do the thing you’re asking us to do. The detail below sets out what we collect, where it comes from, and what happens next.
When you sign up to be notified when our newsletter launches
If you submit your email on a newsletter signup form on this site, we collect:
- Your first and last name
- Your email address
- Your phone number, if you choose to give it (the field is optional)
- The type of enquiry you're making, picked from a dropdown
- Whatever you write in the message box
- The date and time you submitted it, and the IP address you submitted it from
When you book a free advisory session
The booking itself goes through Calendly. Calendly collects:
- Your name
- Your email
- The date and time of the call
After you book, you’ll see a short optional pre-call form. If you fill it in we collect:
- Your business website
- A sentence or two on what your business does
- Your approximate annual turnover (a range)
- Your team size (a range)
- Your biggest challenge right now
- What you want from the call
- Anything else you'd like us to know
When you contact us about selling your accountancy practice
If you fill in the form on /sell-your-practice, we collect:
- Your first and last name
- Your email and phone number
- The name of your practice
- Approximate annual turnover (a range)
- Anything you choose to add about your situation
That form goes directly to Ben Jacob-Smith’s personal inbox. Nobody else inside or outside the business sees it. If you decide not to take it any further, we’ll delete your information on request.
When you register interest as an investor
If you fill in the form on /investors, we collect:
- Your full name
- Your email, phone, and LinkedIn URL
- The range of capital you have available to invest
- A brief background about you (optional)
That form also goes directly to Ben Jacob-Smith’s personal inbox. Your details are never shared with third parties.
When you use the general contact form
[Pending – fields to be locked when the /contact page is built next.]
When you email us
If you email us at legal@obsessed.co.uk or any other address, we have your email address and whatever you’ve put in the email. We treat this as you giving us that information for the purpose of replying.
When you use the website
Like most websites, ours collects some data automatically as you browse:
- Type and version of your device, operating system, and browser
- Your approximate location (city level, derived from your IP address)
- The pages you visit, how long you spend on them, and what you click
- The website or link that brought you here
- Your IP address
Most of this is collected through cookies and similar technologies. Our Cookie Policy sets out exactly what’s in use and how to control it.
4. Where we get your data from
We only collect personal data directly from you – through forms on this site, emails you send us, and your activity on the site as set out above.
We don’t buy data, scrape data, or operate any newsletter co-registration programme that would feed your details to us from another platform. If that changes, we’ll update this policy before any such data flow begins.
5. Why we use your data and the lawful basis for doing so
UK data protection law says we have to have a specific reason for using your data, and that reason has to be one of the lawful bases set out in Article 6 of the UK GDPR. Below is what we use your data for, and which lawful basis we rely on in each case.
Notifying you when the newsletter launches
Lawful basis: Consent (UK GDPR Article 6(1)(a)). You give consent by submitting the form. You can ask us to delete your email at any time.
Lawful basis: Legal obligation (UK GDPR Article 6(1)(c)). UK GDPR requires us to be able to demonstrate that we obtained valid consent.
Advisory sessions
Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interest is providing the session you’ve requested. Your interest in receiving the call is the same.
Enquiries about selling your practice, or investing with us
Lawful basis: Steps you’ve taken with a view to entering into a contract (UK GDPR Article 6(1)(b)). You’ve initiated a step that could lead to a transaction; using the information you’ve provided for that purpose is necessary.
General correspondence
Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interest is being responsive when someone gets in touch.
Website analytics and advertising
Lawful basis: Consent (UK GDPR Article 6(1)(a) and Regulation 6 of the Privacy and Electronic Communications Regulations 2003 – “PECR”). You give and withdraw consent through our cookie banner. Our Cookie Policy sets out which cookies and pixels are in use.
Strictly necessary cookies – the ones the site needs to function – don’t require consent.
Meeting our legal and regulatory obligations
Lawful basis: Legal obligation (UK GDPR Article 6(1)(c)).
6 .Who we share your data with
We share your data with a small number of third-party services that help us run the website. Each one is named below, with what they handle and why.
WPX
Our website and email hosting provider. Anything stored on the site – form submissions, server logs, emails to legal@obsessed.co.uk and similar addresses – sits on WPX’s servers.
WPForms
The WordPress plugin we use to handle form submissions on the site. Submissions are stored in our WordPress database on WPX’s servers. WPForms LLC may have incidental access to that data when we ask them for technical support.
Calendly
The booking platform we use for advisory sessions. When you book, your name, email, and the time of the call are processed by Calendly to manage the booking, send you a confirmation, and put the call in our calendar.
We use four Google services on the site:
- Google Fonts - to load the typefaces (Inter and Playfair Display) used across the site.
- Google Analytics 4 (GA4) - to understand how visitors use the site.
- Google Tag Manager - to manage the tags that fire when you visit.
- reCAPTCHA - to stop spam bots from submitting forms.
Each of these may collect technical data about your visit – IP address, device type, browser, pages visited, and similar – and pass it to Google.
CookieYes
The cookie consent banner on the site is run by CookieYes. They store a record of which cookies you’ve consented to (or refused) so the banner doesn’t ask you again.
We don’t sell your data, share it with marketing partners, or transfer it to anyone else for their own commercial purposes.
7. International transfers of your data
Some of the services we use are based outside the UK, or store data outside the UK. When that happens, UK data protection law requires us to make sure your data has the same level of protection abroad as it would here.
Where your data may travel:
- UK. Our hosting and email data sit in WPX's London data centre. The contract with CookieYes is with a UK-registered company. Most of your data stays within the UK.
- EU/EEA. WPX's headquarters and some of its support functions are in Bulgaria. The UK has an adequacy regulation covering EU/EEA countries, so transfers to Bulgaria are treated as if they were inside the UK.
- United States. Calendly, Google, WPForms, and some of CookieYes's technical infrastructure are based in or transfer data to the US. For these transfers we rely on the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge"), which the UK government has approved as providing adequate protection for transfers to certified US companies. For any provider not covered by that framework, we use the UK's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
You can ask for a copy of the safeguards in place for any specific transfer by emailing legal@obsessed.co.uk.
8. How long we keep your data
We don’t keep your data forever. Below is how long we keep each type, and what triggers deletion.
- DATA
- How long we keep it
Newsletter notify-list email
Until we send the launch notification, plus 90 days. If you don’t subscribe at that point, we delete your email.
Consent records (email + IP + timestamp)
While we’re relying on your consent, plus 2 years after it ends – so we can answer a regulator if asked.
Advisory session booking details (Calendly + pre-call form)
24 months from the date of the session, unless you become a client – in which case retention follows your client engagement letter.
Sell Your Practice form submissions
24 months from your last contact with us, unless you become a client or ask us to delete sooner. If you ask us to delete, we will.
Investors form submissions
Same as above.
General correspondence by email
6 years from your last contact, in line with the standard limitation period under English law for contract claims.
Website analytics data (Google Analytics 4)
14 months – the maximum default retention setting in GA4.
Cookie consent records
12 months – after which we’ll re-ask for your consent.
Accounting and tax records
6 years after the end of the relevant accounting period, as required by HMRC.
You can ask us to delete your data sooner – see “Your rights” below.
9. Your rights
Under UK data protection law, you have a set of rights over your personal data. Here’s what they are, and how to use them.
The right of access. You can ask us for a copy of the personal data we hold about you. We’ll respond within one month and there’s no charge for a reasonable request.
The right to rectification. If we hold information about you that’s wrong or incomplete, you can ask us to correct it.
The right to erasure. You can ask us to delete your data. We’ll comply unless we have a legal obligation to keep it – for example, the accounting and tax records HMRC requires us to keep for six years.
The right to restrict processing. You can ask us to pause our use of your data while we investigate a concern – such as if you’ve challenged the accuracy of what we hold.
The right to data portability. Where we hold your data based on consent or a contract, you can ask us for a copy in a structured, machine-readable format so you can take it elsewhere.
The right to object. You can object to our processing where we rely on legitimate interests. We’ll stop unless we can show a compelling reason to continue. You can object to direct marketing at any time, and that objection is absolute. Every marketing email we send includes an unsubscribe link – one click and you’re off the list.
The right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing doesn’t make our previous use of your data unlawful – it stops future use.
The right not to be subject to automated decision-making. We don’t make decisions about you using fully automated systems. Every meaningful decision involves a person at our end. If that ever changes, we’ll update this policy.
The right to complain. If you think we’ve handled your data badly, email us first so we can put it right. If we don’t, you can complain to the Information Commissioner’s Office – see Section 2 for their contact details.
To use any of these rights, email legal@obsessed.co.uk. Tell us which right you want to exercise and we’ll take it from there. We may ask you to verify your identity before we act on a request, usually using the email address we have on file.
10. Cookies and tracking
Cookies and similar technologies are covered in detail in our Cookie Policy. It lists every cookie in use on the site, what it does, how long it stays, and how to manage your preferences.
You can change your cookie preferences at any time by clicking the cookie banner button at the bottom of any page.
11. Children
This website isn’t aimed at children, and we don’t knowingly collect personal data from anyone under 18. If you’re under 18, please don’t submit your data through any form on this site. If we become aware that we’ve accidentally collected data from a minor, we’ll delete it.
12. Security
We take the security of your data seriously. We use industry-standard measures – encryption in transit (HTTPS), access controls on our systems, secure managed hosting, and regular software updates – to protect against unauthorised access, loss, or misuse.
No system is ever 100% secure, and we can’t guarantee absolute security. If we ever become aware of a personal data breach that’s likely to harm you, we’ll notify you and the Information Commissioner’s Office in line with our legal obligations.
13. Changes to this policy
If we change how we collect or use your data, we’ll update this policy. The “Last updated” date at the top of the page will tell you when the most recent change was made.
For changes that materially affect your rights or how we use your data, we’ll let you know directly – by email if we have a current address for you, or by a prominent notice on the site.
14. Complaints
If you have a concern about how we’ve handled your data, email us at legal@obsessed.co.uk and we’ll do our best to put it right.
If we don’t, you can complain to the Information Commissioner’s Office (ICO) – see “How to contact us about your data” near the top of this policy for full contact details.