- Privacy Policy
What we do with your data, and the rights you have over it.
Written in plain English. Compliant with UK GDPR and the Data Protection Act 2018.
- CONTENTS
1. Who we are
Obsessed Ltd is the data controller for this website. We decide what data to collect from you, why, and what we do with it.
Registered office: 71-75 Shelton Street, London, WC2H 9JQ
Company number: 17143772
ICO data protection registration number: ZC153675
If you want to contact us about anything in this policy – how we use your data, your rights, or a complaint – email legal@obsessed.co.uk.
2. How to contact us about your data
If you want to ask about your data, exercise any of your rights under data protection law, or raise a concern about how we’ve handled your data, email legal@obsessed.co.uk.
If you’re not happy with how we respond, you can complain to the Information Commissioner’s Office (ICO) – the UK’s data protection regulator:
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We’d rather you came to us first so we can put things right. But you don’t need our permission to go to the ICO. It’s your right.
3. What personal data we collect
We only collect what we need to do the thing you’re asking us to do. The detail below sets out what we collect, where it comes from, and what happens next.
When you sign up to be notified when our newsletter launches
If you submit your email on a newsletter signup form on this site, we collect:
- Your email address
When you book a free advisory session
The booking itself goes through Calendly. Calendly collects:
- Your name
- Your email
- The date and time of the call
- Your business website
- A sentence or two on what your business does
- Your approximate annual turnover (a range)
- Your team size (a range)
- Your biggest challenge right now
- What you want from the call
- Anything else you'd like us to know
When you contact us about selling your accountancy practice
If you fill in the form on /sell-your-practice, we collect:
- Your first and last name
- Your email and phone number
- Your practice name
- Approximate annual turnover
- Anything you choose to tell us upfront
Your submission is handled through HubSpot and used to assess and discuss a potential transaction with you. We treat sale enquiries confidentially and do not use the information for general marketing unless you have separately agreed to that. Access is limited to the people and service providers who reasonably need it for the enquiry and any resulting transaction process.
When you register interest as an investor
If you fill in the form on /investors, we collect:
- Your first and last name
- Your email address and telephone number
- The approximate amount you may consider investing
- A brief background about you (optional)
Your submission is handled through HubSpot and used to assess your expression of interest, communicate with you about the registration and, where appropriate, carry out the eligibility and compliance steps required before any investment-specific information is provided. Access is limited to the people, advisers and service providers who reasonably need the information for those purposes.
When you use the general contact form
If you fill in the form on /contact, we collect:
- Your first and last name
- Your email address
- Your company name, if you choose to give it
- Your phone number, if you choose to give it
- The type of enquiry you are making
- Whatever you write in the message box
- The date and time you submitted it, and the IP address you submitted it from
Submissions are handled through HubSpot and routed to the appropriate person or team so we can respond to your enquiry and follow up where it makes sense.
When you send an accounting enquiry
If you use the quick-enquiry form on /accounting, we collect the contact detail you provide, your business type, what you need help with, your approximate annual turnover, your employee band and anything you choose to tell us about the work.
The enquiry is handled through HubSpot and routed to the Obsessed Accounting team so we can respond, scope the work and discuss a potential engagement. If you become an accounting client, professional onboarding and subsequent professional data processing are covered by the applicable engagement documents and privacy information supplied by Obsessed Accounting Ltd.
When you email us
If you email us at legal@obsessed.co.uk or any other address, we have your email address and whatever you’ve put in the email. We treat this as you giving us that information for the purpose of replying.
When someone refers you to Obsessed, or you join Obsessed Ambassadors
A person making a warm introduction may give us your name, business details, contact details and limited information needed to explain the introduction. Our referral forms require the person making the introduction to confirm that they have spoken to you about Obsessed, that you have agreed they may share your contact details with us, and that you are expecting Obsessed to contact you about its services.
If you make a one-off referral, we process the information you provide about yourself and the referral so that we can record the introduction, administer attribution, provide limited referral-status updates where appropriate and administer any referral payment that becomes due.
If you join Obsessed Ambassadors, we also process information needed to operate the programme, including your account and contact details, Referral records, attribution, stage-level progress, Referral Payments, payment information where required, Qualifying Conversion history, tier, bonus and milestone progress, Portal activity and programme communications.
We do not give a referrer access to a referred person’s private conversations, pricing, tax or accounting information, financial details, payment arrangements or personal circumstances merely because they made the introduction.
When you use the website
Like most websites, ours collects some data automatically as you browse:
- Type and version of your device, operating system, and browser
- Approximate location derived from your IP address, where collected
- Pages or features you interact with, where tracking is enabled
- Referrer information
- Your IP address and other technical / security information
Most of this is collected through cookies and similar technologies. Our Cookie Policy sets out exactly what’s in use and how to control it.
When someone refers you to Obsessed, or you join Obsessed Ambassadors
A person making a warm introduction may give us your name, contact details and limited information needed to explain the introduction. Our referral forms require the introducer to confirm that you know about the introduction and have agreed that your details can be shared with us.
If you join Obsessed Ambassadors, we also process information needed to run the programme, including your account/contact details, referral records, attribution, stage-level progress, commission records, payment information when required, tier/bonus progress and Portal activity. HubSpot is our CRM and Partner Portal powers the referral programme and The Obsessed Portal.
We do not give an introducer access to a referred person’s private conversations, pricing, tax information, financial details or personal circumstances.
4. Where we get your data from
We collect most personal data directly from you – through forms, bookings, emails and your activity on the website. We may also receive limited personal data about you from a person or business making a warm introduction through our Refer or Obsessed Ambassadors routes, where they confirm that you know about the introduction, have agreed that your details may be shared with us and are expecting Obsessed to contact you about its services. We also receive information from service providers acting on our behalf when you use their functionality, including our CRM, booking, referral and Portal systems. We do not buy or scrape personal data for the purpose of making referrals through these routes.
5. Why we use your data and the lawful basis
UK data protection law says we have to have a specific reason for using your data, and that reason has to be one of the lawful bases set out in Article 6 of the UK GDPR. Below is what we use your data for, and which lawful basis we rely on in each case.
Notifying you when the newsletter launches
Lawful basis: Consent (UK GDPR Article 6(1)(a)). You give consent by submitting the form. You can ask us to delete your email at any time.
Lawful basis: Legal obligation (UK GDPR Article 6(1)(c)). UK GDPR requires us to be able to demonstrate that we obtained valid consent.
Advisory sessions
Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interest is providing the session you’ve requested. Your interest in receiving the call is the same.
Enquiries about selling your practice, or investing with us
Lawful basis: Steps you’ve taken with a view to entering into a contract (UK GDPR Article 6(1)(b)). You’ve initiated a step that could lead to a transaction; using the information you’ve provided for that purpose is necessary.
Accounting enquiries
Lawful basis: steps taken at your request before entering into a contract (UK GDPR Article 6(1)(b)) and, where appropriate for general pre-engagement administration, our legitimate interests in responding to business enquiries.
Referrals and Obsessed Ambassadors
Our lawful basis is our legitimate interests in responding to a genuine warm introduction, balanced against the referred person’s rights and interests.
For a person making a one-off referral, we use their contact, referral, attribution and payment information to administer the referral and any payment that becomes due. Our lawful bases are performance of the One-Off Referral Terms where applicable, our legitimate interests in administering genuine referrals and legal obligations applying to payment, tax and record-keeping.
For Participants in Obsessed Ambassadors, we use account, referral, attribution, payment, Portal, tier, bonus, milestone and related programme information to administer participation in the programme. Our lawful bases are performance of the Obsessed Ambassadors Programme Terms, our legitimate interests in operating and protecting the programme, and legal obligations applying to payment, tax and record-keeping.
General correspondence
Lawful basis: Legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interest is being responsive when someone gets in touch.
Website analytics and advertising
Where consent is required, our lawful basis for the processing of personal data is Consent (UK GDPR Article 6(1)(a)), and we obtain that consent before the relevant technology is used. Our Cookie Policy explains the technologies in use and the choices available to you.
Strictly necessary technologies, and any other storage or access technologies that may lawfully be used without consent, are used only where the applicable legal requirements are met.
Strictly necessary cookies – the ones the site needs to function – don’t require consent.
Meeting our legal and regulatory obligations
Lawful basis: Legal obligation (UK GDPR Article 6(1)(c)).
6. Who we share your data with
We share your data with a small number of third-party services that help us run the website. Each one is named below, with what they handle and why.
WPX
Our website / email hosting provider. Website content, server logs and hosted site data may be processed on its infrastructure.
HubSpot
Our CRM and website-form platform. Website enquiries, contact records, referral/prospect records and related CRM activity are processed in HubSpot. HubSpot website tracking is also enabled, subject to the cookie / storage-access controls described in our Cookie Policy.
Partner Portal
The referral-programme platform behind The Obsessed Portal. It processes Introducer / Ambassador account information, referral attribution, stage-level progress, commission and programme-status information
Calendly
Our booking platform for Advisory Sessions. It processes booking/contact information needed to arrange and manage the meeting.
Testimonial.to
The platform used to display our testimonial wall and testimonial videos on the Proof page. It may process technical information when its embedded content loads.
We use four Google services on the site:
- Google Fonts - to load the typefaces (Inter and Playfair Display) used across the site.
- Google Analytics 4 (GA4) - to understand how visitors use the site.
- Google Tag Manager - to manage the tags that fire when you visit.
- reCAPTCHA - to stop spam bots from submitting forms.
Each of these may collect technical data about your visit – IP address, device type, browser, pages visited, and similar – and pass it to Google.
We do not sell your personal data or allow these providers to use it for their own unrelated commercial purposes merely because they supply services to us.
7. International transfers of your data
Some of our service providers may process or store personal data outside the UK, including in the United States or the EEA. This includes HubSpot, Partner Portal, Calendly, Testimonial.to and Google.
Where personal data is transferred outside the UK, we use a lawful transfer mechanism appropriate to the destination and provider. This may include a UK adequacy regulation, the UK Extension to the EU–US Data Privacy Framework where the recipient is eligible, or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.
You can ask us for more information about the safeguard used for a particular transfer by emailing legal@obsessed.co.uk.
8. How long we keep your data
We don’t keep your data forever. Below is how long we keep each type, and what triggers deletion.
- DATA
- How long we keep it
Newsletter notify-list email
Until we send the launch notification, plus 90 days. If you don’t subscribe at that point, we delete your email.
Consent records (email + IP + timestamp)
While we’re relying on your consent, plus 2 years after it ends – so we can answer a regulator if asked.
Advisory session booking details (Calendly + pre-call form)
24 months from the date of the session, unless you become a client – in which case retention follows your client engagement letter.
Sell Your Practice form submissions
24 months from your last contact with us, unless you become a client or ask us to delete sooner. If you ask us to delete, we will.
Investors form submissions
Same as above.
General correspondence by email
6 years from your last contact, in line with the standard limitation period under English law for contract claims.
Website analytics data (Google Analytics 4)
14 months – the maximum default retention setting in GA4.
Cookie consent records
6 months from the date of your choice, after which we may ask you to confirm your preferences again. We may ask sooner if our use of cookies or similar technologies materially changes.
You can ask us to delete your data sooner – see “Your rights” below.
9. Your rights
Under UK data protection law, you have a set of rights over your personal data. Here’s what they are, and how to use them.
The right of access. You can ask us for a copy of the personal data we hold about you. We’ll respond within one month and there’s no charge for a reasonable request.
The right to rectification. If we hold information about you that’s wrong or incomplete, you can ask us to correct it.
The right to erasure. You can ask us to delete your data. We’ll comply unless we have a legal obligation or another lawful reason to retain it.
The right to restrict processing. You can ask us to pause our use of your data while we investigate a concern – such as if you’ve challenged the accuracy of what we hold.
The right to data portability. Where we hold your data based on consent or a contract, you can ask us for a copy in a structured, machine-readable format so you can take it elsewhere.
The right to object. You can object to our processing where we rely on legitimate interests. We’ll stop unless we can show a compelling reason to continue. You can object to direct marketing at any time, and that objection is absolute. Every marketing email we send includes an unsubscribe link – one click and you’re off the list.
The right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing doesn’t make our previous use of your data unlawful – it stops future use.
The right not to be subject to automated decision-making. We don’t make decisions about you using fully automated systems. Every meaningful decision involves a person at our end. If that ever changes, we’ll update this policy.
The right to complain. If you think we’ve handled your data badly, email us first so we can put it right. If we don’t, you can complain to the Information Commissioner’s Office – see Section 2 for their contact details.
To use any of these rights, email legal@obsessed.co.uk. Tell us which right you want to exercise and we’ll take it from there. We may ask you to verify your identity before we act on a request, usually using the email address we have on file.
10. Cookies and tracking
Cookies and other storage or access technologies are explained in our Cookie Policy. It describes the categories of technology used on the site, their purposes, the third-party services involved and how to exercise the choices available to you.
11. Children
This website isn’t aimed at children, and we don’t knowingly collect personal data from anyone under 18. If you’re under 18, please don’t submit your data through any form on this site. If we become aware that we’ve accidentally collected data from a minor, we’ll delete it.
12. Security
We take the security of your data seriously. We use industry-standard measures – encryption in transit (HTTPS), access controls on our systems, secure managed hosting, and regular software updates – to protect against unauthorised access, loss, or misuse.
No system is ever completely secure, and we can’t guarantee absolute security. If a personal data breach occurs, we will assess it in accordance with our obligations under data protection law. Where required, we will report the breach to the ICO and, where the applicable threshold is met, notify affected individuals.
13. Changes to this policy
If we change how we collect or use your data, we’ll update this policy. The “Last updated” date at the top of the page will tell you when the most recent change was made.
If we make a material change, we may highlight it on the site or take other reasonable steps to bring it to your attention where appropriate.
14. Complaints
If you have a concern about how we’ve handled your data, email us at legal@obsessed.co.uk and we’ll do our best to put it right.
If we don’t, you can complain to the Information Commissioner’s Office (ICO) – see “How to contact us about your data” near the top of this policy for full contact details.