236 Works Limited is committed to protecting your privacy. This policy explains what personal data we hold, why we hold it, how long we keep it, who we share it with, and the rights you have under UK data protection law.
This website is operated by 236 Works Limited ("236 Works", "we", "us", or "our"), a company registered in England and Wales under company number 14151990, with its registered office at 41 Tun Furlong, Pitstone, Leighton Buzzard, England, LU7 9GE.
For the purposes of UK data protection law, 236 Works Limited is the data controller responsible for your personal data. We are a boutique Operational Excellence consultancy serving small businesses, SMEs, mid-market companies, and enterprise clients.
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. This policy reflects the requirements in force as of its last updated date.
For any question about this policy, or to exercise any of your rights, you can reach our Data Protection Officer at dpo@236works.com.
If you wish to raise a dispute, you can contact our Dispute Resolution Team at disputes@236works.com.
Depending on how you interact with us, we may collect and process the following categories of personal data.
Enquiry and booking data. When you contact us, book a discovery call, or complete a form on our website, we collect your name, email address, telephone number, company, and the content of your message.
Prospect and business contact data. As part of our business development, we hold professional business contact details such as name, job title, work email, company, and industry. Some of this is sourced from reputable third-party business intelligence providers and held within our customer relationship management system, together with our own notes on how the contact arose.
Client data. Where you engage us for a project, we process the personal data necessary to deliver that engagement, as set out in our contract and any associated agreement with you.
Technical data. When you visit our website, we may collect limited technical information such as IP address and browser type. How we use cookies and similar technologies is explained in our Cookie Policy.
Some of the professional contact data we hold is obtained from third-party business intelligence providers who compile business contact information from public and commercial sources. Where we hold and use that data, 236 Works is the controller and is responsible for how we use it. We rely on legitimate interests for business-to-business outreach, and we always provide a clear and simple way to opt out. If you would prefer not to hear from us, contact dpo@236works.com and we will remove you promptly.
We only use your personal data when the law allows us to. The lawful bases we rely on are:
Consent. Where you have given clear consent, for example to receive certain marketing. You can withdraw consent at any time.
Contract. Where processing is necessary to enter into or perform a contract with you.
Legitimate interests. Where processing is necessary for our legitimate interests, such as responding to your enquiries, business-to-business marketing, and running and improving our business, provided your interests and rights do not override those interests.
Legal obligation. Where we need to comply with the law.
We use AI tools responsibly, and we distinguish carefully between public tools and contracted business tools. For general research and public-information tasks, we may use publicly available AI assistants. We do not input client confidential information or personal data into public AI tools.
Where we carry out client project work, we use business AI tools that operate under commercial agreements and appropriate data protection terms. These are Microsoft Copilot, within our secure Microsoft 365 environment, and Claude for Work from Anthropic. For both, 236 Works is the controller of the data our team submits and the provider acts as our processor under a data processing agreement, and the data is not used to train their AI models. Where we connect these tools to our other business systems, such as Microsoft 365 and our customer relationship management platform, that access is governed by the same protections and by our agreements with you.
We do not use AI to make solely automated decisions that produce legal or similarly significant effects about you.
We do not sell your personal data. We share it only where necessary, with:
Service providers. Trusted suppliers who support our operations, including our customer relationship management, document signing, design, Microsoft 365 productivity, and business AI platforms. These providers process data on our behalf under appropriate contractual terms.
Our team. Members of the 236 Works team who need access to deliver our services, bound by confidentiality.
Professional advisers and authorities. Where required by law or to protect our legal rights.
Some of our team members and service providers are located outside the United Kingdom. Where personal data is transferred outside the UK, we make sure it is protected by appropriate safeguards recognised under UK data protection law, such as the UK Data Bridge or data privacy framework certifications, or the ICO's International Data Transfer Agreement or the UK Addendum to the standard contractual clauses.
For client engagements, where data residency matters to you, you can tell us before any contract is signed if you would prefer that we do not use team members based in a particular country, and we will accommodate that.
We keep personal data only for as long as we need it for the purposes set out in this policy. Enquiry data from people who do not become clients is reviewed and deleted when it is no longer needed. Client data is retained for the duration of our engagement and afterwards for as long as we are required to keep it for legal, tax, and accounting purposes, typically up to seven years. Business contact data is reviewed periodically and removed when it is no longer relevant or when you ask us to remove it.
We have appropriate technical and organisational measures in place to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. Our data is held within Microsoft 365 Business Premium with access limited to those who need it to do their job.
Under UK data protection law you have the right to:
be informed about how we use your personal data; request access to your personal data; ask us to correct inaccurate or incomplete data; ask us to erase your data in certain circumstances; restrict our processing in certain circumstances; object to processing based on legitimate interests or for direct marketing; and request the transfer of your data to you or another organisation in certain circumstances.
You will not usually have to pay a fee to exercise your rights. We will respond to your request within one month. To exercise any right, contact dpo@236works.com.
If you have a concern about how we have handled your personal data, please tell us first so we can try to put it right. You can raise a complaint with our Data Protection Officer at dpo@236works.com. We will acknowledge your complaint within 30 days, take appropriate steps to resolve it without undue delay, and keep you informed of progress and the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. We would, however, appreciate the chance to address your concerns before you approach the ICO.
We may update this policy from time to time. When we do, we will revise the last updated date at the top of this page and, where appropriate, bring material changes to your attention. Please check back periodically to stay informed.