Privacy Policy

Last updated: October 2026

This website, acre-consultancy.com (the “Site”), is owned and operated by Avon Chemical Regulatory Enterprises Consultancy Ltd, trading as ACRE Consultancy (“we”, “us”, “our”), a company registered in England and Wales under company number 12795762. Our registered office is Building Society Chambers, Wesley Street, Otley, West Yorkshire, LS21 1AZ, United Kingdom. We are the data controller for personal data collected through the Site, and we are registered with the Information Commissioner’s Office (ICO) under registration reference ZC279887. You can contact us at:

  • Email: info@acre-consultancy.com
  • Telephone: +44 (0) 1425 838 995
  • Post: Building Society Chambers, Wesley Street, Otley, West Yorkshire, LS21 1AZ, United Kingdom

Purpose of this policy

This privacy policy explains:

  • the personal data we collect through the Site;
  • how we use it and our legal basis for doing so;
  • who has access to it;
  • your rights; and
  • how the Site uses cookies.

This policy applies in addition to the terms and conditions of the Site.

Data protection law

For users in the United Kingdom, we comply with the UK General Data Protection Regulation and the Data Protection Act 2018. For users in the European Union, we comply with Regulation (EU) 2016/679, the General Data Protection Regulation. In this policy we refer to these together as the “GDPR”.

Personal data we collect

We only collect data that helps us achieve the purposes set out in this policy.

Data you give us. When you send us a message through the contact form, we collect:

  • your first and last name;
  • your email address;
  • your phone number and company name, if you choose to give them; and
  • the content of your message.

When you ask to download a resource that requires your details, we collect your first and last name, your email address, your company name if you choose to give it, and which resource you asked for.

If you book a consultation through our online booking page, Microsoft Bookings collects the details you enter there, such as your name, email address and the appointment time you choose.

If you email or telephone us directly, we will also hold the details you give us in that correspondence.

Data collected automatically. When you visit the Site, the following may be collected:

  • your IP address and approximate location derived from it;
  • your browser, device type and operating system; and
  • the pages you view, the links you click and the website that referred you to us.

How we use personal data

We will not use your data beyond what we describe in this policy.

  • To respond to you. We use the details you send through the contact form to reply to your enquiry and to discuss our services with you.
  • To provide resources. When you give your details to download a resource, we use them to provide the download and may contact you about it.
  • To arrange consultations. We use the details you give when booking to arrange and hold the consultation.
  • To keep in touch about our services. We may use the contact details you give us through the Site, for example when you send an enquiry or download a resource, to contact you in future about our services or for marketing purposes. You can opt out at any time (see “Marketing and how to opt out” below).
  • To understand how the Site is used. We use the data collected automatically to produce statistics, monitor the performance of the Site and improve it.
  • To keep the Site secure. We use automated checks to protect the contact form from spam and abuse.

Legal basis for processing

We collect and process personal data only when we have a legal basis for doing so under Article 6 of the GDPR. We rely on the following:

  • Legitimate interests. Responding to enquiries, providing the resources you ask for and following up on them, contacting business contacts about our services, running and securing the Site, and understanding how it is used.
  • Steps before entering a contract. Where you ask us about our services with a view to engaging us.
  • Consent. Where we ask for your consent, for example for analytics cookies, or before sending marketing emails where the law requires consent. You may withdraw your consent at any time by contacting us. Withdrawing consent does not make processing we carried out before you withdrew it unlawful.
  • Legal obligation. Where the law requires us to keep or disclose information.

Marketing and how to opt out

We may use the contact details you give us through the Site to contact you about our services or for marketing purposes, for example by email or telephone. We send marketing emails to business contacts on the basis of our legitimate interests. Where the law requires consent, for example if you use a personal email address, we will only send you marketing emails if you have agreed to receive them or if you have recently asked us about similar services and have not opted out.

You can opt out of marketing at any time, free of charge:

  • by following the opt-out instructions in any marketing email we send you;
  • by replying to one of our emails and asking us to stop; or
  • by contacting us at info@acre-consultancy.com or on +44 (0) 1425 838 995.

If you opt out, we will stop sending you marketing and keep a note of your request so that we do not contact you for marketing again. Opting out of marketing does not stop us replying to an enquiry you have made. We do not sell your details or pass them to other organisations for their own marketing.

Who we share personal data with

Our team. We may disclose your data to any member of our organisation who reasonably needs access to it to achieve the purposes set out in this policy.

Service providers. We use the following providers to run the Site. They process data on our behalf and only as needed to provide their service:

  • our website hosting provider, which stores the Site and the messages sent through it;
  • First Rate Marketing Ltd, which maintains the Site for us;
  • Microsoft, which provides our email and our online booking page (Microsoft Bookings);
  • Google, which provides Google Analytics; and
  • Cloudflare, which provides the check on our contact form that tells people from automated software.

Some of these providers may process data outside the United Kingdom and the European Economic Area. Where they do, they rely on safeguards recognised by data protection law, such as adequacy decisions or standard contractual clauses.

Other disclosures. We will not sell your data, and we will not share it with other third parties except:

  • if the law requires it;
  • if it is required for any legal proceeding;
  • to prove or protect our legal rights; and
  • to buyers or potential buyers of this company, in the event that we seek to sell it.

If you follow a link from the Site to another website, please note that we are not responsible for, and have no control over, its privacy policies and practices.

How long we keep personal data

We keep your data only for as long as we need it for the purpose it was collected for. Enquiries sent through the contact form and details given to download a resource are kept for 2 years (24 months) and are then deleted. If you become a client, the information relating to our work for you is kept in line with our contractual and legal obligations. If you opt out of marketing, we keep a record of that request so that we can respect it.

How we protect your personal data

The Site is served over an encrypted connection (HTTPS). Messages sent through the Site are stored on secure servers, and access to them is limited to the people who need it.

While we take all reasonable precautions to keep your data secure, there always remains some risk. The internet can be insecure at times, and we cannot guarantee the security of your data beyond what is reasonably practical.

Your rights

Under the GDPR, you have the following rights:

  • the right to be informed;
  • the right of access;
  • the right to rectification;
  • the right to erasure;
  • the right to restrict processing;
  • the right to data portability; and
  • the right to object, including the right to object to direct marketing at any time.

If you would like to know whether we hold your personal data, how we have used it or who we have disclosed it to, or if you would like it corrected or deleted, or wish to exercise any of your other rights, please contact us using the details at the top of this policy. We will respond within one month.

Children

The Site is intended for businesses. We do not knowingly collect or use personal data from children under 16 years of age. If we learn that we have collected personal data from a child under 16, we will delete it as soon as possible.

Cookies

A cookie is a small file stored on your device by a website. The Site uses the following:

  • Analytics cookies (only if you accept). We use Google Analytics to collect data on how visitors reach and use the Site, such as the pages viewed and the time spent on them. This helps us improve the Site. Google Analytics only loads, and its cookies (named _ga and _ga_HF97309LD9) are only set, if you choose “Accept analytics cookies” on our cookie banner.
  • Your cookie choice. We store your answer to the cookie banner in a cookie named acre_consent for 12 months, so that we do not ask you on every page.
  • Security. On the contact page, Cloudflare Turnstile may store a small amount of data on your device to confirm that the form is being used by a person.
  • Booking calendar. If you open our online booking calendar, Microsoft may set cookies that the calendar needs to work.

You can change your choice at any time using “Cookie settings” at the bottom of every page. If you withdraw your consent, we stop using Google Analytics and remove its cookies. You can also choose to be notified each time a cookie is set, or disable cookies entirely, in your browser settings. Google also offers a browser add-on to opt out of Google Analytics.

Changes to this policy

We may amend this policy from time to time to keep it in line with the law and to reflect any changes to how we collect data. When we do, we will update the date at the top of this page. We recommend that you review this policy periodically.

Complaints

If you have a complaint about how we process your personal data, please contact us first using the details at the top of this policy, and we will try to resolve it. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113. If you are in the European Union, you may complain to the data protection authority in your country.