Privacy Policy

Ecrebo Limited

Last updated: 03 June 2026

1. Who We Are

Ecrebo Limited (“Ecrebo”, “we”, “us”, or “our”) is a data controller responsible for your personal data. Our details are:

This policy explains how we collect, use, store, and share your personal data. It applies to clients, potential clients, suppliers, website visitors, shareholders, job applicants, advisers, and other stakeholders. It does not apply to our current or former employees, workers, or contractors (who receive a separate employee privacy notice), or to data we process as a data processor on behalf of our clients.

2. The Law That Applies

We are committed to handling your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. These laws set out principles we must follow when processing personal data:

• Process data lawfully, fairly, and transparently

• Collect data only for specific, explicit, and legitimate purposes

• Limit data to what is necessary for those purposes

• Keep data accurate and up to date

• Not keep data longer than necessary

• Keep data secure against unauthorized access, loss, or damage

3. Personal Data We Collect and Why

3.1 Clients and Potential Clients

We collect contact details including name, email address, telephone number, job title, and organization details. We use this information to communicate with you about your account, deliver our services, and — where you have not opted out — to send relevant updates about our products and services. Our legal basis is legitimate interests (delivering and developing our business) and, where relevant, the performance of a contract with you.

3.2 Website Visitors

When you visit ecrebo.com, we may collect information about your visit through cookies and analytics tools. This includes your approximate location, browser type, pages viewed, and time spent on site. We use this to understand how our website is used and to improve it. Our legal basis is legitimate interests (improving our website and understanding our audience). Please see Section 9 (Cookies) for full details.

3.3 Shareholders

We use shareholder contact details and shareholding information to send business updates, circulate agreements and resolutions, and to meet our legal obligations. We share director information (name, home address, service address, date of birth, occupation, and nationality) with Companies House as required by law. Our legal basis is compliance with a legal obligation and legitimate interests.

3.4 Job Applicants

If you apply for a role at Ecrebo, we collect your name, contact details, current salary, and CV. We use this to assess your application and contact you about suitable roles. Our legal basis is legitimate interests (finding suitable candidates) and, where an offer is made, steps to enter into a contract.

3.5 Suppliers and Advisers

We collect contact and payment details of suppliers, accountants, auditors, insurers, banks, and professional advisers. We use this to manage our working relationships and meet our legal and contractual obligations. Our legal basis is the performance of a contract and compliance with legal obligations.

3.6 Business Sale or Restructuring

In the event of a possible sale, transfer, or restructuring of Ecrebo’s business, we may share personal data with prospective buyers and their advisers. We will use anonymized data where possible before any transaction completes, and share personal data only to the extent required by the terms of the transaction or by law. Our legal basis is legitimate interests.

4. Legal Basis Summary

The table below summarizes the legal bases we rely on:

5. Sensitive Personal Data

Some categories of personal data require extra protection under the UK GDPR — for example, health information, racial or ethnic origin, or criminal conviction data.

We do not routinely collect sensitive personal data. If you disclose a disability to us, we may retain that information solely to make appropriate adjustments for meetings at our premises and to ensure your health and safety. We will not retain or use criminal conviction information unless you have given explicit written consent. We will not use sensitive data for any purpose other than that for which it was collected, and we will only process it where we have a lawful basis to do so.

6. Who We Share Your Data With

We only share your personal data where there is a legitimate reason to do so. We require all third parties to handle your data securely and only for specified purposes. The processors and recipients we currently use include:

We do not sell your personal data to third parties.

7. International Data Transfers

Some of our third-party service providers are based outside the UK. Where we transfer personal data to countries that do not have an equivalent level of data protection law, we ensure appropriate safeguards are in place. For transfers to the USA and other third countries, we rely on:

• The ICO’s International Data Transfer Agreement (IDTA), or

• UK Addendum to the EU Standard Contractual Clauses, as approved by the UK Secretary of State

You may request a copy of the relevant transfer mechanism by contacting our DPO at oliver.crowley@ecrebo.com.

8. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purpose for which it was collected, or as required by law. Our standard retention periods are:

Where data is no longer required, we delete or anonymize it securely. Anonymized data (which cannot identify you) may be retained indefinitely for statistical purposes.

9. Cookies

Our website uses cookies — small text files stored on your device — to help us operate the site and understand how it is used.

Essential Cookies

These cookies are necessary for the website to function and cannot be switched off. They are set in response to actions you take, such as setting your cookie preferences.

Statistics Cookies

These cookies allow us to count visits and understand how visitors use our site, so we can improve it. All information is aggregated and anonymous. These cookies are only set with your consent.

Note: We are in the process of reviewing our cookie configuration to ensure only active cookies are listed. If you have questions about specific cookies on our site, please contact our DPO.

Managing Your Cookie Preferences

When you first visit our website, you will be presented with a cookie banner. You can accept all cookies, or manage your preferences to allow only essential cookies. You can update your preferences at any time by clicking the “Cookie Preferences” link in our website footer.

You can also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the website. For more information about cookies generally, visit www.allaboutcookies.org.

10. Marketing Communications

We only send marketing communications to people who have opted in to receive them, or where we have a legitimate interest in contacting you about our services and you have not opted out.

If you would like to opt out of marketing communications at any time, please contact our Head of Marketing, Sarah Todd, at sarah.todd@ecrebo.com.

11. Automated Decision-Making

We do not use automated decision-making (including profiling) that produces legal or similarly significant effects on you. If this changes, we will notify you and ensure a lawful basis is in place.

12. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organizational measures to protect it against unauthorized access, loss, alteration, or disclosure. 

These include:

• Restricting access to personal data to those with a business need

• Requiring all staff and contractors who access personal data to do so under a duty of confidentiality

• Using encrypted connections (HTTPS) on our website

• Maintaining data breach response procedures

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and will notify you where required.

13. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

These rights are not absolute and may be subject to exemptions in certain circumstances. To exercise any of these rights, please contact our DPO, Oliver Crowley, at oliver.crowley@ecrebo.com. You will not be charged a fee for making a request unless it is manifestly unfounded or excessive.

14. Keeping Your Data Accurate

It is important that the personal data we hold about you is accurate and up to date. Please notify us if your information changes so we can update our records.

15. Changes to This Policy

We may update this privacy policy from time to time. The “Last updated” date at the top of this page will always reflect when the policy was last revised. If we make material changes, we will take reasonable steps to notify you — for example, by email or by placing a prominent notice on our website.

16. How to Raise a Concern or Complaint

If you have any concerns about how we handle your personal data, we ask that you contact our DPO in the first instance so we can try to resolve the matter:

If you remain dissatisfied after raising a concern with us, you have the right to lodge a complaint with the UK’s supervisory authority for data protection: