Privacy & Cookies Policy

Privacy Notice

Who We Are

This notice is issued by Annansec Group Ltd, a company registered in England and Wales (Company No. 17119293). We act as the data controller for the personal data described in this notice.

What This Notice Covers

This notice applies to visitors to annansec.com and to people who contact us or book a call.

Personal data processed during a client engagement is governed by the engagement contract and its data processing terms, under which Annansec generally acts as a processor on the client's instructions. That processing is outside the scope of this notice.

What We Collect, and Why

This website is hosted on Cloudflare Pages. It has no contact forms, no account areas and no analytics. The personal data we receive is limited to the following.

Email enquiries. If you email us, we receive your email address, your name if you provide it, and the content of your message. We use this to respond to you.

Meeting bookings. If you choose to book a call, our scheduling provider Calendly opens and collects the name, email address, company details and meeting time you enter, and shares them with us so we can manage the booking. Calendly's own privacy notice (opens in a new tab) explains how it handles that data. Nothing is sent to Calendly unless you choose to open the booking tool.

Technical connection data. When you load the site, our hosting and security provider Cloudflare processes basic connection details, including your IP address and browser type, in order to deliver the site and protect it from attack. We do not have access to this data as a standalone record, and its retention is governed by Cloudflare.

We do not buy, rent or receive personal data about you from data brokers or advertising networks.

What We Do Not Do

We think it is as useful to tell you what does not happen on this site.

• We do not run analytics, advertising or profiling scripts, and we set no tracking cookies. There is no consent banner because there is nothing to consent to.
• We do not load any third-party code when you simply view the site. The scheduling tool loads only if you choose to open it.
• We do not store anything in your browser's local storage or session storage.
• We do not carry out automated decision-making or profiling, and we do not use your enquiry or booking data to train artificial intelligence models.
• We do not track you across other websites, and we do not share your data for marketing purposes.

Lawful Basis for Processing

Our processing relies on the following lawful bases under UK GDPR Article 6.

Legitimate interests (Article 6(1)(f)). Responding to general business enquiries, maintaining the security of our site, and ensuring it operates reliably. We have considered your interests and rights against ours and are satisfied this processing is proportionate and would be expected. You can ask us for details of that assessment.

Steps prior to entering a contract (Article 6(1)(b)). Processing the details you provide when booking a call or holding a preliminary conversation, in order to understand and scope a possible engagement.

If you become a client, personal data connected to that commercial relationship is governed by our client agreement and its data processing terms, not by this notice.

Do You Have to Provide Your Data

No. There is no statutory or contractual requirement to give us any personal data, and you are free to read this site without providing any.

If you want a reply to an enquiry or a scheduled call, we need enough information to contact you and to arrange it. Without that, we cannot respond or book the meeting, but nothing else follows from choosing not to.

Service Providers and International Transfers

We use a small number of providers. We have set out what each one does, where it processes data and what protects it, because we think you should be able to see the whole picture rather than a list of names.

Where a provider processes personal data outside the UK, we rely on UK-approved Standard Contractual Clauses together with the UK International Data Transfer Addendum, supported by a transfer risk assessment. Where a provider additionally holds a certification such as the UK Extension to the EU-US Data Privacy Framework, that operates alongside those clauses rather than instead of them.

Data Retention

We delete enquiry correspondence and booking records 24 months after your last interaction with us, unless the enquiry becomes a client engagement, in which case the retention terms in the client agreement apply instead.

Technical connection data is held by Cloudflare under its own retention periods, described in the Cloudflare privacy policy (opens in a new tab). We do not retain a separate copy.

Your Rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased where we have no continuing lawful reason to keep it;
• restrict or object to our processing in certain circumstances;
• receive a copy of your data in a structured, commonly used and machine-readable format.

To exercise any of these rights, email info@annansec.com. We will respond within one month.

You can also complain to the UK data protection regulator:
Information Commissioner's Office (ICO)
ico.org.uk (opens in a new tab) · 0303 123 1113

We would rather hear from you first, but you are not required to raise it with us before going to the ICO.

Children

This website offers business services and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to This Notice

We will update this notice if our website functionality or our service providers change. The version published here is always the current one, and the effective date at the top shows when it last changed.

Cookie Policy

Effective date: 23 September 2026

Overview

This website sets no analytics, tracking, advertising or profiling cookies, and stores nothing in your browser's local or session storage.

The only cookies that can be set are strictly necessary ones from our security and hosting provider. Under Regulation 6(4) of the Privacy and Electronic Communications Regulations (PECR), strictly necessary cookies do not require consent, which is why you are not asked to dismiss a banner on this site.

Strictly Necessary Cookies

The site runs on Cloudflare Pages with bot protection enabled. Cloudflare sets the following.

These exist to keep the site available and to distinguish real visitors from automated traffic. They are not used to identify you, to build a profile, or for any marketing purpose. Cloudflare documents them in full in its cookie reference (opens in a new tab).

Cookie Categories

Scheduling Tool

Our booking tool, Calendly, loads only when you choose to open it. Until then, no Calendly code runs and no data reaches Calendly.

If you do open it, Calendly loads its own scheduling interface and may set its own cookies, governed by the Calendly privacy notice (opens in a new tab), which covers its cookies. You can read the whole site, including this page, without that ever happening.

External Links

Links to third-party sites, such as our LinkedIn company profile, take you to domains outside our control. Those platforms set cookies in accordance with their own policies.

Managing Cookies

Because this site sets no non-essential cookies, there is no banner and no action required from you. You can block or delete cookies at any time through your browser's privacy settings. Blocking Cloudflare's security cookies may prevent parts of the site from loading correctly.

Future Changes

If we ever introduce privacy-preserving first-party statistics under the PECR exemptions, we will update this policy and provide a clear opt-out. If we ever introduce third-party tracking or advertising scripts, we will ask for your explicit consent before any such cookie is set.