Who is responsible?
Orithen Ltd is the controller for the personal information described here. For enquiries or privacy requests, contact ugur.eken@orithen.co.uk. Company number: 17410512. Registered office: Johnson Matthey Building, Haverton Hill Road, Billingham, United Kingdom, TS23 1QG. These particulars were checked against the Companies House register on 15 October 2026.
What we collect
The enquiry form collects your organisation name, name, phone number, email address, subject and message. The hosting service may process technical information such as your IP address and request details to deliver and protect the website. Please do not submit passwords, payment card details or sensitive assessment records.
Why we use it and our lawful bases
- Handling business enquiries and discussing consultancy: our legitimate interests in responding to the business contact you initiate and managing prospective business relationships. We have assessed the purpose, necessity and effect on the people contacting us; we limit this use to responding to the enquiry and managing that discussion.
- Steps before a contract: where you personally request steps towards a contract with us, processing may be necessary to take those steps at your request.
- Security and abuse prevention: our legitimate interests in protecting the website and inbox, proportionate to the risk.
- Optional browser preferences: your permission to remember the theme you choose. We do not use that choice to identify you.
Providing information through this form is not a statutory obligation. The form requires the listed contact fields so we can understand the business enquiry and respond by email or phone. If you prefer to provide fewer details, you can email us directly instead.
Marketing
We use this form to respond to your enquiry. It does not sign you up for newsletters, promotional email, text messages or marketing calls. We do not treat the enquiry, a privacy-policy acknowledgement or a cookie choice as marketing permission.
Who receives information?
Enquiries are emailed to our business inbox and handled by the people at Orithen responsible for responding. Website hosting and email providers process information to deliver those services. Professional advisers or public authorities may receive information where necessary and legally justified. AWS hosts the website origin and processes the contact form in its London region. CloudFront delivers the site through its global network, so technical request information may be processed outside the UK. Enquiries are sent using Amazon SES to our IONOS Mail Basic business inbox. IONOS’s published processing agreement provides for processing in the UK or EEA, with necessary transfers to other countries subject to its data-protection requirements; we do not promise a particular mailbox data centre. AWS’s Data Processing Addendum and UK GDPR Addendum apply under its service terms, including contractual safeguards for relevant international transfers. IONOS’s Data Processing Agreement forms part of its terms and includes requirements for necessary third-country transfers. These arrangements do not mean that all processing takes place in the UK. You can contact us for information about the applicable safeguards. We do not sell enquiry information.
Keeping information
We retain enquiries that do not lead to a client relationship for no longer than 12 months after our last contact. The Director reviews these records and the business mailbox monthly and deletes enquiries due before the next review, so active copies are removed on or before that limit. This is a manual process. If an enquiry becomes a client relationship, the applicable client and statutory record-keeping arrangements apply instead and will be explained separately.
Function security and diagnostic logs have a configured retention period of 14 days. The website does not intentionally log enquiry bodies, and this release does not enable CloudFront or API access logs or sampled WAF requests. Providers may keep their own service-operation and recovery information under their applicable terms. Deleting an active mailbox copy does not necessarily remove every provider recovery copy immediately; those copies are subject to the provider’s recovery, retention and deletion arrangements. We do not use recovery copies as an active enquiry archive. If information is restored, we reapply the enquiry deletion rules. Contact us if you need information about recovery-copy handling or wish to exercise your rights.
The AWS contact abuse-prevention state contains keyed hashes of source IP addresses and request counts, without enquiry messages. Short request limits use one-second and 15-minute windows, with a separate daily cap. Counter records expire after 24 hours and are removed by DynamoDB’s asynchronous expiry process, which can take several days. Expired records are not used to extend active request windows. Browser preferences last up to 90 days as explained in the Cookies Policy.
Your rights
Depending on the circumstances and lawful basis, you may request access, correction, erasure, restriction or portability of your personal information. Contact us using the address above to exercise a right. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Your right to object
You can object to processing based on legitimate interests, on grounds relating to your situation. You can object to direct marketing at any time. We will consider and act on requests as required by applicable data protection law.
Complaints
Please contact us if you have a concern. You can also complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk/make-a-complaint.
Automated decisions
The enquiry form does not make automated decisions producing legal or similarly significant effects, or profile you for marketing. Automated checks may reject invalid or excessive form requests to protect the service; you can contact us by email if this happens.
Changes and scope
This policy covers the public consultancy website. The unreleased Orithen application is outside its scope. We will update this policy when the site’s processing changes.
Last updated: 15 October 2026.