Privacy Policy

1. Who we are

Colebridge helps owner-led businesses identify and eliminate friction that is costing them money, time or capacity.

For the purposes of applicable data protection law, the organisation responsible for your personal information (the “controller”) is:

References in this policy to “Colebridge”, “we”, “our” or “us” mean the organisation identified above.

2. Information we collect

The information we collect depends on how you interact with Colebridge.

Information you provide to us

This may include:

• your name;
• email address;
• telephone number;
• job title or role;
• company or organisation name;
• information about your business;
• business size or characteristics;
• information submitted through the Business Performance Check;
• answers submitted through scorecards, assessments or questionnaires;
• figures and assumptions entered into calculators;
• information submitted when requesting a conversation;
• messages and correspondence you send us;
• newsletter preferences;
• information provided during discovery, diagnostic or client engagements; and
• other information you choose to provide.

Please avoid providing sensitive personal information through our website tools unless we specifically ask you to do so.

3. Business information can still be personal information

Much of the information we work with concerns businesses rather than individuals.

However, business information may still constitute personal information where it identifies or relates to an individual — for example, the name and email address of a company owner or employee.

This Privacy Policy applies to personal information contained within business information where applicable.

4. Information collected automatically

When you use our website, we may collect certain technical or usage information automatically.

Depending on the technologies enabled on the website, this may include:

• IP address;
• browser and device information;
• pages visited;
• approximate location derived from technical information;
• referring page or source;
• dates and times of visits;
• interactions with website features;
• Diagnostic or calculator usage events;
• session information;
• error and performance information; and
• cookie or similar technology identifiers.

Where information is genuinely anonymised so that it can no longer identify an individual, it is not personal information.

See our Cookies notice for the technologies the website currently uses.

5. How we use your information

We may use personal information to:

Provide our website and tools

For example, to:

• operate the Business Performance Check;
• calculate and display results;
• generate recommendations;
• operate business calculators;
• save or retrieve information where a feature allows this;
• generate reports; and
• send requested results or confirmations.

Respond to you

We use information you provide to:

• respond to enquiries;
• arrange conversations;
• understand the problem you are asking us about;
• provide information about Colebridge services; and
• communicate about potential or existing engagements.

Deliver our services

Where you become a client, we may process information to:

• understand your organisation;
• conduct discovery and analysis;
• investigate business friction;
• document processes, systems and requirements;
• estimate economic impacts;
• develop recommendations;
• deliver agreed work;
• monitor outcomes;
• manage our relationship with you; and
• administer contracts and payments.

Improve Colebridge

We may analyse how people use our website, tools and services to understand:

• which tools are useful;
• where people encounter difficulty;
• common patterns in business problems;
• how our services and products can be improved; and
• website performance and reliability.

Where practical, we use aggregated or anonymised information for research and analysis.

Send communications you have requested

If you subscribe to Colebridge Insights or another mailing list, we may use your contact details to send those communications.

You can unsubscribe at any time using the unsubscribe link included in marketing emails or by contacting us.

Protect Colebridge and others

We may process information where reasonably necessary to:

• maintain security;
• prevent misuse or fraud;
• investigate technical problems;
• establish or defend legal claims; and
• comply with legal and regulatory obligations.

6. Our lawful bases

Where UK GDPR or EU GDPR applies, we must have a lawful basis for processing personal information.

Depending on the activity, we may rely on:

Contract

Where processing is necessary to provide something you have requested or to perform a contract with you.

For example, delivering an agreed Colebridge engagement.

Steps before entering into a contract

Where you ask us to discuss a potential engagement or provide information necessary to consider working together.

Legitimate interests

We may process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.

These interests may include:

• operating and improving Colebridge;
• responding to business enquiries;
• understanding how our services and tools are used;
• maintaining security;
• managing business relationships;
• improving our tools and services; and
• establishing, exercising or defending legal rights.

Consent

We may rely on your consent where appropriate, including for certain marketing communications and non-essential cookies or similar technologies.

Where processing relies on consent, you may withdraw that consent at any time.

Legal obligation

We may process information where required to comply with applicable law.

7. Business Performance Check

Your Diagnostic answers and progress are saved in your browser tab so you can return to them during the session.

When you reach your report, your answers are automatically sent to our server to calculate and record a completion summary. This summary contains your scores, priority areas, completion duration, Diagnostic version and referring page. Individual answers are not saved in this completion record, and this request does not include your name, email address or company.

If you choose to share your report, we also store the contact and business details you submit, your individual answers and your results. We use these to review your report and respond to you. Sharing is optional and does not subscribe you to marketing emails.

Requests also pass through security controls, which use an IP-derived identifier to limit misuse. Completion records should therefore not be treated as a promise of complete anonymity.

We use this information to:

• calculate your results;
• identify potential patterns of friction;
• provide recommendations;
• generate or send your results where requested;
• maintain the integrity and performance of the Diagnostic; and
• improve the Diagnostic and our understanding of recurring business problems.

Diagnostic results are intended to provide general business insight, not a definitive audit or professional determination of the condition, performance or value of your business.

They depend on the information you provide.

8. Previous calculator use and estimates

The Business Leak Calculator and Business Leak Explorer are no longer available as public tools. This section covers information previously submitted through them, or a previous calculation you choose to include in an enquiry.

Colebridge calculators may process figures relating to staffing, working time, revenue, processes, cash flow, capacity or other aspects of your business.

Calculations are based on the information and assumptions entered into the tool.

Unless clearly stated otherwise:

• estimates are indicative;
• they are not audited financial calculations;
• they do not guarantee that a stated amount can be recovered or saved;
• released employee capacity does not automatically represent a cash saving;
• potential commercial opportunity is not guaranteed revenue; and
• results should be interpreted in the context of your business.

We may store calculator inputs and results where necessary to provide the tool, allow you to return to your work, understand tool usage or improve the service.

9. Automated processing

Our tools may automatically calculate scores, classifications, estimates or recommendations based on information you provide.

These outputs are intended to help you understand or investigate your business.

Unless we specifically tell you otherwise, Colebridge does not use these automated outputs to make decisions about you that produce legal or similarly significant effects.

10. Email communications

There is an important distinction between service communications and marketing communications.

Service communications

If you complete a Diagnostic, request results, submit an enquiry, book a conversation or use another service, we may send emails necessary to fulfil that request.

For example: “Here are your Business Performance Check results.”

Receiving such an email does not automatically subscribe you to the Colebridge newsletter.

Marketing and Insights

If you separately subscribe to Colebridge Insights or another marketing list, we may send editorial or promotional communications in accordance with applicable law.

You may unsubscribe at any time.

11. Who we share information with

We do not sell your personal information.

We may use trusted service providers to operate Colebridge.

Depending on the services currently enabled, these may include providers of:

• website hosting;
• databases and cloud infrastructure;
• email delivery;
• website analytics;
• error monitoring;
• content management;
• communications;
• scheduling;
• payment processing;
• professional services; and
• security.

The website uses Supabase to store enquiries, shared Diagnostic reports, completion summaries and security rate-limit records; and Resend to deliver transactional emails. Google Fonts receives technical request information when your browser loads the website’s typefaces. Sanity supplies website content, rather than storing enquiry submissions.

These providers process information for defined purposes and are subject to appropriate contractual or other safeguards where required.

We may also disclose information:

• where required by law;
• to regulators or law-enforcement bodies where legally required;
• to professional advisers;
• in connection with establishing or defending legal claims; or
• as part of a merger, acquisition, restructuring or sale of all or part of our business, subject to appropriate protections.

12. International transfers

Colebridge is based in the United Kingdom, but some of the technology providers we use may process or store information in other countries.

Where personal information is transferred internationally, we take appropriate steps required by applicable data protection law.

Depending on the destination and circumstances, these may include:

• UK adequacy regulations;
• European Commission adequacy decisions where EU GDPR applies;
• approved contractual safeguards;
• the UK International Data Transfer Agreement or UK Addendum where appropriate; or
• another lawful transfer mechanism.

You may contact us for further information about the safeguards applicable to relevant transfers.

13. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

Retention periods vary depending on the information and why we hold it.

For example:

• enquiry information may be retained while an enquiry remains relevant and for a reasonable period afterwards;
• client records may be retained for the duration of the engagement and an appropriate period afterwards for contractual, tax, legal and professional purposes;
• newsletter information may be retained until you unsubscribe, with limited suppression information retained where necessary to respect your preference;
• Diagnostic reports, individual answers, associated contact details and completion summaries are normally kept for 12 months after submission or completion, then deleted or anonymised during our monthly retention review;
• where a Diagnostic becomes part of an active enquiry or client engagement, relevant records may be kept with that engagement for as long as needed for the stated purpose; any legal or dispute-related exception is reviewed and documented;
• previous calculator records are reviewed and removed when no longer needed for the enquiry or service for which they were supplied;
• security and technical logs may be retained for shorter operational periods.

Where information is no longer required, we will delete it, anonymise it or otherwise securely dispose of it where reasonably practicable.

14. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

However, no internet-based system can be guaranteed to be completely secure.

You are responsible for ensuring that information you provide through Colebridge’s tools is information you are authorised to provide.

15. Your privacy rights

Depending on where you live and the law applicable to our processing, you may have rights concerning your personal information.

These may include rights to:

• access personal information we hold about you;
• correct inaccurate information;
• request deletion;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to a data protection regulator.

These rights are not absolute and may be subject to legal conditions or exemptions.

To make a privacy request, contact:

We may need to verify your identity before fulfilling a request.

16. Your right to object

Where we process your personal information on the basis of legitimate interests, you may have the right to object to that processing.

You also have the right to object at any time to processing of your personal information for direct marketing purposes.

17. UK and EEA complaints

If you are in the United Kingdom and have concerns about how we use your personal information, we would appreciate the opportunity to address them first.

You also have the right to complain to the UK Information Commissioner’s Office.

If EU GDPR applies to you, you may also have the right to complain to the relevant supervisory authority in the EEA country where you live, work or where you believe an infringement occurred.

18. United States and other jurisdictions

Privacy laws differ between countries and, in some cases, between states or provinces.

Where applicable law grants you additional privacy rights, Colebridge will honour those rights to the extent they apply to us.

For example, California law provides qualifying consumers with rights including access, deletion, correction and, where applicable, rights relating to the sale or sharing of personal information. Those laws apply only to businesses that meet specific legal thresholds.

Colebridge does not sell personal information.

If our practices or legal obligations change, we will update this notice accordingly.

19. Children’s privacy

Colebridge’s website and business services are intended for adults acting personally or in connection with businesses and organisations.

They are not directed at children.

We do not knowingly seek to collect personal information from children through our business tools.

20. Changes to this policy

We may update this Privacy Policy where our services, technology, processing activities or legal obligations change.

The current version will be published on this page with its latest revision date.

21. Contact us

For questions about this Privacy Policy or how Colebridge handles personal information: