Website & Marketing Privacy Notice

How Charcoalblue Group Ltd collects and uses personal data through our website, contact channels and email marketing
Effective date: August 2026

This notice explains how Charcoalblue Group Ltd (“Charcoalblue”, “we”, “us”, “our”) collects, uses and protects personal data when you visit our website, contact us, or receive marketing communications from us. It does not cover how we process the personal data of job applicants — that is set out in our separate Candidate Privacy Notice.

 

1. Who we are

Charcoalblue Group Ltd is the data controller for the purposes described in this notice. Our registered address is 17 Short St, London SE1 8LJ. You can contact us about this notice at [email protected].

 

2. What personal data we collect

Depending on how you interact with us, we may collect:

  • Contact details — name, job title, employer, email address, telephone number and postal address
  • Enquiry and communication data — the content of messages you send us, and our replies
  • Marketing engagement data — whether you have opened, clicked or otherwise engaged with an email, and your marketing preferences
  • Technical and usage data — IP address, browser type, device information, pages visited and time spent on our website, collected via cookies and similar technologies (see our separate Cookie Policy)
  • Source information — where a contact was introduced to us, for example a past project relationship, an industry event, a website enquiry, or a publicly available business source

 

3. Where we get your data from

  • Directly from you, when you contact us or sign up on our website
  • From our own records of past client, project and business relationships
  • From publicly available professional sources, such as company websites or professional networking sites

 

4. How and why we use your data

We use your personal data for the following purposes, on the legal bases described:

  • To respond to enquiries you send us — necessary to take steps at your request before, or in performing, a contract, or our legitimate interest in providing customer service
  • To send you email marketing about our services, projects and events — either with your consent, or, for existing clients and contacts, in reliance on the PECR “soft opt-in” exception where we obtained your details in the course of a sale or negotiation of a sale of a similar service and you were given a clear opportunity to opt out
  • To measure engagement with our marketing and maintain accurate, up-to-date contact records — our legitimate interest in understanding whether our communications are wanted and relevant, balanced against your right to object
  • To operate, secure and improve our website — our legitimate interest in maintaining a functioning and secure site, and consent where required for non-essential cookies
  • To comply with legal obligations, for example responding to regulator requests

We do not use your personal data to make decisions about you based solely on automated processing.

 

5. Who we share your data with

We use the following categories of processor to help us run our marketing and website:

  • HubSpot — our customer relationship management and email marketing platform, which processes contact and engagement data on our instructions
  • Periti — our CRM implementation and technical services provider, which assists with the implementation and management of our HubSpot platform and processes contact and related personal data on our instructions.

Both providers act as our data processors, are bound by written data processing agreements, and are only permitted to use your data in accordance with our instructions and for the purposes we specify.

We do not sell personal data to third parties.

 

6. International transfers

Where any of our processors store or access personal data outside the UK, we ensure an appropriate safeguard is in place before the transfer takes place — such as a UK adequacy finding for the destination country, or the International Data Transfer Agreement (IDTA) or UK Addendum together with a Transfer Risk Assessment.

 

7. How long we keep your data

We retain marketing and website contact data in line with our Data Retention Policy, which sets out how long we hold non-engaging contacts before we ask them to reconfirm their interest or remove them from our systems.

 

8. Your rights

Depending on where you are located and the data protection laws that apply to you, you may have the right to:

  • Be informed about how we use your data
  • Access a copy of the data we hold about you
  • Have inaccurate data corrected
  • Ask us to delete your data in certain circumstances
  • Object to processing based on our legitimate interests, including direct marketing — we will always stop marketing to you if you object
  • Restrict how we use your data in certain circumstances
  • Receive certain data in a portable format
  • Withdraw consent at any time, where we rely on consent

To exercise any of these rights, or to unsubscribe from marketing emails, use the unsubscribe link in any marketing email, update your preferences, or email us as [email protected].

 

9. Complaints

If you are unhappy with how we have handled your personal data, please raise it with us first using the details above — see our Marketing & Data Complaints Procedure for how we handle complaints. You also have the right to complain directly to the Information Commissioner’s Office (ICO) at ico.org.uk.

 

10. Changes to this notice

We may update this notice from time to time, for example to reflect changes in the law or in how we use your data. The effective date at the top of this page shows when it was last updated.