Privacy Policy

Who We Are

MDA Business Advisory Limited is a fractional commercial director consultancy registered in England and Wales. We provide senior commercial thinking to UK scaling businesses across DTC, B2B, Retail, FMCG and Professional Services.

We are registered with the Information Commissioner's Office (ICO) and take our obligations under UK data protection law seriously.

What Information We Collect

We only collect information that is necessary for the purposes described in this policy. This may include:

• Contact information — your name, email address and company name when you submit our contact form or book a diagnostic call
• Communication data — the content of any messages you send us through the website or by email
• Usage data — information about how you use our website, including pages visited, time spent and referring sources, collected via cookies only where you have given consent
• Technical data — your IP address, browser type and device information, collected automatically when you visit our site

We do not collect sensitive personal data, payment card information, or data from anyone we know to be under the age of 18.

How We Use Your Information

We use the information we collect for the following purposes:

• To respond to enquiries and contact form submissions
• To schedule and manage diagnostic calls booked through Calendly
• To provide our consultancy services to clients
• To send relevant commercial communications where you have given consent or where we have a legitimate business interest
• To improve the performance and content of our website
• To comply with our legal and regulatory obligations

We will never sell your personal data to third parties. We will never use your data for automated decision-making or profiling.

Our Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases:

• Consent — for analytics cookies and any direct marketing communications
• Legitimate interests — to respond to business enquiries and manage client relationships where it is reasonable to expect contact
• Contract — to deliver services where an engagement agreement is in place
• Legal obligation — where we are required to retain records for tax, accounting or regulatory purposes

Cookies

Our website uses cookies. When you visit the site, you will be presented with a cookie banner that allows you to choose between essential cookies only, or accepting all cookies including analytics.

Essential cookies are required for the website to function correctly. They do not track you or collect personal data beyond what is technically necessary.

Analytics cookies help us understand how visitors use the site — which pages are visited, how long people stay, and where visitors come from. We only set these if you have given explicit consent.

You can change your cookie preferences at any time by clearing your browser's local storage or adjusting your browser settings.

Third Party Services

We use a small number of third party services in the operation of this website and our business. These include:

• Calendly — for booking diagnostic calls. When you book a call, you are subject to Calendly's own privacy policy in addition to ours
• Netlify — for website hosting. Netlify processes technical data as part of serving the website
• Google Fonts — for web typography. Google may collect limited technical data when fonts are loaded

We do not share your personal data with any third party for marketing, advertising or profiling purposes.

How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purpose it was collected, or as required by law.

• Enquiry and contact form data — retained for up to 2 years from the date of last contact
• Client engagement records — retained for 6 years in line with HMRC requirements
• Cookie consent records — stored locally in your browser until cleared

When data is no longer needed, it is securely deleted.

Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your data where there is no legitimate reason to continue holding it
• Right to restrict processing — you can ask us to pause processing your data in certain circumstances
• Right to data portability — you can ask for your data in a machine-readable format
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, please contact us at the details below. We will respond within 30 days.

Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection authority.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. Any material changes will be noted with an updated date at the top of this page.

We encourage you to review this policy periodically. Continued use of the website following any changes constitutes acceptance of the updated policy.