Privacy Policy & Data Protection Notice
Data Controller Identity & Statutory Registration:
1. Introduction & Scope
Mind Reflection Ltd ("we", "our", "us") operates as an independent B2B strategic management consultancy, digital systems integrator, and IT advisory firm. We respect your privacy and are committed to safeguarding your personal data in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Policy explains how we collect, process, store, and protect information when you visit our website (mindreflection.co.uk), communicate with our advisory team, or schedule business appointments via our embedded scheduling systems.
2. The Personal Data We Collect
We process personal data strictly necessary to facilitate corporate consulting engagements, technical audits, and administrative operations:
A. Direct Inquiries & Corporate Communications
- Identity & Contact Details: Name, professional title, corporate email address, business telephone number, and employer/company name.
- Consultation Subject Matter: Operational context, architecture specifications, or business inquiries provided in your correspondence.
B. Google Calendar Appointment Scheduling
When you schedule a consultation or discovery session via our embedded Google Calendar Appointment Scheduling system, we collect:
- Your full name and corporate email address.
- Selected date, appointment time slot, and meeting timezone.
- Preliminary notes regarding your operational challenges or systems audit scope.
- Generated Google Meet video conferencing tokens and invitation telemetry.
C. Technical & Log Data (Automated)
- Standard server request logs: IP address, browser user-agent, operating system, referring URL, and timestamp (utilized exclusively for network security, rate limiting, and intrusion prevention).
3. Lawful Bases for Processing (UK GDPR Art. 6)
| Processing Purpose | Data Categories | UK GDPR Lawful Basis |
|---|---|---|
| Scheduling & hosting advisory consultations (Google Calendar / Meet) | Name, Email, Meeting notes | Article 6(1)(b): Performance of a contract or preliminary steps prior to entering a contract. |
| Responding to B2B inquiries & technical scoping | Contact information, correspondence | Article 6(1)(f): Legitimate interests in conducting corporate B2B consultancy. |
| Corporate accounting, VAT invoicing & statutory filings | Billing details, business address | Article 6(1)(c): Legal obligation (HMRC, Companies House statutory retention). |
| Server security, TLS integrity & fail2ban protection | IP addresses, server logs | Article 6(1)(f): Legitimate interests in maintaining cybersecurity and system integrity. |
4. Third-Party Data Processors & International Transfers
We do not sell, rent, or trade your personal data. We only share data with vetted infrastructure partners who act as Data Processors under strict Data Processing Addendums (DPAs):
- Google LLC / Google Ireland Ltd (Google Workspace & Google Calendar): Used for secure enterprise email hosting, appointment scheduling, and Google Meet video conferencing. Data is transferred and secured under UK International Data Transfer Agreements (IDTA) and EU/UK Standard Contractual Clauses (SCCs).
- Cloud & Hosting Infrastructure (AWS / Dedicated Linux VPS): Hardened hosting environments featuring TLS 1.3 encryption, POSIX access controls, and firewall isolation.
- Statutory Authorities: Where legally mandated under UK law (e.g., HMRC, Companies House, or law enforcement with appropriate warrants).
5. Data Retention Periods
We retain personal information only for as long as strictly necessary to fulfill business objectives or satisfy statutory obligations:
- Appointment Bookings & General Inquiries: Retained for the duration of the advisory relationship or securely purged within 24 months following the last active communication.
- Statutory Accounting & Engagement Contracts: Retained for 6 full tax years in accordance with HMRC and UK Companies Act regulations.
- Network Security Logs: Automatically rotated and purged within 30 to 90 days.
6. Cybersecurity & Technical Safeguards
As a cloud systems and infrastructure consultancy, our defensive data hygiene incorporates enterprise-grade controls:
- Enforced TLS 1.3 encryption with strict transport security (HSTS) across all web properties.
- Zero-trust SSH access with ed25519 key authentication and root login disabled on production systems.
- Multi-Factor Authentication (MFA / 2FA) enforced on all administrative Google Workspace accounts.
- Regular automated backups with automated point-in-time recovery and zero-leak environment secret management.
7. Your Statutory Rights Under UK GDPR
As a data subject in the United Kingdom, you possess enforceable statutory rights:
- Right of Access (Subject Access Request - SAR): Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete records.
- Right to Erasure ("Right to be Forgotten"): Request deletion of data where retention is no longer legally justified.
- Right to Restrict or Object to Processing: Object to processing carried out under legitimate interests.
- Right to Data Portability: Request transmission of your data in a structured, machine-readable format.
To exercise any of these rights, contact our Data Protection Lead at: info@mindreflection.co.uk. Requests are responded to within one calendar month without administrative charge.
8. Information Commissioner's Office (Supervisory Authority)
Mind Reflection Ltd is formally registered as a Data Controller with the UK supervisory authority:
Information Commissioner’s Office (ICO) Registration:
Registration Reference: ZA317530
You have the right to lodge a complaint with the ICO at any time if you believe your data has been handled unlawfully:
Website: https://ico.org.uk/
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, UK
9. Contact the Data Controller
If you have questions regarding this Privacy Policy or wish to discuss our data governance practices, please reach out directly:
Mind Reflection Ltd
Unit 869 Moat House, 54 Bloomfield Avenue
Belfast, BT5 5AD, Northern Ireland, United Kingdom
Email: info@mindreflection.co.uk
Telephone: +44 7400 992785