Privacy & cookies
This notice covers what happens to your data when you use this website. What happens to your data during a client engagement is governed by the data processing agreement for that engagement, not by this notice.
Who the controller is
North Stack Limited, a company registered in England & Wales (no. 16928771), registered office Suite Ra01, 195-197 Wood Street, London, England, E17 3NU, is the data controller for this website. We are registered with the Information Commissioner's Office under registration ZC186532. For anything in this notice, write to [email protected] and a person will answer.
What we collect, and why
Only what you choose to send us. When you use a form on this site, that is your name, email address, and whatever you write in the message, plus the company name and phone number on forms that ask for them. We use it to respond to your enquiry and to carry on that conversation. We do not sell it, we do not share it for anyone else's marketing, and we do not use it to build a profile of you.
The lawful basis is legitimate interests: you contacted a business about its services, and replying to you is the obvious consequence. If you would rather we did not hold it, say so and it goes.
How long we keep it
Enquiries are kept for 24 months from our last contact with you, then deleted. That period covers a normal enquiry-to-engagement cycle, so a conversation that goes quiet and restarts a year later does not begin from nothing. If you become a client, engagement records are kept under the terms of that engagement instead.
Who else processes it
These third parties process data on our behalf for this website:
- Cloudflare — hosting, edge delivery and bot protection (Turnstile).
- Three Impact — processes contact and enquiry form submissions.
We apply transport encryption and security headers across the site. The current list, and our wider security position, is on our trust page.
Cookies and third parties
This site sets no analytics or advertising cookies, and runs no tracking scripts, tag managers or chat widgets. Cloudflare Turnstile, which keeps bots off our forms, may set a short-lived token needed for the form to work at all.
Two things do reach out to other companies, and we would rather say so than have you find out. Our typefaces are loaded from Google Fonts and Fontshare, which means those two see your IP address when a page loads. They set no cookies and we receive nothing back, but it is a transfer and it is not strictly necessary, so we are moving to serving the fonts ourselves.
The introduction video on our home page is hosted by us, not embedded from a social platform, so watching it tells nobody else that you were here.
Your rights
Under UK GDPR you can ask us for a copy of what we hold on you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, and object to our using it. Email [email protected] and we will answer within one month, usually much sooner. You have no obligation to go through us first: you can complain directly to the Information Commissioner's Office at ico.org.uk.
Changes
If this notice changes materially we will date the change here rather than quietly editing it. Last updated 12 August 2026.