Privacy Policy

1. About this policy

This Privacy Policy explains how FONRAT collects, uses, stores and protects personal information in connection with this website, enquiries and its strategic advisory relationships. FONRAT is a UK-based strategic advisory practice.

This policy is intended to reflect the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003.

2. Information we may collect

The website does not currently offer user accounts, online registration or a contact form. If you contact FONRAT by email or through another business channel, or enter into discussions about a potential engagement, we may collect:

• identity and contact information, such as your name, professional role, organisation, email address and telephone number;
• the contents of your enquiry, correspondence and any information you choose to provide;
• prospective-client and client information, including engagement details, instructions, meeting notes, correspondence and administrative records;
• billing and payment-status information where relevant to an engagement, but not complete payment-card details processed independently by a payment provider; and
• limited technical information generated when the website is accessed, such as IP address, browser and device information, requested pages, date and time, and security or server-log data.

Please do not send sensitive personal information unless it is genuinely necessary. If you voluntarily provide such information, FONRAT will use it only where there is an appropriate legal basis.

3. How and why information is used

Personal information may be used to:

• respond to enquiries and communicate with prospective clients;
• assess whether FONRAT can accept or perform a proposed engagement;
• provide agreed advisory services and manage the client relationship;
• prepare correspondence, strategic materials, reports and related work requested by a client;
• administer invoices, payments, records and business operations;
• protect the website, communications and business from misuse, fraud or security threats;
• establish, exercise or defend legal rights; and
• comply with applicable legal, regulatory, accounting or tax obligations.

4. Lawful bases

Depending on the circumstances, FONRAT relies on one or more of the following lawful bases:

• Contract: where processing is necessary to take steps at your request before an engagement or to perform an agreed engagement.
• Legitimate interests: to respond to business enquiries, manage professional relationships, operate and secure the website, maintain appropriate records and protect legal interests.
• Legal obligation: where information must be processed to comply with applicable law.
• Consent: where consent is specifically requested. You may withdraw consent at any time, without affecting processing already carried out lawfully.

5. Website technology and cookies

FONRAT does not currently use advertising cookies, behavioural tracking or optional website analytics. The site is delivered through Cloudflare infrastructure. Cloudflare may process limited technical data as part of content delivery.

Strictly necessary technical mechanisms may be used where required for security or reliable delivery. If optional analytics, advertising or other non-essential cookies are introduced in the future, this policy will be updated and you will be given an opportunity to consent.

6. Sharing and service providers

FONRAT does not sell personal information. Information may be shared only where reasonably necessary with service providers supporting website hosting and security, business email, document management and similar functions.

Cloudflare supports the hosting and delivery of this website, and Apple supports FONRAT business email. These providers process information under their own terms and privacy commitments. International transfers of data are protected by appropriate legal mechanisms recognised under UK data protection law.

7. International transfers

Some service providers may process information outside the United Kingdom. Where a restricted international transfer occurs, FONRAT will use a mechanism recognised under UK data-protection law, such as standard contractual clauses.

8. Retention

Information is kept only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, tax, security and dispute-resolution requirements. Client files and engagement records are retained in accordance with professional standards and applicable law.

9. Security

FONRAT uses reasonable organisational and technical measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. No internet or digital system is completely secure, and we cannot guarantee absolute security.

10. Your rights

Subject to the circumstances and applicable exemptions, you may have the right to request access to your personal information; correction of inaccurate information; erasure; restriction of processing; data portability; and objection to processing.

Your right to object: you may object to processing based on FONRAT's legitimate interests. FONRAT will stop that processing unless there are compelling legitimate grounds that override your interests or a legal obligation applies.

FONRAT does not currently use solely automated decision-making or profiling that produces legal or similarly significant effects.

11. Contact and complaints

To exercise a data-protection right or ask a privacy question, contact FONRAT at fonrat@fonrat.com.

You also have the right to complain to the UK Information Commissioner's Office. Information about making a complaint is available at ico.org.uk/make-a-complaint.

12. Changes to this policy

This policy may be updated to reflect changes in the website, services or applicable law. The effective date above will be revised when a material update is made.