Privacy Policy

Privacy Notice (Privacy Policy) — Outlier Technology Limited

Last updated: 9th November 2026

Applies to: https://outliertechnology.co.uk and Outlier Technology Limited’s own business operations.

1. Who we are

Outlier Technology Limited (“Outlier Technology”, “we”, “us”) is a UK-based information technology consultancy, registered in England and Wales (company number 11303595).

This notice explains how we handle personal data for which we are responsible (for example: business contact details, recruitment information, and limited supplier/finance records).

In most client engagements, we work inside client-controlled environments and do not store or operate client production data on Outlier Technology systems as part of normal operations.

2. How to contact us about privacy (including deletion requests)

Email: hello@outliertechnology.co.uk
Postal address: Popeshead Court Offices, Peter Lane, York, England, YO1 8SU

If your request relates to data held in a client’s systems (where the client is the controller), we may direct you to the relevant client contact rather than acting unilaterally.

3. What personal data we collect

Depending on your relationship with us, we may collect:

Identity and contact data: name, job title, employer, email address, phone number, work address.
Communications: emails and messages with us, meeting notes, and records of requests you make (including privacy requests).
Business operations: invoices, purchase orders, and payment reconciliation information (where relevant).
Recruitment / HR (where relevant): CVs, employment history, references, right-to-work checks, and other information you provide during recruitment.
Website usage: basic technical and usage information (for example IP address, timestamps, user agent, pages accessed, and error/security events) in server/security logs.
Website contact / scheduling (if you use our contact/booking features): information you submit such as name, email address, organisation, meeting time, and any notes you choose to provide.

Where we get this data from:

Directly from you (for example when you email us, apply for a role, or book a meeting)
From your organisation / our clients (for example where you are a named stakeholder on an engagement)
From public / professional sources (for example your organisation website or LinkedIn, where relevant to a business relationship)
From our systems and service providers (for example Website logs and scheduling confirmations)

Our website analytics do not use cookies. Embedded features (for example scheduling) may set cookies. Where we use non-essential cookies, we will provide appropriate notice and choices.

Website analytics and ad labels

We use Plausible Analytics (Plausible Insights OÜ) to understand which pages are read and which sites send people to us. Plausible does not use cookies and does not identify a visitor. A visit records the page, the referring site, the country, and the browser and device type.

Links we use in an advert can carry a label we choose, in the address (ad, or the standard utm_source, utm_medium, utm_campaign, utm_content and utm_term). When you arrive on such a link, we keep that label in the browser until the tab is closed. If you then book a call, the same label is passed to the booking so we can match the call to the advert. The label identifies the advert, not you. We do not sell it and we do not use it to follow you onto other websites.

We do not intentionally collect special category data (for example health data) unless you choose to provide it, or it is required by law.

4. How we use personal data (purposes and lawful bases)

We only use personal data where we have a lawful basis under UK GDPR / GDPR. Common bases include:

Contract (to provide requested services or manage a relationship)
Legal obligation (to comply with tax, accounting, employment, or other laws)
Legitimate interests (to run our business responsibly, keep systems secure, and communicate with business contacts)
Consent (only where required; you can withdraw consent at any time)

Typical processing activities:

Delivering and managing consulting services (contract / legitimate interests)
Responding to enquiries and maintaining business relationships (legitimate interests)
Recruitment and onboarding (legitimate interests / contract steps)
Accounting and tax compliance (legal obligation)
Security, fraud prevention, and audit trails (legitimate interests / legal obligation where applicable)

You do not usually have to provide personal data to us by law. However, if you do not provide information that is necessary for a contract or to progress an enquiry (for example contact details), we may not be able to respond or provide the requested services.

We may share personal data with:

Service providers we use to operate our business (for example email, document storage, accounting, security tooling), under appropriate contractual protections.
Website providers we use to host and operate our Website (including embedded features such as scheduling).
Plausible Insights OÜ, which processes the website visit statistics described above.
Professional advisers (for example legal, insurance, or accounting) where needed.
Regulators and authorities where we are legally required to do so.
Clients only where necessary for an engagement (for example to coordinate with named stakeholders) and in line with contractual terms.

We do not sell personal data.

6. International transfers

Some of our service providers may process data outside the UK/EEA. Where that happens, we use appropriate safeguards (for example UK IDTA / EU Standard Contractual Clauses, and vendor due diligence).

7. Retention

We keep personal data only as long as needed for the purposes described above, including legal and contractual requirements. Retention is determined by:

the type of relationship (for example applicant vs supplier vs business contact),
legal requirements (for example tax/finance records), and
security/audit needs.

Website logs are typically retained for a short period for security and troubleshooting, and longer where needed to investigate or evidence security incidents.

Data subject request records (including deletion requests) are retained for at least 3 years (or longer where required) as evidence of compliance and decision-making.

8. Your rights (data subject rights)

Subject to applicable law, you may have the right to:

Access your personal data
Rectify inaccurate data
Erase data (deletion) in certain circumstances
Restrict processing in certain circumstances
Object to processing based on legitimate interests
Data portability (where applicable)
Withdraw consent (where we rely on consent)
Complain to a supervisory authority (for the UK, the ICO)

If you are unhappy with how we handle your data, we encourage you to contact us first so we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO): https://ico.org.uk .

9. Data deletion requests and how we track them

To request deletion (erasure) or exercise other rights, use:

hello@outliertechnology.co.uk

Our approach:

We verify identity where appropriate (to prevent unauthorised disclosure or deletion).
We assess the request against legal and contractual requirements (for example, we may need to retain certain records for legal obligations).
We respond within required timeframes (typically within one month, and sooner where practical).
We track and log requests in a restricted-access Data Subject Request (DSR) log, including receipt date, request type, decision, and completion date.

10. Direct marketing

We do not send direct marketing communications unless we have a lawful basis to do so (for example where you have requested information, or where you have consented and you can opt out at any time).

If you receive email from us and want to stop, reply to the message or email hello@outliertechnology.co.uk .

11. Automated decision-making

We do not use your personal data for solely automated decision-making (including profiling) that produces legal or similarly significant effects.

12. Stakeholder rights and obligations (ISO 42001)

We aim to address stakeholder rights and obligations explicitly:

Customers: we treat business contact data confidentially, use it only for legitimate service/business purposes, and align with client instructions when working in client-controlled environments.
Regulators: we maintain privacy governance, respond to lawful requests, and retain appropriate evidence (for example DSR logs).
Society: we minimise personal data use, avoid unnecessary collection, and support safe, lawful, and responsible use of technology (including any AI-related activities) consistent with applicable laws and contractual commitments.

13. Changes to this notice

We keep this notice under review and update it promptly when our practices change (target: within 30 days of any significant change). The “Last updated” date above shows the current version.

Terms of Service: https://outliertechnology.co.uk/terms
Data subject requests (including deletion requests): hello@outliertechnology.co.uk