Privacy notice

Your details and the priority screen

Who we are

Hyphora Consulting Ltd is the controller of the personal data described here. We are registered in England and Wales, company number 12904446, registered office 126 Crampton Street, London, England, SE17 3AE. Hyphora is a trading name of Hyphora Consulting Ltd. Questions or requests go to Ben Hart at ben@hyphora.co.uk. This notice covers the priority screen; our main privacy notice covers everything else.

What we collect

• About you: first and last name, work email, job title and company.
• About your company: sector, size bands, sites (name, postcode, type, area band, water use and discharge answers), overseas countries, purchased commodities and sourcing countries, reporting status and who is asking you about nature.
• If you upload the spreadsheet, the file itself.
• Where you came from (UTM tags on the link you clicked), a one-way hash of your IP address for rate limiting, and whether you clicked the booking link in our email.

What we do with it, and the lawful basis

• To produce and send your screen: steps taken at your request, and our legitimate interest in responding to business enquiries.
• To email you once, about five working days after your screen is sent, to ask whether it was useful: our legitimate interest in following up a business enquiry. The email goes to the work address you gave us and has a one-click unsubscribe.
• To send our occasional update on nature and energy regulation, no more than monthly: only if you ticked the box (consent). You can withdraw at any time.
• To keep a record of you as a business contact in our CRM (Notion): legitimate interests.

Who else handles it

We don’t sell or share your details. These processors handle them for us:

• Vercel (hosting, file storage and analytics that use no cookies).
• Neon (database, hosted in London, UK: AWS eu-west-2).
• Resend (sending email).
• Notion (our contact records).
• Cloudflare Turnstile (spam check on the final step).
• postcodes.io (turns your site postcodes into map references; sent from our server, not your browser).

Some of these providers, including Vercel, Resend, Notion and Cloudflare, store or access data outside the UK, mainly in the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by the ICO’s International Data Transfer Agreement or Addendum.

How long we keep it

• Uploaded spreadsheets and site postcodes: deleted 90 days after your screen is sent (or after we tell you we couldn’t produce one). An uploaded spreadsheet that never becomes a request is deleted after a day.
• Your contact details and the PDF we sent: up to two years after our last contact, unless you ask us to delete them sooner, or six years if your organisation becomes a client.
• The download link in your email stops working after 14 days.

Cookies

This site sets no cookies for visitors. Your answers are kept in your browser’s session storage until you submit, so a refresh doesn’t lose them; closing the tab clears them.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to our use of it, or withdraw consent. Every email has a one-click unsubscribe. Email ben@hyphora.co.uk. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Last updated: 28 October 2026