top of page

Privacy Policy

This Privacy Policy applies to the website (“website”), operated by Beneath The Surface, Joanna Williams Consulting Ltd, 49 Peter Street, Manchester, M2 3NG, UK. 

Where we manage personal data, we identify as a Data Controller and recognise and act on our obligations under applicable data protection law, including but not limited to the EU General Data Protection Regulation and the Data Protection Act 2018. 

For any issues relating to data protection the person responsible is Joanna Williams. You can contact us in relation to data protection matters by email to


Your acceptance of this Privacy Policy is deemed to occur upon your first use of the website. 


Beneath the Surface recognises the trust you place in us when you share personal data with us. We are committed to being open, honest and transparent with our use of personal data.

This Privacy Policy provides you with details of the personal data we collect when we engage with you via our website, how we will use and look after your personal data, your privacy rights and how the law protects you. We will take all reasonable steps to ensure that personal data is safeguarded and kept in accordance with applicable data protection law. 


Personal data is any information relating to an identified or identifiable individual. It does not include data where the identity has been removed (i.e. anonymous data). We may collect, use, store and transfer different kinds of personal data about you when we engage with you. This may include: 

(a) Identity Data – title, first name, last name, date of birth or similar identifiers. If you interact with us through social media, this may include your social media username; 

(b) Contact Data – billing address, email address and telephone numbers; 

(c) Technical Data – includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to access the website; 

(d) Usage Data – information about how you use our website and services; 

(e) Marketing and Communications Data – includes your preferences in receiving marketing from us and your communication preferences. 


We use different methods to collect data from and about you, through: 

  • Using ‘Contact Us’ on the website

  • Registration

    • We collect details of a user’s name, email and phone number as well as subject and content of any message when using our online contact form to get in touch. This information enables us to communicate with our clients, suppliers and third parties and facilitates our service provision. We may process personal data on the basis of being legitimate to our business or in order to fulfil a contractual obligation in relation to our services. 

  • Emails

    • We retain copies of emails sent to us and any personal data will be held in accordance with this Privacy Policy on the basis of being legitimate to our business interests. 

  • Other direct interactions

    • You may give us your data by filling in forms or by corresponding with us face-to-face, by post, when attending any events, training, talks or workshops we hold, or through our social media channels. This includes personal data you provide when you: register to receive our services; make enquiries or request information be sent to you; use our services; ask for information to be sent to you; engage with us on social media; contact us directly; or leave comments or reviews on our services. 

  • Visits to our website

    • When you visit our website, we do not attempt to identify you as an individual user, and we will not collect personal data about you unless you specifically provide this to us. 

    • As you interact with our website, technical data may be automatically processed through the use of Cookies, details of which are explained in our Cookie Policy. 


Our website uses 'cookies' which we do not use to identify an individual. A cookie is a small text file which is placed onto your device (eg computer, smartphone or other electronic device) when you use our website. These help us recognise you and your device and store some information about your preferences.

Consent to use cookies and changing settings

We will ask for your consent to place cookies or other similar technologies on your device, except where they are essential for us to provide you with a service that you have requested (e.g. essential cookies to enable you to complete a contact form).

You can withdraw any consent to the use of cookies or manage any other cookie preferences by using the tools on any page of our website and/or interacting with our cookies banner. You can then adjust your settings as appropriate. It may be necessary to refresh the page for the updated settings to take effect. We do not pass on information gathered from these cookies to any third party.


Our website may contain links to other sites. We are not responsible for the privacy practices within any of these other sites. We encourage you to be aware of this when you leave our site and to read the privacy statements on other websites you visit.


UK data protection law requires us to have a “legal basis” for processing personal data. The legal bases we rely on are: 

  • Performance of a contract we are about to enter into or have entered into with you; 

  • Compliance with a legal or regulatory obligation; 

  • Carrying out activities that are legitimate to our business interests; 

  • Consent. However, generally, we shall not rely on consent as a legal basis for processing your personal data other than where the law requires it. Where our legal basis is consent, you have the right to withdraw consent any time. 

Detailed list of the reasons for us using personal data.

Use of personal data Type of data Legal basis Online registration: 

(a) Identity 

(b) Contact

Necessary to comply with a legal obligation to administer and improve the website 

(e) Technical (h) Usage 

It is in our legitimate interests to develop and improve our products and services, so that we can continue to provide products and services that our customers want to use, and to make sure we continue to be competitive


To send email notifications which have been specifically requested 

(a) Identity (b) Contact 

It is in our legitimate interests to give you information about our products and services that you may be interested in To send marketing communications, where expressly agreed eg newsletters; 

(a) Identity (b) Contact (i) Marketing and Communications 

In the case of electronic marketing when we have your consent to do so. 

It is in our legitimate interests to better understand how our customers use our products and what changes we could make to improve them To ask for feedback or review 

(a) Identity (b) Contact 

It is in our legitimate interests to better understand how our customers use our products and what changes we could make to improve them


To deal with enquiries and complaints 

(a) Identity (b) Contact (e) Technical (h) Usage 

Your personal data is kept private and stored securely until a time it is no longer required or has no use. 



We don’t share, sell, or distribute your data to third parties. We may disclose your personal data if we are required to do so by law, in connection with any legal proceedings, and in order to establish, exercise or defend our legal rights, or if otherwise legally permitted. 

If you are a staff member of a Company purchasing our services we will not share your data or any other information with that Company except with your permission (extending service provision etc). 


We may carry out direct marketing by email, phone, text or post. We will ask for your consent to receiving marketing communications (including newsletters) when you register on the website and you have the option not to give consent and to withdraw consent given at any time.


You may withdraw your consent for us to contact you by email to . We may continue to contact you for non-marketing purposes if there is another lawful basis to do so. 

External links 

Clicking an external link will take the user away from our website. Once you leave our website we cannot guarantee or verify the contents of any externally linked website and users click on external links at their own risk.


We keep your personal data in accordance with our Data Retention Policy which reflects our needs to provide services to you as contracted and also as required to meet legal, statutory and regulatory obligations. The need to hold information is regularly reviewed and data will be disposed of when no longer required. 


Subject access requests 

You have the right to ask for a copy of the information that we hold about you by email to


Right to rectification 

Data subjects have the right to request that personal data is amended or changed if it is inaccurate or incorrect. We act on any such request without delay. 

Right to erasure 

Data subjects have the right to ask us to delete personal data from our systems without giving any reason and at any time. We act on any such request without delay. 


We reserve the right to change this Privacy Policy at any time and users are recommended to review it frequently. Changes will take effect immediately upon their posting on the website. You will be deemed to have accepted any changes to the terms of the privacy policy on your next visit of the website following the amendment. 


If you wish to raise a concern about the use of your personal data, you can contact us by email to Alternatively, you can formally raise a concern or complaint to the Information Commissioner’s Office (ICO), the UK regulatory authority for data protection: Address: Information Commissioner’s Office, Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone: 0303 123 1113 Website:

bottom of page