Last updated: 23 October 2026
1. Who we are
Protea Consultancy (“Protea”, “we”, “us”) is the controller of the personal data described in this policy. We are a company registered in Scotland under company number SC840544, providing fractional contract, commercial, legal and supply chain services to the energy, project management, construction and engineering sectors.
This policy explains how we handle personal data when you visit www.protea-consult.com, contact us, request a consultation, sign up for updates, or work with us. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact for privacy matters: info@protea-consult.com · 329 North Deeside Road, Cults, Aberdeen
2. Personal data we collect
We collect only what we need to respond to you and deliver our services.
Contact details you give us when you email us, request a consultation, sign up for updates or engage us: name, job title, company, email address, phone number.
Enquiry details: the content of your messages and any information you share about your business or contracts.
Client and project information: contracts, documents and correspondence you provide during an engagement, which may include personal data about your staff, suppliers or counterparties.
Billing details: invoicing contact, company address and payment records. We do not store card details.
Technical data: IP address, browser and device type, pages visited and referring site, collected automatically when you use our website.
We do not knowingly collect special category data (such as health information). Please do not send it to us unless we have asked for it.
3. How we use your data and our lawful basis
UK GDPR requires a lawful basis for each use of personal data. Ours are:
Responding to enquiries and arranging consultations (contact and enquiry details): legitimate interests (responding to business enquiries) or steps before entering a contract.
Delivering our services (contact details, client and project information): performance of a contract; legitimate interests where the data relates to your staff or counterparties.
Invoicing, accounting and tax records (billing details): legal obligation.
Running, securing and improving our website (technical data): legitimate interests; consent where cookies require it.
Sending updates about our services and insights (name, email, company): legitimate interests for corporate contacts; consent where PECR requires it (for example, sole traders). Every email includes an unsubscribe link.
Establishing or defending legal claims (any relevant records): legitimate interests.
We do not sell your data or use it for automated decision-making that has legal effects on you.
4. Cookies and analytics
Our website is hosted on Framer, which uses strictly necessary cookies to load pages securely. We also use two analytics tools to understand how visitors use the site:
Framer Analytics measures page views, visits and referring sites. It is designed to report traffic without identifying individual visitors.
Google Analytics, provided by Google, uses cookies (such as _ga) to tell visits apart and show which pages are popular and how visitors found us. Google Analytics 4 does not store full IP addresses. We only turn it on once you accept analytics cookies.
Under the Privacy and Electronic Communications Regulations (PECR), we only set non-essential cookies, such as analytics or marketing cookies, with your consent. You can change your choice at any time through our cookie banner or by clearing cookies in your browser settings.
You can also opt out of Google Analytics on all websites with Google’s opt-out browser add-on. Google explains how it uses this data in its privacy policy.
5. Sharing, transfers, retention and security
Who we share data with. We share personal data only where needed, with:
service providers acting on our behalf, such as website hosting and analytics (Framer and Google Analytics), email and file storage, our mailing tool and accounting software;
professional advisers, such as accountants, lawyers and insurers;
associate consultants who work with us on your engagement, under confidentiality obligations;
regulators, courts or law enforcement where the law requires it.
Our service providers may only use your data on our instructions.
International transfers. Some providers store data outside the UK, including in the EU and the United States. Where this happens, we rely on UK adequacy regulations (including the UK–US data bridge for certified US companies such as Google) or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.
How long we keep data.
Enquiries that do not lead to an engagement: 2 years from last contact.
Client and project records: 6 years after the engagement ends.
Accounting and tax records: 6 years from the end of the financial year (Companies Act 2006 and HMRC rules).
Website analytics: up to 26 months.
We then delete or anonymise it.
Security. We use access controls, encryption in transit, secure cloud services and confidentiality obligations to protect your data. No system is fully secure, but we will notify you and the ICO of any serious breach where the law requires it.
6. Your rights and how to complain
Under UK data protection law you have the right to:
access the personal data we hold about you;
have inaccurate data corrected;
have your data erased in certain circumstances;
restrict or object to our use of your data, including for direct marketing;
receive your data in a portable format;
withdraw consent at any time, where we rely on consent.
To exercise any right, email info@protea-consult.com. We will respond within one month and will not usually charge a fee. We may ask you to confirm your identity first.
If you are unhappy with how we handle your data, please contact us first. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy. We may update this policy from time to time. The date at the top shows when it last changed.