Elmar Risk Management

Legal

Privacy Policy

Last updated: September 2026

1. Who We Are

This privacy policy applies to the website and services of Elmar Risk Management Ltd, a company registered in England and Wales (Company Number 15543528), based in Gloucester.

Elmar Risk Management Ltd is the data controller for the personal data collected through this website. You can contact us at:

2. What Personal Data We Collect

We collect personal data in the following ways:

Contact and enquiry forms

When you submit an enquiry or book a call via our website, we collect: your first and last name, your work email address, your company name, your message, and any other information you choose to provide. This data is submitted via Web3Forms and forwarded to our email address.

Newsletter subscriptions

If you choose to subscribe to our newsletter via the footer sign-up form, we collect your email address and record your consent. This data is submitted via Web3Forms.

AI Chat Assistant

When you use the AI chat assistant on this website, the messages you type are transmitted to Cloudflare Workers AI to generate a response. See Section 9 for full details.

Automatically collected data

This website is hosted on Cloudflare Pages. Cloudflare may process certain technical data automatically, including your IP address, browser type, and request metadata, as part of delivering the website and protecting against abuse. Cloudflare acts as a data processor on our behalf. Please refer to Cloudflare's privacy policy for details of how they handle this data.

We do not currently use any analytics tracking scripts or advertising cookies on this website.

3. How We Use Your Personal Data and Our Lawful Bases

Responding to enquiries

Purpose: To respond to your enquiry or booking request and provide the information you asked for. Lawful basis: Legitimate interests (our legitimate interest in responding to business enquiries).

Providing our services

Purpose: To deliver the compliance consultancy services you engage us to provide. Lawful basis: Contractual necessity.

Newsletter communications

Purpose: To send you updates on UK regulatory changes, ISO standards, and compliance topics you have signed up to receive. Lawful basis: Consent. You can withdraw your consent at any time by contacting us.

Legal and compliance obligations

Purpose: To comply with our legal obligations, including record-keeping requirements. Lawful basis: Legal obligation.

4. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected:

  • Enquiry and booking form data: Retained for up to 2 years from the date of your last contact with us, unless you become a client (in which case client retention periods apply).
  • Newsletter subscriber data: Retained until you withdraw consent or unsubscribe.
  • Client engagement data: Retained for up to 7 years following the end of the engagement, in line with standard business record-keeping requirements.

5. Who We Share Your Data With

We do not sell your personal data to third parties. We share data with the following processors only to the extent necessary to operate this website and deliver our services:

  • Web3Forms: Our contact and newsletter forms submit data to Web3Forms, which forwards submissions to our email address. Web3Forms acts as a data processor.
  • Cloudflare: Our website is hosted on Cloudflare Pages. Cloudflare processes certain technical data as part of delivering the website and protecting against attacks.
  • Cloudflare Workers AI: Messages sent via the AI chat assistant are processed by Cloudflare Workers AI to generate a response. See Section 9 for full details.

We may be required to disclose personal data to law enforcement or regulatory authorities if required by law.

6. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. This website is served over HTTPS and hosted on Cloudflare's secure infrastructure.

Please be aware that no method of transmission over the internet is completely secure, and we cannot guarantee the absolute security of data transmitted to us.

7. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right of access: You can request a copy of the personal data we hold about you (Subject Access Request).
  • Right to rectification: You can ask us to correct inaccurate personal data.
  • Right to erasure: You can ask us to delete your personal data in certain circumstances.
  • Right to restriction: You can ask us to restrict the processing of your personal data in certain circumstances.
  • Right to data portability: You can ask for your data in a structured, machine-readable format where technically feasible.
  • Right to object: You can object to processing based on legitimate interests.
  • Right to withdraw consent: Where processing is based on consent, you can withdraw consent at any time.

To exercise any of these rights, please contact us at info@elmarrisk.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been infringed.

8. Cookies and Local Storage

This website uses minimal local storage. We do not use advertising cookies, social media tracking pixels, or third-party analytics scripts.

The following items may be stored in your browser's localStorage:

  • elmar-popup-dismissed: Set when you close the newsletter sign-up popup on the homepage, to prevent it appearing again on future visits.
  • elmar-cookie-choice: Set when you make a choice on the cookie consent banner, to remember your preference.

For full details, see our Cookie Policy.

9. AI Chat Assistant

This website includes an AI-powered chat assistant. Any messages you send via the chat widget are transmitted toCloudflare Workers AI solely to generate a response in real time. Message content is not permanently stored, logged to any database, or used to train any AI model by Elmar Risk Management or by this website. Cloudflare processes the data as a data processor on our behalf, subject to their standard data processing terms.

The assistant is provided for general information about Elmar's services only and does not constitute professional advice. For detailed advice or a specific quote, please contact Peter directly.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, services, or applicable law. The date at the top of this page shows when the policy was last updated. For significant changes, we will take reasonable steps to notify you.

11. Contact

If you have questions about this privacy policy or how we handle personal data, please contact us: