This notice covers aaronisaac.co.uk, the enquiry form at clients.aaronisaac.co.uk, and the documents clients send us during an engagement. Aaron Isaac Advisory is a trading name of The Shinobi Project Limited, which is the data controller.
The site itself is static: it sets no cookies, runs no analytics and loads nothing from third parties. The web server keeps standard access logs (IP address, requested page, browser type) for a short period for security and fault-finding, on the legal basis of legitimate interests.
When you send an enquiry we collect your name, your email address, a phone number if you give one, your organisation and what type it is, what you are enquiring about in your own words, who else is involved, any date it needs sorting by, and anything else you choose to tell us. We use it to reply to you with the engagement and the fee, on the legal basis that these are steps taken at your request before entering a contract.
The form is protected by Cloudflare Turnstile, which checks that the submission comes from a person and not a script. Turnstile processes your IP address and browser signals for that purpose only. This is necessary to keep the form open and is done on the legal basis of legitimate interests.
Enquiries are recorded in our practice system, which we run ourselves on a server hosted by Hetzner in Helsinki, Finland, within the EU. If no engagement follows, the enquiry is deleted twelve months after it was received.
Once an engagement is agreed in writing, you send us the documents the work needs: agreements, correspondence, constitutions, plans. They will contain personal data about you, the people in your organisation and the other parties. We process it to carry out the engagement, on the legal basis of our contract with you, and to keep a record of the advice given, on the legal basis of legitimate interests.
Documents are held in the matter record in our practice system, on the same hosting as above. Matter records, including the documents, are kept for six years after the engagement closes, which is the period within which a claim about the advice could be brought, and then deleted.
Our practice system holds these records on encrypted backups. The live disk of the server is not itself encrypted at rest; access to it is by key only, over a private network.
We keep your message and our reply for as long as the correspondence is live and for a reasonable period afterwards, so we can pick the thread up again. We do not add you to any list.
Hetzner (hosting and encrypted backup, Finland), Cloudflare (DNS, content delivery and the Turnstile check) and Migadu (email, Switzerland). We do not sell personal data and we do not share it with anyone else unless the law requires it.
The Shinobi Project Limited, registered in England and Wales, company number 15507524. Registered office: Office 1, Izabella House, 24–26 Regent Place, Birmingham B1 3NJ. Registered with the Information Commissioner's Office, number ZC071062.
You can ask what we hold about you, ask for it to be corrected or deleted, or object to our processing it, by writing to [email protected]. You can complain to the Information Commissioner's Office at ico.org.uk.
Last updated 11 September 2026.