Privacy Notice

Last updated 3 October 2026

This notice explains what personal data Tier 1 Elite collects, why, how long it is kept, and what rights you have. It is written to meet the transparency requirements of the UK GDPR and the Data Protection Act 2018.

Who is responsible for your data

Tier 1 Elite is a trading name of Simon Emberley, operating as a sole trader in Norwich, Norfolk, United Kingdom. Simon Emberley is the data controller for the purposes of UK data protection law.

Contact for any data protection question, including the requests described below: [email protected].

What this website collects

The website itself sets no cookies, runs no analytics software, embeds no social media widgets, and loads no third-party scripts for tracking or advertising. There is no consent banner because there is nothing to consent to.

The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical connection data — your IP address, the time of the request, the page requested, your browser type — in order to serve the page and to protect the service from attack and abuse. This is standard server logging, is handled by Cloudflare as our processor, and is retained by Cloudflare under their own retention periods. Cloudflare's privacy practices are set out at cloudflare.com/privacypolicy.

What we collect when you get in touch

If you use the enquiry form or email us, we receive the information you provide. Typically that is your name, your email address, your company name if you give it, and the content of your message.

What	Why	Lawful basis	Kept for
Name, email, company, message content	To respond to your enquiry and to carry on the conversation	Legitimate interests — responding to someone who has approached us about our services	24 months from last contact, then deleted
Contract, engagement and project correspondence	To deliver work you have engaged us for and to manage the relationship	Performance of a contract	6 years after the engagement ends, for tax, insurance and limitation-period reasons
Invoices and payment records	Accounting and tax compliance	Legal obligation	6 years, as required by HMRC
Findings and technical data from an assessment	To produce the report you commissioned	Performance of a contract	See the section below

Assessment and engagement data

If you engage Tier 1 Elite for an exposure assessment, security audit, AI and supply-chain review or resilience review, the work necessarily involves handling information about your business, and sometimes personal data about your staff — for example names and job titles found in publicly published sources, or account information identified during an internal review.

In that situation Tier 1 Elite acts as your processor: you decide what is assessed and we handle the data on your instructions, under a written agreement that sets out the scope, the security measures and the retention period before any work starts. Our standing practice is:

• Only data within the agreed scope is collected.
• Findings are held on encrypted storage and are not placed in any third-party tool that has not been agreed with you.
• Raw collected data is deleted within 30 days of the final report being delivered, unless you ask in writing for it to be retained for longer.
• The report itself is retained for 6 years alongside the engagement record, unless you instruct otherwise.
• Nothing about your business is used as a case study, reference or marketing example without your separate, specific, written agreement.

Who your data is shared with

We do not sell personal data and we do not share it for anyone else's marketing. Data is shared only with the service providers needed to run the business, and only to the extent needed:

• Cloudflare — website hosting and protection.
• Porkbun — domain registration and email forwarding for our address.
• Google (Gmail / Google Workspace) — email and document storage.
• Our accountant — invoices and financial records, where required for tax compliance.
• Named specialist subcontractors — only where a piece of commissioned work requires one, only under a written confidentiality and data processing agreement, and only with your knowledge.

We may also disclose information where we are legally required to, for example to a regulator, a court, or law enforcement acting under proper authority.

International transfers

Some of the providers above are US-based or operate global infrastructure, so your data may be processed outside the UK. Where that happens, the transfer is covered by the provider's own safeguards — the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework.

How your data is protected

Accounts are protected with unique passwords held in a password manager and multi-factor authentication where the provider supports it. Devices use full-disk encryption. Access to client material is limited to those who need it for the work in hand. No system is immune, and we would rather say that plainly than claim otherwise.

Your rights

Under UK data protection law you have the right to:

• be told what personal data we hold about you, and get a copy of it;
• have inaccurate data corrected;
• have data erased, where there is no overriding legal reason to keep it;
• restrict how we use your data while a dispute about it is resolved;
• object to processing we carry out on the basis of legitimate interests;
• receive your data in a portable, machine-readable form where it was provided to us and is processed by automated means;
• withdraw consent, where consent was the basis for the processing.

To exercise any of these, email [email protected]. We will respond within one month. There is no charge.

No automated decision-making or profiling is carried out that would have legal or similarly significant effects on you.

Marketing

We do not operate a marketing mailing list, and we do not add enquirers to one. If that changes, it will be on an opt-in basis and this notice will be updated before any such list is used.

Complaints

If you are unhappy with how your data has been handled, please raise it with us first — it is usually quicker to resolve directly. You also have the right to complain to the UK supervisory authority at any time:

Changes to this notice

If this notice changes materially, the date at the top will be updated. Where the change affects how we handle data we already hold about you, we will tell you directly.