Privacy Policy | Lantara

Introduction

This Privacy Policy explains how Lantara Ltd (“Lantara”, “we”, “us”, “our”) collects and uses personal data when you visit lantara.co.uk, contact us, or engage us for compliance services.

We take data protection seriously. As a UK compliance services business, we recognise that how we handle your data sets the standard we hold our own clients to.

Who we are

Lantara Ltd — a company registered in England and Wales
Company number: 16961099
ICO data protection registration: ZC189166
Registered office: 66 Paul Street, London, EC2A 4NA
Contact: drew@lantara.co.uk
Data Controller: Lantara Ltd is the data controller for all personal data described in this policy.

What data we collect

When you visit our site or contact us, we may collect:

Information you give us directly

Name, email address, phone number, company name (when you book an assessment or contact us)
Information about your business, products, and sales channels (during assessment calls and client engagements)
Communications you send us (emails, form submissions, messages)
Links to your online store or product listings, your product category, and your current UK selling status (when you request a Compliance Readiness Check)

Information collected automatically

Before you make a cookie choice, we collect none of this. No cookies are set and no analytics data is sent when you arrive on the site. The following is collected only if you accept analytics cookies:

Technical data: your IP address (Google uses it to derive an approximate location — country, region, city — and then discards it; we never see or store your full IP address), browser type and version, operating system, device type, screen size and language
Usage data: pages you visit, page titles, time on site, and how you arrived (referring site or search)
Cookies and similar technologies (see our Cookie Policy for details)

We do not use Google Analytics for advertising. Advertising features, ad personalisation and Google Signals are disabled, and no analytics data is used to build advertising profiles or shared with advertising networks.

Information from third parties

If you book a call through our scheduling tool (Calendly), we receive your name, email, and meeting details from that platform. The booking calendar only loads on our site if you have accepted cookies, or if you choose to open it yourself
LinkedIn profile information if you connect with us through that platform

Why we collect it and our legal basis

We process your personal data for the following purposes:

Purpose	Legal basis (UK GDPR)
Responding to enquiries and booking assessments	Legitimate interests / Steps before entering into a contract
Delivering our compliance services	Contract performance
Sending service-related communications	Contract performance
Sending marketing emails about regulatory updates and services	Consent (you can unsubscribe at any time)
Website analytics, to understand how the site is used and improve it	Consent (you can withdraw it at any time using the Cookie settings link in our footer)
Meeting our legal and regulatory obligations	Legal obligation
Detecting and preventing fraud or misuse	Legitimate interests

Marketing communications

If you opt in to our mailing list, we'll send you regulatory updates, guidance, and occasional information about our services. You can unsubscribe at any time by clicking the unsubscribe link in any email, or by emailing drew@lantara.co.uk. We keep a permanent record of unsubscribe requests to make sure we honour them.

Who we share it with

We do not sell your personal data. We share it only with:

Service providers who help us operate the business — including our website host (Webflow), our email provider (Google Workspace), our scheduling platform (Calendly) and our analytics provider (Google Analytics). These providers process data on our behalf under data processing agreements.
Professional advisers — accountants, solicitors, and insurers, where necessary.
Regulators and authorities — where legally required (e.g. HMRC, ICO, law enforcement).
Business successors — if Lantara is sold or merged, personal data may transfer to the new owner.

International transfers

Some of our service providers (including Webflow, Google and Calendly) may store data outside the UK, typically in the EU or the United States. Where data is transferred outside the UK, we rely on:

UK adequacy decisions, where available
The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses
Other appropriate safeguards as required by UK GDPR

How long we keep it

Prospect enquiries (not converted to clients): 24 months from last contact
Client records: 7 years after the end of our engagement, in line with UK tax and accounting record-keeping requirements
Marketing consent records: until you unsubscribe, plus a permanent record of the unsubscribe request
Website analytics: event data 2 months; user-level data 14 months from your last visit, restarting if you visit again. Aggregated reporting totals contain no identifiers and are kept for longer.

Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete data
Erase your data (in certain circumstances)
Restrict how we process your data
Object to processing based on legitimate interests
Data portability — receive your data in a machine-readable format
Withdraw consent at any time, where consent is our legal basis. For website analytics you can do this instantly using the Cookie settings link in our footer
Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email drew@lantara.co.uk. We'll respond within one month, as required by UK GDPR.

Security

We protect your personal data through:

Encrypted data transmission (HTTPS across the site)
Access controls — only authorised personnel can access client data
Regular security reviews of our systems and third-party providers
Breach notification procedures in line with UK GDPR (72-hour regulator notification where required)

Children

Our services are directed at businesses, not individuals under 18. We do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll update the “Last updated” date at the top. Significant changes will be communicated to clients directly.

Contact us

Questions about this Privacy Policy or your data:

Email: drew@lantara.co.uk
Post: Lantara Ltd, 66 Paul Street, London, EC2A 4NA, United Kingdom

If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) — website: ico.org.uk, helpline: 0303 123 1113.