Privacy Policy

Last updated: 8 April 2026

This Privacy Policy explains how Still Water Runs Free Limited ("we", "us" and "our") collects, uses, stores and protects your personal data when you visit our website, contact us, enquire about our services, or otherwise interact with us.

We are committed to handling personal data in accordance with applicable data protection law, including the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation where applicable ("GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations ("PECR").

1. Who we are

For the purposes of data protection law, the data controller is:

Still Water Runs Free Limited
4 Hale Avenue
Cambridge
CB4 3ET

If you have any questions about this Privacy Policy or want to exercise your data protection rights, please contact us via our Contact Page or write to us at the address above.

2. What this policy covers

This Privacy Policy applies to personal data collected through this website and through related communications with us, including enquiries about our services.

Our website may contain links to third-party websites or services. If you follow a link to another website, please note that we are not responsible for that third party's privacy practices, content or security. You should review their own privacy policy before providing personal data to them.

3. The personal data we may collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

  • Identity data, such as your name;
  • Contact data, such as your email address, telephone number, postal address, and any other contact details you provide;
  • Business data, such as your company name, role, organisation details, and information relating to your event, campaign or enquiry;
  • Enquiry and correspondence data, including the content of messages, form submissions, emails, and records of communications with you;
  • Technical data, such as IP address, browser type, device information, operating system, and website usage information;
  • Marketing and preference data, such as your communication preferences, consent choices, and cookie preferences;
  • Campaign or interaction data, where relevant, including information relating to how you interact with linked content, marketing activations, QR-enabled experiences, or related digital engagement tools.

We only collect personal data that is relevant and proportionate to the purposes described in this policy.

4. How we collect your personal data

We may collect personal data:

  • directly from you, for example when you contact us, submit an enquiry, or otherwise communicate with us;
  • automatically when you use the website, including through server logs, cookies and similar technologies;
  • from publicly available sources or trusted third parties where this is lawful and relevant to your enquiry or our services.

5. How we use your personal data and our lawful bases

We will only process your personal data where we have a valid lawful basis to do so. Depending on the circumstances, we may use your personal data for the following purposes:

  • To respond to enquiries and communicate with you - this is usually necessary for our legitimate interests in running and promoting our business, and in some cases to take steps at your request before entering into a contract.
  • To provide services or manage a client relationship - this is necessary for the performance of a contract, or to take steps before entering into a contract.
  • To administer our business, website and records - this is necessary for our legitimate interests in operating our business efficiently and securely.
  • To improve our website, services and user experience - this is based on our legitimate interests, and where cookies or similar technologies are not strictly necessary, on your consent.
  • To send marketing communications - where required by law, we will do this only with your consent. In limited business-to-business contexts, we may rely on our legitimate interests where permitted by law, and you can opt out at any time.
  • To monitor website use, performance and engagement - where this involves non-essential cookies or similar technologies, we rely on your consent.
  • To comply with legal and regulatory obligations - this is necessary to comply with our legal obligations.
  • To establish, exercise or defend legal claims - this is necessary for our legitimate interests and, where applicable, to comply with legal obligations.

Where we rely on legitimate interests, those interests include operating, protecting and improving our business, website, services and communications in a way that is proportionate and respectful of your rights.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

6. If you do not provide personal data

You are not generally required to provide personal data in order to browse our website. However, if you choose not to provide information that is needed for us to respond to your enquiry, provide services, or comply with legal obligations, we may not be able to assist you fully.

7. Sharing your personal data

We may share personal data, where necessary and lawful, with the following categories of recipients:

  • our employees, contractors and professional advisers;
  • service providers who help us operate our website, communications, IT systems, hosting, security, analytics, marketing, administration or business operations;
  • subcontractors or partners where this is necessary to provide services you have requested;
  • regulators, law enforcement bodies, courts, government authorities or other third parties where required by law or where necessary to protect our legal rights.

We require third parties processing personal data on our behalf to do so only on our instructions, to keep it secure, and to use it only for lawful purposes.

We may also share aggregated or anonymised information that does not identify individuals.

8. International transfers

Some of our service providers may process personal data outside the UK or European Economic Area.

Where personal data is transferred internationally, we will take appropriate safeguards as required by law. These may include relying on an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or other lawful transfer mechanisms.

9. How long we keep your personal data

We will not keep personal data for longer than is necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

As a general guide:

  • Enquiry data may be kept for up to 24 months after your last meaningful contact with us;
  • Client and contract-related data may be kept for the duration of the relationship and for up to 24 months afterwards, where appropriate;
  • Marketing data may be kept until you unsubscribe, opt out, or withdraw consent, after which we may keep limited suppression information to ensure your preferences are respected;
  • Financial, invoicing and tax-related records may be kept for up to 6 years, or longer where required by law;
  • Technical and website usage data may be retained for reasonable periods consistent with security, troubleshooting, performance and compliance needs.

We may retain data for longer where necessary to establish, exercise or defend legal claims, or to comply with legal obligations.

10. Security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

However, no method of transmission over the internet or method of electronic storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

11. Cookies and similar technologies

Our website uses cookies and similar technologies. Some are strictly necessary for the website to function, while others are used only with your consent.

For full details of the cookies and similar technologies we use, the purposes for which we use them, the legal bases that apply, and how to manage your preferences, please see our Cookie Policy.

You can also review or change your cookie preferences at any time by clicking the floating "Privacy Settings" icon at the bottom left of any page on the website.

12. Marketing communications

If you opt in to receive marketing from us, we may use your contact details to send you updates about our services, campaigns, opportunities or related news.

You can unsubscribe or opt out of marketing communications at any time by using the unsubscribe link in the message where available, adjusting your preferences, or contacting us through our Contact Page.

13. Your data protection rights

Subject to applicable law, you have the right to:

  • be informed about how your personal data is used;
  • request access to the personal data we hold about you;
  • request correction of inaccurate or incomplete personal data;
  • request erasure of your personal data in certain circumstances;
  • request restriction of processing in certain circumstances;
  • object to processing carried out on the basis of legitimate interests or for direct marketing;
  • request portability of personal data where applicable;
  • withdraw consent at any time where processing is based on consent;
  • raise concerns about automated decision-making and profiling where applicable under law.

To exercise any of these rights, please contact us via our Contact Page. We may need to verify your identity before responding to your request.

14. Complaints

If you are unhappy with how we handle your personal data, we would appreciate the opportunity to address your concerns first. Please contact us using the details above.

You also have the right to lodge a complaint with the Information Commissioner's Office ("ICO") in the UK. Further information is available at https://ico.org.uk/.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulation, guidance, technology, our business practices, or the way our website operates.

Any changes will be posted on this page and will take effect from the updated date shown at the top of this policy.