Who we are
Nine Stones is a trading style of Copy House Consulting Limited, a company registered in England and Wales and part of the Cohaesus Group. When this policy says "we", "us", or "our", that's who we mean.
We are the data controller for the personal data you share with us through this website and in the course of working together. That means we decide what data is collected and how it's used, and we're responsible for keeping it safe.
If you have any question about your data, or you want to exercise one of the rights set out below, write to us at hello@ninestones.co.uk and mark it for the attention of the data lead.
What we collect
We only collect what we need. In practice, that falls into three groups.
- Things you tell us Your name, company, email address, phone number, and anything else you share when you book a call, complete a form, or email us. If you become a client, this extends to the details we need to do the work and raise an invoice.
- Things we measure Standard analytics about how the site is used — pages visited, rough location, device and browser, and referring source. This is aggregated and used to improve the site, not to identify you personally.
- Things from cookies A small number of cookies and similar technologies, covered in section 07. Essential cookies keep the site working; the rest only run if you allow them.
We do not knowingly collect data from anyone under 18, and we don't collect special-category data unless you choose to share it with us directly.
How we use it
We use your data for a handful of clear purposes. Each one has a lawful basis under the UK GDPR.
- To reply to you When you get in touch, we use your details to answer, arrange a call, and follow up.Lawful basis Consent, or our legitimate interest in responding to an enquiry.
- To do the work If you're a client, we use your data to deliver the engagement, manage the account, and bill for it.Lawful basis Performance of our contract with you.
- To run the business Accounting, record-keeping, and meeting our legal obligations.Lawful basis Legal obligation, and our legitimate interest in running a sound business.
- To improve the site Aggregated analytics tell us what's useful and what isn't.Lawful basis Consent, given through the cookie banner.
Who we share it with
We don't sell your data. We never have, and we never will.
Your data is not a revenue line for us. We do share it, carefully, in a few limited situations:
- Trusted processors. The providers who help us run the business — email, analytics, scheduling, cloud hosting, accounting. Each is contractually bound to protect your data and to use it only on our instructions.
- The Cohaesus Group. As part of the group, we may share limited data within it where doing so helps us serve you. The same protections apply across the group.
- When the law requires it. We'll disclose data if we're legally compelled to — a court order, a regulator, or a genuine legal obligation. Never more than is required.
We will not share your Text message opt-in or consent status with any third party for purposes unrelated to providing the messaging service. We may share this data with vendors who help us deliver text messages, including platform providers and phone companies.
How long we keep it
We keep personal data only for as long as we have a reason to.
- Enquiry dataFor as long as we're in conversation, and a reasonable period afterwards.
- Client recordsFor the duration of the engagement, and as long afterwards as our legal and accounting obligations require — typically six years.
When data is no longer needed for any of these purposes, we delete it.
Where it's stored
We store data in the UK and the EEA wherever we can. If one of our providers processes data elsewhere, we make sure appropriate safeguards are in place — such as the UK's International Data Transfer Agreement or equivalent standard contractual clauses — as the UK GDPR requires.
Cookies
Some cookies keep the site working. The rest only run if you say yes.
Essential cookies make the site function and don't need consent. Analytics and marketing cookies — for example, the tools that tell us how the site is used or measure a campaign — only load once you've agreed through the cookie banner.
You can change your mind whenever you like, either through the banner or in your browser settings, where you can block or delete cookies entirely. Turning some off may change how parts of the site behave.
No tracking before you've said yes. That's the whole rule.
Your rights
Under UK data protection law you have the following rights. To use any of them, just email us — there's no charge, and we'll respond within one month.
- See itAsk for a copy of the personal data we hold about you.
- Correct itTell us if anything's wrong or out of date and we'll put it right.
- Erase itAsk us to delete your data where there's no good reason for us to keep it.
- Restrict or objectAsk us to pause certain uses, or object to processing based on legitimate interest.
- Take it with youAsk for your data in a portable format so you can move it elsewhere.
- Withdraw consentWhere we rely on consent, withdraw it at any time without affecting what came before.
Complaints
Come to us first — we'd always rather fix it directly. If you're unhappy with how we've handled your data, email hello@ninestones.co.uk and we'll look into it properly.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk — though we hope you'd give us the chance to put things right first.
Changes to this policy
We update this policy from time to time as the business and the law change. When we do, we'll update the "last updated" date at the top of this page. The latest version always lives here.
How to contact us
One inbox, a real person, and a reply inside a working day.