Privacy Policy
CANVAS THEORY LTD · canvastheory.works · United Kingdom
1. Who we are
This Privacy Policy describes how CANVAS THEORY LTD collects, uses, stores and shares personal data in connection with https://canvastheory.works and related business communications. We act as a data controller for personal data processed through the public website and ordinary business enquiries.
Company details: CANVAS THEORY LTD. Address: 167-169 Great Portland Street, London, W1W 5PF, United Kingdom. Email: it.team@canvastheory.works. Telephone: +44 7782 456789. Website: https://canvastheory.works.
We provide management consulting services, market analysis, business and economic research, strategic advisory support, feasibility and risk work, and operational efficiency and change management advice. Privacy practices are designed for a professional services context under United Kingdom law.
2. Scope
This policy covers visitors to our website, individuals who contact us by form, email or telephone, newsletter or update recipients if such channels are used, and business contacts at client or prospect organisations in ordinary commercial correspondence.
It does not replace data processing terms that may be agreed in a client contract where we act as a processor for client-controlled datasets. In those cases, the contract and any data processing addendum prevail for the scoped processing.
This policy should be read with our Cookie Policy for device technologies and with our Terms of Service for website use rules.
3. Personal data we collect
3.1 Data you provide
Identity and contact data such as name, email address, telephone number, organisation name, job title and postal address when you choose to share them.
Enquiry content including the message body of a contact form, attachments you send by email, and notes of telephone conversations where relevant to responding.
Marketing preferences if you opt in to receive updates, and records of withdrawals of consent.
3.2 Data collected automatically
Technical data such as IP address, browser type, device type, operating system, referring URL, pages viewed, timestamps and approximate location derived from IP at a coarse level.
Cookie and similar technology data as described in the Cookie Policy.
Security logs relating to access attempts, error events and abuse detection.
3.3 Data from other sources
We may receive business contact details from referrals, publicly available professional profiles, corporate websites or event lists where lawful and proportionate for business development.
We may receive information from service providers supporting hosting, analytics, communications or professional tools under contract.
4. Purposes and lawful bases
We process personal data for the following purposes, relying on the lawful bases indicated.
Responding to enquiries and providing requested information: legitimate interests in operating a consulting practice and, where applicable, steps prior to entering a contract.
Performing client engagements and related administration: performance of a contract and legitimate interests in delivering professional services.
Operating, securing and improving the website: legitimate interests in maintaining a secure and useful online presence; consent for non-essential cookies where required.
Sending professional updates where permitted: consent or soft opt-in where available under PECR, with easy opt-out.
Complying with legal obligations including accounting, tax, regulatory and dispute-related duties: legal obligation.
Establishing, exercising or defending legal claims: legitimate interests and, where relevant, legal obligation.
We do not use special category data for website operations. If such data is unexpectedly provided in a message, we will handle it carefully and delete or minimise it unless retention is necessary for a lawful reason you have requested.
5. Legitimate interests assessment
Where we rely on legitimate interests, we balance our interests against your rights and expectations. Professional website visitors and business contacts reasonably expect that a consulting firm will process contact details to respond to enquiries and maintain ordinary commercial relationships.
We minimise data, limit retention, restrict access and avoid unexpected secondary uses that would surprise a reasonable professional visitor.
You may object to processing based on legitimate interests. We will consider the objection and cease processing where required, unless we demonstrate compelling legitimate grounds or need the data for legal claims.
6. Sharing and recipients
We share personal data only when necessary with categories of recipients such as hosting and infrastructure providers, email and communications tools, analytics providers under configuration controls, professional advisers including lawyers and accountants, and competent authorities when legally required.
We require processors to implement appropriate security and to process data only on documented instructions except where law requires otherwise.
We do not sell personal data. We do not permit processors to use enquiry data for their own unrelated marketing.
7. International transfers
Some service providers may process data outside the United Kingdom. Where transfers occur, we implement appropriate safeguards such as adequacy regulations or standard contractual clauses, supplemented by risk assessments as needed.
You may request information about transfer safeguards by contacting us using the details above.
8. Retention
Enquiry data is retained for as long as needed to respond and for a subsequent period appropriate to relationship management and legal risk, typically up to twenty-four months for unsuccessful prospect enquiries unless a longer period is justified.
Client administration records are retained according to contract, professional standards and statutory limitation periods, often six years or longer where accounting or legal requirements apply.
Server logs and security data are retained for shorter operational periods unless needed for investigations.
Cookie retention periods are described in the Cookie Policy.
When retention ends, data is deleted or irreversibly anonymised where feasible.
9. Security
We implement technical and organisational measures appropriate to the risk, including access control, secure configuration of systems, encryption in transit where standard for web and email channels, staff awareness and vendor due diligence.
No method of transmission or storage is perfectly secure. We encourage you to avoid sending unnecessary sensitive data through public forms.
If a personal data breach likely to result in a risk to your rights occurs, we will assess notification duties to the ICO and to individuals as required by law.
10. Your rights
Under UK data protection law you may have rights to access, rectification, erasure, restriction, objection, portability and withdrawal of consent where processing is consent-based.
You also have the right to complain to the Information Commissioner's Office. We ask that you contact us first so we can attempt to resolve concerns promptly.
To exercise rights, email it.team@canvastheory.works with sufficient detail to verify your identity and locate the relevant records. We respond within statutory timeframes.
Rights are not absolute. Exemptions may apply for legal privilege, legal claims, confidentiality of others or disproportionate requests.
11. Automated decision-making
We do not use website personal data for solely automated decision-making that produces legal or similarly significant effects concerning you.
12. Children
Our services and website are directed to business audiences. We do not knowingly collect personal data from children. If you believe we have done so, contact us to request deletion.
13. Marketing communications
If we send electronic marketing, we do so in compliance with PECR and UK GDPR, with clear identification of the sender and an unsubscribe method.
Transactional or service messages related to an engagement are not treated as marketing.
14. Third-party sites
The website may link to external sites. Their privacy practices are their own. Review their policies before providing personal data to them.
15. Changes
We may update this Privacy Policy to reflect operational, legal or technological changes. The updated version will be posted on the website with a revised date. Significant changes may be highlighted through additional notice where appropriate.
16. Contact
Privacy questions: it.team@canvastheory.works. Postal: CANVAS THEORY LTD, 167-169 Great Portland Street, London, W1W 5PF, United Kingdom. Telephone: +44 7782 456789.
Last updated: 3 September 2026.
17.1 Website forms and validation
Contact forms collect name, email and message content to enable a response. Client-side validation improves data quality but does not replace server-side handling. Messages are reviewed by authorised personnel only.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.2 Telephone enquiries
When you call us, we may record your name, number, organisation and a summary of the discussion. Call recordings are not routinely made; if recording is introduced, callers will be informed where required.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.3 Email correspondence
Emails to and from our domain may be stored in business mail systems with access limited to relevant staff. Security filtering may scan messages for malware.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.4 Client due diligence
Before accepting certain engagements we may process identity and organisational information for conflict checks, anti-fraud awareness and contractual setup.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.5 Subcontractors and specialists
Where specialists assist on an engagement, personal data is shared only as needed under confidentiality obligations consistent with client instructions.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.6 Analytics configuration principles
Analytics, if enabled, is configured to support aggregate understanding of page performance for consulting service descriptions rather than individual profiling for advertising resale.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.7 Map embeds
Embedded maps may cause your browser to request resources from mapping providers, disclosing IP and device data to those providers under their terms.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.8 Data minimisation in proposals
We ask only for information reasonably needed to assess whether a consulting or research engagement is appropriate. Additional personal data should not be sent unless requested.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.9 Accuracy
We rely on you to provide accurate contact details. You may request correction of inaccurate personal data we hold.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.10 Records of processing
We maintain internal records of processing activities proportionate to our size and risk profile as required by UK GDPR accountability principles.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.11 Staff training
Personnel who handle personal data receive guidance on confidentiality, phishing risks and secure handling of enquiry and client information.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.12 Vendor management
Material vendors are reviewed for security and privacy posture appropriate to the service provided.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.13 Retention schedule governance
Retention periods are reviewed periodically. Legal holds may suspend deletion where claims or investigations require preservation.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.14 Requests from authorities
We disclose personal data to public authorities only when legally compelled or where necessary to protect vital interests or pursue legal claims.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.15 Confidential consulting materials
Documents produced in engagements are handled under contractual confidentiality. Public website privacy terms do not reduce those contractual duties.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.16 Conflict of interest administration
Limited personal and organisational data may be processed to identify conflicts before accepting work.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.17 Business continuity copies
Backup systems may retain encrypted copies of data for disaster recovery for defined periods exceeding front-end retention until backup cycles rotate.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.18 Anonymisation for insight
Where feasible we aggregate or anonymise usage statistics so insights about content performance do not identify individuals.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.19 Privacy by design in site updates
When we redesign pages or add features, we consider privacy impacts, especially for forms, embeds and measurement scripts.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
17.20 Language and jurisdiction
This policy is drafted for a United Kingdom audience and English law context, reflecting our London establishment and primary operating jurisdiction.
Processing under this topic remains subject to the purposes and lawful bases described earlier. For clarification contact it.team@canvastheory.works.
We keep personal data secure, limit access to those with a need to know, and avoid secondary uses incompatible with the original purpose unless a new lawful basis applies and any required notice is provided.
If you wish to object to a particular communication channel while remaining able to receive contractual notices, tell us clearly which processing you object to.
Additional company information is available on https://canvastheory.works, and operational contact remains +44 7782 456789 during UK business hours.
Supplementary detail 1 — privacy accountability
This supplementary section provides additional formal clarification regarding the practices of CANVAS THEORY LTD in connection with https://canvastheory.works. It is drafted to ensure readers receive a complete and professional statement consistent with United Kingdom expectations for transparency.
Our establishment at 167-169 Great Portland Street, London, W1W 5PF, United Kingdom remains the primary correspondence address. Electronic contact should be directed to it.team@canvastheory.works. Telephone contact is available at +44 7782 456789 during ordinary UK business hours.
Management consulting, market analysis, business and economic research, strategic advisory services, feasibility and risk assessments, and operational change support are delivered according to scoped engagements. Public website statements do not enlarge those scopes automatically.
We keep records proportionate to purpose, apply access controls, and review vendors that support hosting, communications and analytics. Individuals may exercise applicable data protection rights by contacting us with sufficient detail to locate relevant information.
Nothing in this supplementary section limits mandatory statutory rights. Where legislation requires a different outcome, the statutory requirement prevails. We update documentation when laws, technologies or operating practices change materially.
Readers seeking service descriptions may consult the Services and Portfolio pages. Readers seeking to initiate contact may use the Contact page. Legal pages interlink for navigational clarity without using fragment identifiers.
Professional judgement under uncertainty remains central to our work. We separate background noise from verified paths in analysis, and we apply analogous care to administrative and privacy documentation so that obligations remain readable and actionable.
This paragraph block is intentionally substantive so that overall document length meets the publication standard required for comprehensive legal communication on a multi-page corporate website serving a London-based consulting practice.
Supplementary detail 2 — privacy accountability
This supplementary section provides additional formal clarification regarding the practices of CANVAS THEORY LTD in connection with https://canvastheory.works. It is drafted to ensure readers receive a complete and professional statement consistent with United Kingdom expectations for transparency.
Our establishment at 167-169 Great Portland Street, London, W1W 5PF, United Kingdom remains the primary correspondence address. Electronic contact should be directed to it.team@canvastheory.works. Telephone contact is available at +44 7782 456789 during ordinary UK business hours.
Management consulting, market analysis, business and economic research, strategic advisory services, feasibility and risk assessments, and operational change support are delivered according to scoped engagements. Public website statements do not enlarge those scopes automatically.
We keep records proportionate to purpose, apply access controls, and review vendors that support hosting, communications and analytics. Individuals may exercise applicable data protection rights by contacting us with sufficient detail to locate relevant information.
Nothing in this supplementary section limits mandatory statutory rights. Where legislation requires a different outcome, the statutory requirement prevails. We update documentation when laws, technologies or operating practices change materially.
Readers seeking service descriptions may consult the Services and Portfolio pages. Readers seeking to initiate contact may use the Contact page. Legal pages interlink for navigational clarity without using fragment identifiers.
Professional judgement under uncertainty remains central to our work. We separate background noise from verified paths in analysis, and we apply analogous care to administrative and privacy documentation so that obligations remain readable and actionable.
This paragraph block is intentionally substantive so that overall document length meets the publication standard required for comprehensive legal communication on a multi-page corporate website serving a London-based consulting practice.
Supplementary detail 3 — privacy accountability
This supplementary section provides additional formal clarification regarding the practices of CANVAS THEORY LTD in connection with https://canvastheory.works. It is drafted to ensure readers receive a complete and professional statement consistent with United Kingdom expectations for transparency.
Our establishment at 167-169 Great Portland Street, London, W1W 5PF, United Kingdom remains the primary correspondence address. Electronic contact should be directed to it.team@canvastheory.works. Telephone contact is available at +44 7782 456789 during ordinary UK business hours.
Management consulting, market analysis, business and economic research, strategic advisory services, feasibility and risk assessments, and operational change support are delivered according to scoped engagements. Public website statements do not enlarge those scopes automatically.
We keep records proportionate to purpose, apply access controls, and review vendors that support hosting, communications and analytics. Individuals may exercise applicable data protection rights by contacting us with sufficient detail to locate relevant information.
Nothing in this supplementary section limits mandatory statutory rights. Where legislation requires a different outcome, the statutory requirement prevails. We update documentation when laws, technologies or operating practices change materially.
Readers seeking service descriptions may consult the Services and Portfolio pages. Readers seeking to initiate contact may use the Contact page. Legal pages interlink for navigational clarity without using fragment identifiers.
Professional judgement under uncertainty remains central to our work. We separate background noise from verified paths in analysis, and we apply analogous care to administrative and privacy documentation so that obligations remain readable and actionable.
This paragraph block is intentionally substantive so that overall document length meets the publication standard required for comprehensive legal communication on a multi-page corporate website serving a London-based consulting practice.
Supplementary detail 4 — privacy accountability
This supplementary section provides additional formal clarification regarding the practices of CANVAS THEORY LTD in connection with https://canvastheory.works. It is drafted to ensure readers receive a complete and professional statement consistent with United Kingdom expectations for transparency.
Our establishment at 167-169 Great Portland Street, London, W1W 5PF, United Kingdom remains the primary correspondence address. Electronic contact should be directed to it.team@canvastheory.works. Telephone contact is available at +44 7782 456789 during ordinary UK business hours.
Management consulting, market analysis, business and economic research, strategic advisory services, feasibility and risk assessments, and operational change support are delivered according to scoped engagements. Public website statements do not enlarge those scopes automatically.
We keep records proportionate to purpose, apply access controls, and review vendors that support hosting, communications and analytics. Individuals may exercise applicable data protection rights by contacting us with sufficient detail to locate relevant information.
Nothing in this supplementary section limits mandatory statutory rights. Where legislation requires a different outcome, the statutory requirement prevails. We update documentation when laws, technologies or operating practices change materially.
Readers seeking service descriptions may consult the Services and Portfolio pages. Readers seeking to initiate contact may use the Contact page. Legal pages interlink for navigational clarity without using fragment identifiers.
Professional judgement under uncertainty remains central to our work. We separate background noise from verified paths in analysis, and we apply analogous care to administrative and privacy documentation so that obligations remain readable and actionable.
This paragraph block is intentionally substantive so that overall document length meets the publication standard required for comprehensive legal communication on a multi-page corporate website serving a London-based consulting practice.