Privacy & Cookie Policy

Last updated: 18 August 2026 | Version 2.2

This Privacy Notice explains how IllumiFi Advisory Ltd uses personal data when you visit our website, contact us, use our forms or tools, receive business communications from us, become a customer or supplier, or otherwise interact with our business.

1. Who we are

IllumiFi Advisory Ltd is registered in England and Wales under company number 16118269. Our registered office is 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. We provide data and analytics solutions, including analytics-as-a-service, data foundations and advisory support. We are registered with the Information Commissioner's Office (ICO) and pay the applicable data protection fee. For questions about this notice or our use of personal data, contact Nader Hosni at dataprotectionofficer@illumifiadvisory.co.uk.

2. Personal data we use

Depending on how you interact with us, we may use:

• your name, job title, employer and business contact details;
• professional information available from LinkedIn, company websites or other lawful public business sources;
• emails, meeting notes, enquiries, proposals, opportunities and other CRM relationship records;
• marketing preferences, opt-outs and suppression records;
• information you submit through HubSpot forms, meeting bookings or tools such as the Data Clarity Scorecard;
• website and technical information such as IP address, visitor/session identifiers, browser/device information, page paths, website interactions and permitted analytics or tracking data;
• billing, contract, supplier or recruitment information where relevant. We do not ordinarily seek special category personal data for our own sales, marketing or website activities.

3. Where we obtain personal data

We may obtain personal data:

• directly from you when you contact us, complete a form, book a meeting or enter into a business relationship;
• from your employer or another organisation with which you are associated;
• from publicly available professional and business sources, including LinkedIn and company websites;
• through referrals, introductions and networking;
• from approved lead-generation or business-development partners; and
• automatically through our website and digital services, using cookies and similar technologies where permitted.

4. Why we use personal data and our lawful bases

Purpose	Typical lawful basis
Enquiries, meetings and customer relationships	Legitimate interests; contract where Article 6(1)(b) applies; and legal obligation where relevant.
CRM and relevant B2B business development	Legitimate interests in developing our business, maintaining business relationships and communicating with appropriate business contacts.
Marketing communications	Legitimate interests where appropriate; consent where PECR or other applicable rules require it.
Website forms, meeting bookings and Data Clarity Scorecard	Legitimate interests, steps before contract or consent depending on the feature and purpose.
Business administration, suppliers, security and legal matters	Legitimate interests, contract and/or legal obligation depending on the activity.
Recruitment	Steps before contract, legitimate interests and legal obligation, as applicable.

5. B2B marketing and prospecting

We may contact people in their professional capacity about IllumiFi services where their role and organisation make the communication relevant. This can include professional information obtained from public sources such as LinkedIn or company websites, or leads introduced by an approved lead-generation partner. UK GDPR applies whenever we use a named business contact's personal data. We also comply with the Privacy and Electronic Communications Regulations (PECR). For corporate subscribers, unsolicited electronic B2B marketing can generally be sent without prior PECR consent, but we identify ourselves and provide a way to opt out. Where the recipient is a sole trader or another individual subscriber, we apply the stricter PECR rules. You can object to direct marketing at any time. If you do, we will stop using your personal data for direct marketing and may retain a minimal suppression record so that we do not contact you again inadvertently. You can opt out using any unsubscribe facility provided or by emailing privacy@illumifiadvisory.co.uk.

6. Who we share personal data with

Where necessary, we may share personal data with:

• authorised IllumiFi personnel and contractors;
• technology and cloud providers supporting our CRM, website, email, productivity, document management and security;
• professional advisers such as accountants, lawyers and insurers;
• approved suppliers and delivery partners;
• regulators, public authorities, law enforcement bodies or courts where required or permitted by law; and
• parties involved in a potential business sale, investment or corporate transaction, subject to appropriate safeguards. Our main business systems currently include HubSpot for CRM, website hosting, forms, meeting bookings, marketing functionality, website analytics and organisation-level visitor identification (Buyer Intent), and Microsoft 365 for email, cloud productivity and collaboration.

7. International transfers

Some service providers operate internationally. Where personal data is transferred outside the UK and the transfer is restricted under UK data-protection law, we use an appropriate lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another permitted safeguard, together with any required transfer-risk assessment.

8. Security

We use proportionate technical and organisational measures to protect personal data, including appropriate access controls, multi-factor authentication, secure cloud services, confidentiality requirements and incident-response procedures.

9. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of legal, contractual and business requirements.

• Prospect and marketing CRM records are ordinarily reviewed for removal after two years without meaningful contact, subject to any continuing lawful need and minimal suppression records.
• Customer and supplier relationship records may be retained for up to seven years after the relationship ends where required for contractual, tax, accounting or legal reasons.
• Contracts and related legal records may be retained for up to seven years, or longer where a specific requirement applies.
• Unsuccessful recruitment records are ordinarily retained for six months after the candidate is notified.
• Website analytics and cookie data are retained in accordance with the relevant technology settings and our Cookie Notice.

10. Your rights

Depending on the circumstances, you may have rights to access your personal data, correct it, ask us to delete or restrict it, object to processing, receive certain data in a portable format, withdraw consent where we rely on consent, and obtain safeguards relating to solely automated decisions. You have an absolute right to object to the use of your personal data for direct marketing. To exercise your rights, email dataprotectionofficer@illumifiadvisory.co.uk. We may need to verify your identity. We normally respond without undue delay and within one month, subject to the extensions permitted by law in appropriate circumstances.

11. When we process personal data for clients

Some IllumiFi analytics engagements involve personal data supplied by a client. Where the client determines why and how that data is processed, the client is the controller and IllumiFi acts as its processor under the relevant agreement and documented instructions. Requests relating to that client-controlled data should normally be directed to the client.

12. Cookies and similar technologies

Our website uses cookies and similar technologies. Strictly necessary technologies may operate without consent where permitted by law. Where consent is required, non-essential technologies - including Google Analytics, HubSpot website analytics/Buyer Intent and Flowd organisation-level visitor identification - are only enabled after the visitor grants consent through our website controls. See our Cookie Notice for more information.

13. Complaints and changes to this notice

If you have concerns about how we use your personal data, please contact us first so that we can investigate. You also have the right to complain to the Information Commissioner's Office (ICO). We update this Privacy Notice when our services, systems, suppliers or processing activities materially change. The date at the top of the notice identifies the current version.

Cookie notice

Last updated: 19 August 2026 | Version 1.2

This Cookie Notice explains how IllumiFi Advisory Ltd uses cookies and similar website technologies on www.illumifiadvisory.co.uk. It should be read alongside our Privacy Notice.

1. What we use

Our website uses a small number of cookies and similar technologies to keep the site secure, remember your privacy choice, understand how the website is used, measure page and form interactions, and identify the organisation associated with a website visit. Some technologies store information on your device, while others send information from your browser without setting a cookie. We apply the same consent approach to non-essential tracking technologies.

2. Your choices

When you first visit the website you can choose Accept or Decline, or open Cookies settings to choose category by category. Strictly necessary technologies operate without consent because they are required for security or to remember your privacy choice. Non-essential analytics and visitor-identification technologies are only enabled after you accept them. You can change or withdraw your choice at any time using the Cookie settings control in the website footer, which reopens the banner. Withdrawing consent does not affect processing that took place before you withdrew it.

The banner shows a standard set of categories: strictly necessary, analytics, advertisement and functionality. HubSpot's consent interface includes an Advertising category. IllumiFi does not currently use advertising cookies, advertising pixels or advertising tags. The category remains visible so visitors can make an explicit category-level choice rather than giving broader consent for advertising technologies that IllumiFi does not use.

3. Technologies used on this website

Technology / name	Provider	Purpose	Type / category	Duration
__cf_bm	Cloudflare	Helps protect the website against automated or abusive traffic.	Strictly necessary cookie	About 30 minutes
_cfuvid	Cloudflare	Supports request-rate management and website security.	Strictly necessary cookie	Session
__hs_cookie_cat_pref	HubSpot	Records which consent categories you chose on the cookie banner, so your choice is remembered.	Strictly necessary cookie	6 months
__hs_do_not_track	HubSpot	Set if you decline analytics. It tells HubSpot's tracking code not to send any data about your visit, including the anonymous page counts it would otherwise still send.	Strictly necessary cookie	6 months
Google Analytics 4	Google	Measures website usage and engagement so we can understand and improve the site.	Analytics / non-essential	When consent is granted, GA4 may set _ga and _ga_<container-id> cookies for up to 2 years
__hstc	HubSpot	Main HubSpot visitor-tracking cookie. Records visit/session history and supports website analytics.	Analytics / non-essential	6 months
hubspotutk	HubSpot	Visitor identity token used for visitor recognition, form attribution and contact deduplication.	Analytics / non-essential	6 months
__hssc	HubSpot	Tracks sessions and page-view counts within a session.	Analytics / non-essential	30 minutes
__hssrc	HubSpot	Helps determine whether a visitor has restarted their browser and a new session has begun.	Analytics / non-essential	Session
HubSpot Buyer Intent / page interaction tracking	HubSpot	Uses HubSpot tracking data, including IP address, visitor ID, timestamps and page paths, to measure website activity and identify the visiting organisation. Page interaction/click data may also be used for analytics.	Visitor identification / analytics - non-essential	Uses HubSpot tracking data; no separate cookie duration
HubSpot collected forms	HubSpot	Supports capture/attribution of submissions from non-HubSpot forms where used. It may use the HubSpot visitor token when available.	Analytics / functionality - non-essential	No separate cookie; may use hubspotutk when consented
Flowd visitor identification	Flowd / dataoperation24.com	Uses IP address and browser/navigation information to identify the organisation associated with a visit and understand business website activity. It does not identify an individual by name from the website visit.	Visitor identification / non-essential	No cookie or browser storage set by Flowd; server-side retention is controlled by the provider

Depending on your browser settings, HubSpot may also set two further strictly necessary cookies: __hs_gpc_banner_dismiss (180 days) where your browser sends a Global Privacy Control signal, and __hs_initial_opt_in (7 days) where your browser blocks storage, so that the banner does not reappear on every page.

• non-essential Uses HubSpot tracking data; no separate cookie duration HubSpot collected forms HubSpot Supports capture/attribution of submissions from non-HubSpot forms where used. It may use the HubSpot visitor token when available. Analytics / functionality - non-essential No separate cookie; may use hubspotutk when consented Flowd visitor identification Flowd / dataoperation24.com Uses IP address and browser/navigation information to identify the organisation associated with a visit and understand business website activity. It does not identify an individual by name from the website visit. Visitor identification / non-essential No cookie or browser storage set by Flowd; server-side retention is controlled by the provider

4. HubSpot analytics and Buyer Intent

HubSpot provides website analytics, visitor/session recognition, form attribution, page-interaction tracking and Buyer Intent functionality. When enabled after consent, HubSpot may use the cookies listed above and collect information such as IP address, visitor ID, timestamps and page paths. Buyer Intent uses this tracking data to identify the organisation associated with a website visit. We treat HubSpot analytics, page-interaction tracking and Buyer Intent as non-essential and suppress them unless you accept analytics cookies.

5. Flowd visitor identification

Flowd is used to identify the organisation associated with a website visit. When enabled after consent, the service receives the visitor's IP address together with information such as screen dimensions, referrer, page title, page URL, browser/user-agent information and domain. IllumiFi uses this information for B2B website analytics and business development. Flowd does not set cookies, localStorage or sessionStorage on the visitor's device. We nevertheless treat it as a non-essential tracking technology and only enable it after you accept analytics cookies.

6. Google Analytics 4

We use Google Analytics 4 (GA4) to understand how people use the website. Google Consent Mode is configured so that analytics storage is denied until you consent. If you accept analytics cookies, the consent state is updated and GA4 may use first-party analytics cookies such as _ga and _ga_<container-id>. If you decline, analytics storage remains denied.

7. Strictly necessary technologies

Strictly necessary technologies do not require consent where they are needed to provide the website service you request, protect the site, or remember your privacy choice. These technologies are not used for advertising or behavioural profiling.

8. Changes to this notice

We review this Cookie Notice when we make a material change to the website's tracking, analytics or consent configuration. The date at the top of this notice identifies the current version.

9. Contact

If you have questions about our use of cookies or similar technologies, contact us at dataprotectionofficer@illumifiadvisory.co.uk.