Last updated 24 August 2026

Privacy notice

This notice explains what happens to personal data in connection with this website, under the UK GDPR and the EU GDPR. If we go on to discuss or carry out an engagement, separate terms cover the personal data involved in the work itself. Please read this notice together with any other notice given to you at the time.

Who we are

Brett Gibson, trading as Proventarc, is the controller for the personal data described here. Address for correspondence: 1 Fenwick Road, London SE15 4HS.

For anything in this notice, including any of the requests described below, email privacy@proventarc.com.

Visiting this site

We use PostHog to count visits and see which pages are read. It runs in cookieless mode, so nothing is stored on or read from your device, and no profile of you is built.

When your browser requests a page, your IP address and browser user agent reach PostHog's servers, where they are combined with a value that changes daily to produce an irreversible identifier. That identifier cannot be turned back into your IP address or anything else about you, and the daily value is deleted once that day's data has been processed. Your IP address is not stored and no location is derived from it. Session recording and surveys are switched off.

Our lawful basis is legitimate interest: understanding which parts of the site are useful so we can improve them. There is no advertising, no marketing profiling, and this data is not sold or shared. Because nothing identifying is retained, there is no analytics record we could return to you if you asked for one.

The hosting provider that serves this site may keep short-lived technical server logs, such as IP address and requested page, for security and operations. We do not use those logs to identify visitors.

Cookies, and why there is no banner

Browsing this site sets no cookies and stores nothing in local or session storage. Nothing is read back from your device. Because nothing is stored on or retrieved from your equipment while you browse, there is nothing to consent to under the Privacy and Electronic Communications Regulations for that.

The one exception is booking a call. Clicking "Book a call" loads a booking calendar from Cal.com, our scheduling provider, directly into the page. At that point Cal.com sets a small number of cookies: to hold the time slot you select while you complete the booking form, and for its own security and bot protection. These are set only once you click through to book, are not used by us for advertising or analytics, and Cal.com's own privacy policy governs how it handles them. No separate cookie banner is shown for this: the cookies are set only when you choose to open the booking calendar, and support that action rather than tracking your visit to the rest of the site.

If you get in touch or book a call

If you contact us by email or through LinkedIn, the personal data you choose to share, being your name, contact details and the content of your message, is used only to respond and to hold the conversation you started. The lawful basis is legitimate interest in responding to business enquiries, and performance of a contract where an engagement follows. Correspondence is not added to a marketing list.

If you book a call, the details you enter go to Cal.com, our scheduling provider, so the meeting can be arranged, and appear in our calendar.

Links from this site to LinkedIn lead to a third-party platform with its own privacy policy. We are not responsible for how LinkedIn handles your data there.

Who we share information with

We use third party tools and service providers to operate the practice. Those that handle personal data do so as our processors, on our instructions and under written terms. In connection with this site, that means the software behind hosting, analytics, scheduling, email and calendar, and our record of who we have spoken to. Analytics is provided by PostHog on its European cloud, and scheduling by Cal.com, as described above.

We may also share personal data with our professional advisers, such as our accountant, insurers and legal advisers, where that is necessary.

Some of these providers are based outside the UK. Where personal data is transferred outside the UK, we make sure it is given a similar level of protection, using the safeguards recognised under UK data protection law.

We require anyone who handles personal data for us to respect its security and to treat it in accordance with the law. We do not allow them to use it for their own purposes, and they may only process it for purposes we specify and on our instructions. We will not disclose personal data you have given us other than as described in this notice, unless you authorise us to, or unless we are required to by law. Where we are required by law to release information, we will do so and will co-operate with the relevant authorities. We do not sell personal data and we do not use it for marketing lists.

If the practice is ever incorporated, sold, merged or transferred, personal data may pass to the new controller, who would be bound by a notice at least as protective as this one.

How long we keep information

Analytics data holds nothing that identifies you, and the daily value used to generate identifiers is deleted once each day's data has been processed.

Enquiries that do not lead to an engagement are kept for 24 months, then deleted. Client correspondence and engagement records are kept for six years after the relationship ends, which is the period we are required to keep business records for tax purposes.

Keeping information secure

We have measures in place to prevent personal data being lost, misused, altered or accessed without authorisation. Access is limited to those with a business need for it. We have a procedure for dealing with any suspected personal data breach, and will notify you and the Information Commissioner's Office where the law requires it.

Your rights

Under the UK and EU GDPR you have the right to ask us to give you access to the personal data we hold about you, to correct it if it is wrong or incomplete, to delete it, to restrict how we use it, to object to our using it, and to transfer it to you or another organisation. Where we rely on your consent for something, you can withdraw that consent at any time.

You will not have to pay a fee to exercise any of these rights. We may charge a reasonable fee, or decline, if a request is clearly unfounded, repetitive or excessive. We will respond without undue delay and in any event within one month.

Complaints

If you have a concern about how we have used your personal data, please raise it with us first at privacy@proventarc.com. If you are still unhappy, you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113, or at ico.org.uk/make-a-complaint.

Changes to this notice

If this site adds forms, marketing, or any processing not described here, this notice will be updated before that change goes live, and consent will be sought where the law requires it.