Privacy Policy

JBAF LIMITED ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website jbafconsult.com and use our services.

1. Data Controller

The data controller responsible for processing your personal data is:

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

2.1 Information You Provide Directly

• Contact Forms: Name, email address, phone number, and message content when you contact us
• Business Inquiries: Company/organisation name, contact person details, and inquiry content
• Service Engagement: Information necessary to provide our consulting services to you

2.2 Information Collected Automatically

• Technical Data: IP address (anonymised), browser type and version, operating system, device information
• Usage Data: Pages visited, time spent on pages, click patterns, referral sources (via Google Analytics)
• Cookie Data: Cookie consent status (see our Cookie Policy for details)

3. Legal Basis for Processing (UK GDPR Article 6)

We process your personal data based on the following legal grounds:

• Consent (Art. 6(1)(a)): For analytics cookies. You may withdraw consent at any time.
• Contract Performance (Art. 6(1)(b)): To provide our consulting services and fulfil our obligations to clients.
• Legitimate Interests (Art. 6(1)(f)): To improve our website, ensure security, prevent fraud, and analyse website usage for operational purposes.
• Legal Obligations (Art. 6(1)(c)): To comply with accounting, tax, and other legal requirements.

4. How We Use Your Data

We use collected data for the following purposes:

• To respond to your inquiries and provide support
• To provide consulting services
• To improve website functionality and user experience
• To generate anonymised analytics and usage statistics
• To comply with legal obligations
• To protect our rights and prevent fraudulent activities

5. Data Sharing and Third-Party Services

We may share your data with the following categories of recipients:

5.1 Analytics

Google Analytics (GA4): For website performance and usage analytics. Google's privacy policy

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

6. International Data Transfers

Some of our service providers may be located outside the United Kingdom. When we transfer data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses, adequacy decisions, or other legally recognised transfer mechanisms in accordance with UK GDPR requirements.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form inquiries: 3 years after your last contact
• Client records: 6 years (as required by UK tax and accounting laws)
• Analytics data: 14 months (anonymised)
• Consent cookie: 1 year

8. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restriction (Art. 18): Request restriction of processing in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time (without affecting lawfulness of prior processing)

How to Exercise Your Rights

To exercise any of these rights, please contact us at info@Jbafconsult.com. We will respond to your request within 30 days. We may require proof of identity before processing your request.

9. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: https://ico.org.uk

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption (HTTPS/TLS), secure authentication, access controls, and regular security assessments.

11. Children's Privacy

Our website and services are not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16 without parental consent. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on our website with an updated "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

For any questions or concerns about this Privacy Policy or our data practices, please contact:

© 2026 JBAF LIMITED. All rights reserved.