Privacy Policy
Last updated 26 September 2026.
Who we are
This policy explains how Williams, Stanley and Co. Limited ("we", "us") uses personal data collected through this website. We are the controller of that data. We are a company registered in England and Wales under number 05860058, with our registered office at The Yard Halecat, Witherslack, Grange-Over-Sands, England, LA11 6RT. We are registered with the Information Commissioner's Office under number ZA487117.
Questions about this policy, or about your data, go to info@williamsstanley.co.
This policy covers the website only. If you become a client, our terms of business and engagement letter explain how we handle the data we process in providing our services.
What we collect, and why
We only collect what you give us, what we need to keep the site secure, and, if you allow it, information about how the site is used. For each, the law requires us to name a lawful basis under the UK GDPR.
| What | Why we use it | Lawful basis |
|---|---|---|
| Your name, email, company, phone number and message, when you send an enquiry | To reply to you and, if you ask, to talk about working together | Legitimate interests (answering the enquiry you sent), and steps before entering a contract |
| Your email address and, optionally, first name, when you sign up to the newsletter | To send you the newsletter | Consent, which you give by ticking the box and confirming by email |
| The details you give when you make a data request | To find your records and respond | Legal obligation |
| The text of messages you send to Nora, our AI assistant | To generate a reply, and to pass your enquiry to our team if you ask | Legitimate interests (answering your question) |
| Your IP address and basic request details | To keep the site running, and to limit repeated submissions that look like abuse | Legitimate interests (security) |
| Anonymous page view and performance counts | To see which pages are useful and whether the site is fast enough | Legitimate interests (running and improving the site). No cookies are used and no profile of you is built |
We do not make decisions about you by automated means, and we do not sell your data. This site is intended for people running or working in businesses, not for children.
Newsletter
Signing up is double opt-in. When you enter your email address we send you a link, and you are only added to the list once you click it. If you do not, you are not added, and the unconfirmed signup is deleted after 30 days.
Every newsletter includes a link to unsubscribe, which takes effect straight away. We keep a record of the address and the date you unsubscribed, so that we do not add you again by mistake.
Nora, our AI assistant
Our website includes an AI assistant called Nora, shown as a chat panel. It is provided to answer general questions about our services. Nothing it says is advice on your own circumstances, and it can be wrong.
When you send a message to Nora, the text of your conversation is sent to Anthropic, who provide the underlying AI model, in order to generate a reply. Anthropic process it as our processor for that purpose. We do not use your conversations to train AI models.
We do not keep a database of chat transcripts. The conversation exists only in the open page and is gone when you close it. Our analytics count that a message was sent; they never record what it said.
The one exception is if you ask to be put in touch with our team. In that case, and only with the email address you have given, we send our team a notification containing your email address, any name or business you have mentioned, and a short summary of what you asked about, so that someone can follow up.
Please do not enter personal, financial or payroll information into the chat. Nora is instructed never to ask for it. If you would rather not use it at all, you can contact us by the enquiry form, by email or by telephone instead.
Who we share it with
We use the following service providers to run the site. Each acts as our processor, under a contract that only allows them to use your data on our instructions.
- Vercel, which hosts the website and its server functions.
- Neon, which provides the database that holds newsletter signups and security records.
- Resend, which delivers the emails the site sends.
- HubSpot, our customer relationship management system, where enquiries and confirmed subscribers are recorded.
- Anthropic, which provides the AI model behind Nora.
- Google, which serves one of the fonts the pages use. Your browser requests it directly, so Google receives your IP address. No cookies are set.
We may also disclose data where the law requires it, for example to a regulator.
International transfers
Some of these providers are based in, or process data in, the United States. Where data leaves the UK we rely on the safeguards UK law provides: the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise the International Data Transfer Agreement or Addendum approved by the Information Commissioner.
How long we keep it
- Enquiries: for as long as we are discussing your enquiry, then for up to two years so that we have a record if you get back in touch. If you become a client, our engagement terms take over.
- Newsletter: for as long as you are subscribed. Unconfirmed signups are deleted after 30 days. Unsubscribed addresses are kept only as a record not to mail you.
- Data requests: for two years after we have responded, as evidence that we did.
- Security records of IP addresses: deleted within a day of the limit they relate to expiring.
- Hosting logs: kept by our hosting provider for a short period, no more than 30 days.
Security
Data travels to and from this site encrypted. Access to the systems that hold it is limited to the people who need it, and protected by individual accounts. Our forms are protected by a hidden field that automated submissions fill in and people do not, and by rate limits applied at our server. Neither involves tracking you.
If a personal data breach is likely to put your rights at risk, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it. If the risk to you is high, we will tell you directly and without undue delay.
Your rights over your data
Under the UK GDPR and the Data Protection Act 2018 you can ask us to tell you what personal data we hold about you, to give you a copy, to correct it if it is wrong, to delete it, to restrict or object to how we use it, and to stop using it for marketing. Where we rely on your consent, you can withdraw it at any time. You do not have to give a reason, and it costs nothing.
Use the form below, or email info@williamsstanley.co. We will respond within one month, as the law requires. We may need to confirm who you are first, so that we do not disclose someone's data to the wrong person.
If you are unhappy with how we handle your data or your request, please tell us first through our complaints procedure. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Cookies and analytics
This website sets no cookies for visitors, and shows no cookie banner because there is nothing to consent to.
Our cookie policy lists exactly what runs and why.
Links to other websites
This site links to other websites, including TeamPay, WS Insights, LinkedIn and our booking page. Their own privacy policies apply once you are there.
Changes to this policy
We update this policy when what we do changes. The date at the top shows when it last changed. If a change affects how we use data you have already given us, we will tell you.