Privacy Policy

1. Who we are

This privacy policy explains how Sardine & Co Ltd ("Sardine & Co", "we", "us", "our") collects, uses, and protects your personal information when you visit our website, submit an enquiry, or otherwise engage with us.

Sardine & Co Ltd is a company registered in England and Wales (company number 16697809), with its registered office at [16 Lord North Street, SW1P 3LD]. We are the data controller responsible for your personal data.

We are registered with the Information Commissioner's Office under registration number [C1937756].

If you have any questions about this policy or how we handle your data, please contact us at hello@sardineco.com

2. Information we collect

We collect personal information in the following ways:

Information you give us directly. When you submit an enquiry through our website, sign up to hear from us, or correspond with us by email, you may provide us with information such as your name, email address, phone number, company name, job title, and the contents of your message.

Information we collect when you visit our website. Our website automatically collects certain technical information, including your IP address, browser type, device information, referring website, and pages visited. This is collected through cookies and similar technologies — see Section 8 below.

Information from third parties. In limited cases, we may receive your information from third parties such as event partners, referrers, or business introducers, where you have agreed for your details to be shared with us.

3. How we use your information and our lawful basis

We use your personal information for the following purposes:

Purpose	Lawful basis
Responding to enquiries you submit	Legitimate interests (to respond to your request) / pre-contractual steps
Providing event production, retreat, and related services to clients	Performance of a contract
Sending you marketing communications about our events and services	Your consent (which you can withdraw at any time)
Maintaining business records, accounting, and tax compliance	Legal obligation
Improving our website and services	Legitimate interests
Protecting our business, preventing fraud, and enforcing legal rights	Legitimate interests

4. Who we share your information with

We do not sell your personal information. We share it only in the following circumstances:

• — Service providers who help us run our business, including our website host (Wordpress), CRM provider (Copper), email and productivity tools (Google Workspace), accounting software (Xero), banking (Tide), and event delivery partners (such as venues, DMCs, photographers, and travel providers engaged for specific events).
• — Professional advisors such as our accountants, lawyers, and insurers, where reasonably required.
• — Clients and event partners, but only where necessary for the delivery of an event you are attending or where you have consented.
• — Regulators, law enforcement, or other authorities where we are legally required to do so.
• — In connection with a business transaction such as a sale, merger, or restructuring of our business, in which case appropriate safeguards will apply.

5. International transfers

Some of the service providers we use are based outside the United Kingdom, including in the European Economic Area and the United States. Where we transfer your personal data outside the UK, we ensure it is protected by appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfers to jurisdictions that the UK Government has determined provide an adequate level of protection.

6. How long we keep your information

We retain your personal information only for as long as necessary for the purposes set out in this policy:

• — Enquiry data: up to 24 months from your last contact with us, unless you become a client or ask us to keep in touch.
• — Client and event records: for the duration of our relationship and for 6 years after the end of that relationship, in line with HMRC requirements.
• — Marketing data: until you unsubscribe or otherwise withdraw your consent, after which we retain a suppression record to ensure we do not contact you again.
• — Website analytics data: typically up to 26 months.

7. Your rights

Under UK data protection law, you have the following rights in relation to your personal information:

• — The right to be informed about how your data is used (this policy)
• — The right of access to your personal data
• — The right to rectification of inaccurate data
• — The right to erasure ("right to be forgotten") in certain circumstances
• — The right to restrict processing in certain circumstances
• — The right to data portability for data you have provided to us
• — The right to object to processing based on legitimate interests or direct marketing
• — The right to withdraw consent at any time, where we rely on consent
• — The right not to be subject to automated decision-making

To exercise any of these rights, please contact us at [PRIVACY EMAIL]. We will respond within one month.

If you are not satisfied with how we have handled your data or any request you make, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

8. Cookies and similar technologies

Our website uses cookies and similar technologies to make the site work, understand how it is used, and (where you have consented) deliver marketing.

We use the following categories of cookies:

• — Strictly necessary cookies, which are required for the site to function and cannot be switched off.
• — Analytics cookies, which help us understand how visitors interact with our site. [If you use Google Analytics: We use Google Analytics for this purpose.]
• — Marketing cookies, which we set only where you have consented.

You can manage your cookie preferences through the cookie banner displayed when you first visit our site, and you can change your preferences at any time through [LINK TO COOKIE SETTINGS]. You can also manage cookies through your browser settings.

9. Security

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration, or disclosure. No method of transmission over the internet is completely secure, however, and we cannot guarantee absolute security.

10. Children

Our website and services are not directed at children under 16, and we do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the "Last updated" date at the top of this page. Material changes will be brought to your attention where appropriate.

12. Contact us

If you have any questions about this policy or wish to exercise any of your rights, please contact:

Sardine & Co Ltd Email: hello@sardineco.com