Multipli Consulting Ltd Privacy Notice
Last Updated: 9 November 2026
1. INTRODUCTION
This privacy notice explains how Multipli Consulting Ltd collects and uses your personal data when you interact with us, including through our website (www.multipli.co.uk or www.multipliconsult.co.uk), by email or social media, when using our client portals and when you enquire about or receive our services.
By providing us with your data, you warrant to us that you are over 13 years of age. Our website and services are intended for businesses and are not aimed at children.
Multipli Consulting Ltd is the data controller and we are responsible for your personal data (referred to as “we”, “us” or “our” in this privacy notice).
Contact Details
Multipli Consulting Ltd is registered in England and Wales under company number 15472240.
Its registered office is The White House, Greenall’s Avenue, Warrington, WA4 6HL.
Email address: alex@multipliconsult.co.uk
It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at alex@multipliconsult.co.uk.
2. WHAT DATA DO WE COLLECT ABOUT YOU, FOR WHAT PURPOSE AND ON WHAT GROUND WE PROCESS IT
Personal data means any information capable of identifying an individual. It does not include anonymised data.
We may process the following categories of personal data about you:
Communication Data
This includes any communication that you send to us whether that be through the contact form on our website, through email, text, social media messaging, social media posting or any other communication that you send us. We process this data for the purposes of communicating with you, for record keeping and for the establishment, pursuance or defence of legal claims. Our lawful ground for this processing is our legitimate interests which in this case are to reply to communications sent to us, to keep records and to establish, pursue or defend legal claims.
Customer Data
This includes information relating to the services you purchase from us, such as your name, business name, contact details, details of the services and invoice and payment records. Payment records may include information shown on our bank statements, such as the payer’s name, payment amount, date and transaction reference. We process this data to respond to enquiries, take steps at your request before entering into a contract, provide our services and administer payment. Where processing is necessary to enter into or perform our contract with you, our lawful basis is contract.
User Data
This includes data about how you use our website, such as the pages you visit, how you arrived at our site (for example, from a search engine or link), the date and time of your visit, and technical information such as your browser, device type, IP address and approximate location. We process this data to operate, secure and administer our website and business. Where we rely on legitimate interests, those interests are to operate and administer our website and business.
Where you agree to analytics cookies, we also use this data to understand how visitors use our website and improve its content. We rely on your consent for this. You can withdraw it at any time using the Cookie Preferences button at the bottom of each page, and we will stop setting analytics cookies from then on.
Client Portal Data
We provide secure online portals for our clients at multipliportal.co.uk. Where a portal requires sign-in, we hold the work email address of each person authorised to use it. That address is provided by the client organisation you work for, or by you. When you sign in, you receive a one-time code by email, and our access provider records details of each sign-in attempt, such as your email address, the date and time, your IP address and approximate location, and whether access was granted.
We process authorised users’ account and sign-in data on the basis of our legitimate interests in providing and securing the portals and protecting client information. Where an individual is themselves our client, we may rely on contract for processing that is necessary to provide the services agreed with them.
When you sign in, the portal sets a strictly necessary cookie (CF_Authorization) to keep you signed in. It usually lasts 24 hours, but some portals use a different session length at the request of the client organisation. The portals do not use analytics or advertising cookies.
Sign-in is provided by Cloudflare, Inc., which acts as our processor. Cloudflare may process this data in the United States. Those transfers rely on Cloudflare’s certification under the UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses as a fallback.
We remove your email address from our access list when your access is no longer needed, for example when your organisation asks us to or when our work with them ends. Sign-in records are available to us for up to 24 hours. Cloudflare retains them for a limited period in line with its data retention policy.
Marketing Data
This includes your preferences about receiving marketing from us and your communication preferences. We use your email address and subscription preferences to send our quarterly newsletter and manage unsubscribes. We rely on your consent where you have subscribed, and otherwise on our legitimate interests (see Marketing Communications). You can withdraw your consent at any time by using the unsubscribe link in the newsletter or contacting us at alex@multipliconsult.co.uk.
We also publish general posts about our business on Instagram and LinkedIn. We do not use your marketing data to target you with advertising.
We may also use Communication Data, Customer Data, User Data, Client Portal Data and Marketing Data for the establishment, pursuance or defence of legal claims. Our lawful ground for this processing is our legitimate interests which in this case are to establish, pursue or defend legal claims.
Information we need to provide our services
Some information is necessary for us to respond to an enquiry, agree or provide consultancy services, or meet a legal obligation. If you do not provide information we reasonably need for one of these purposes, we may be unable to respond, enter into or perform an agreement, or take a step you have asked us to take. We will explain the relevant information and likely consequences when we request it.
Purposes of Processing
We will only use your personal data for a purpose it was collected for or a reasonably compatible purpose if necessary. For more information on this please email us at alex@multipliconsult.co.uk. In case we need to use your details for an unrelated new purpose we will let you know and explain the legal grounds for processing.
Special Category Data, Criminal Conviction Data and Automated Processing
We do not collect Special category data about you. Special category data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data.
We do not collect any information about criminal convictions and offences.
Automated decision making
We do not carry out automated decision making or any type of automated profiling.
3. HOW WE COLLECT YOUR PERSONAL DATA
We collect personal data in the following ways:
Directly from you. You may give us personal data when you contact us by email or through our website, work with us, or otherwise correspond with us.
Automatically, when you use our website or client portals. Our website platform, Squarespace, collects technical and usage data when you visit our website. Our contact form uses Google reCAPTCHA, a service provided by Google LLC, to protect it from spam. When you visit our contact page, reCAPTCHA collects information such as your IP address, browser and device details, and how you interact with the page, and sends it to Google. Analytics cookies are set only if you accept them. When you use a client portal, Cloudflare records sign-in information as described under Client Portal Data. See our Cookie Policy for more information about cookies.
Through our social media pages. If you comment on our LinkedIn or Instagram posts, or send us a message through those platforms, we may receive your profile details and the information in your comment or message.
From the organisation you work for. If a client organisation gives you access to a client portal, it will usually provide us with your work email address. It may also give us the names, job titles and work contact details of its staff so that we can carry out our work with it.
From people who refer you to us. A client, associate or business contact may introduce you to us or give us your contact details.
4. SOCIAL MEDIA
We use LinkedIn and Instagram to publish content about our work. If you comment on a post or send us a message, we may use the information you share, including your profile details and the content of your comment or message, to respond and deal with your enquiry. The platforms also process information about their users under their own privacy notices. If we take your enquiry forward or add relevant details to our business records, we handle that information as described in this Privacy Notice.
5. MARKETING COMMUNICATIONS
We send a quarterly newsletter with news, insights and information about our services. We send it to people who have subscribed, and to other clients and contacts only where the law allows us to do so, as explained below.
Where you have subscribed, we rely on your consent. Where you receive our newsletter at a work email address without having subscribed, we rely on our legitimate interests in promoting and growing our business.
Under the Privacy and Electronic Communications Regulations (PECR), we send marketing emails to individual subscribers, including sole traders and ordinary partnerships, only where they have consented or the “soft opt-in” applies. We rely on the soft opt-in only where we obtained your details directly from you during a sale or genuine negotiations for a sale, the newsletter promotes our own similar services, and we gave you a clear opportunity to opt out when we collected your details and in every newsletter since. We may send marketing emails to corporate subscribers without prior consent under PECR. Where a work email address identifies you, we still handle your personal data in line with data protection law and will always respect an objection to direct marketing.
You can unsubscribe at any time using the link in every newsletter, or by emailing us at alex@multipliconsult.co.uk. If you unsubscribe, we will stop sending you the newsletter. We keep a minimal record that you have unsubscribed, so that you are not added back to our mailing list. This does not affect messages about work we are doing for you or your organisation, which are not marketing.
We send our newsletter using Mailchimp, provided by The Rocket Science Group LLC (part of Intuit), which acts as our processor. Mailchimp may process your data in the United States. Those transfers rely on Mailchimp’s certification under the UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses as a fallback. We have turned off open and click tracking in our newsletter emails, so we do not see whether you open them or which links you click. Mailchimp may still route links through its own servers for a limited period to detect abuse and protect email delivery.
The newsletter email contains a link to a web page where the newsletter is published. That page is hosted by Cloudflare, which acts as our processor, and does not require you to sign in. It does not use cookies or analytics. Cloudflare processes technical data, such as your IP address, to deliver and secure the page. The page also loads its fonts from Google Fonts, a service provided by Google LLC, so your browser sends your IP address to Google when you open the page. Google does not act as our processor for this service. It uses this data in line with its own Privacy Policy and may process it in the United States.
We will never share your personal data with any third party for their own marketing purposes.
6. DISCLOSURES OF YOUR PERSONAL DATA
We may share your personal data with the following parties:
Service providers who help us run our business. These are Microsoft 365 (email, file storage and office software), FreeAgent (accounting), Anthropic (Claude, an AI assistant we use to keep records of client contacts and support our work), Squarespace (our website), Cloudflare (our client portals and newsletter page) and Mailchimp (our newsletter). Most of the personal data these providers handle for us, they process as our processors. Where they do, we require them by contract to process it only in accordance with our instructions and to protect it appropriately. Some providers may also process limited data for their own purposes, such as security, billing or meeting their legal obligations, and in that case they are responsible for it.
Subcontractors who work with us on client projects. We share only the information they need to carry out that work, and we require them to keep it confidential and secure.
Professional advisers, including our accountants, lawyers, bankers and insurers, where they need the information to advise or provide services to us. They generally handle it under their own professional and legal duties.
HM Revenue & Customs, regulators and other authorities, where we are required by law to share data with them.
Third parties to whom we may sell, transfer or merge parts of our business or our assets. If this happens, the new owner may use your personal data in the same way as set out in this policy.
Some services receive data directly from your browser or device, rather than from us. Google receives your IP address when our newsletter page loads its fonts. Google also receives information through reCAPTCHA when you visit our contact page. LinkedIn and Meta (Instagram) receive information when you visit or interact with our social media pages. These providers handle that data for their own purposes under their own privacy policies. See the How We Collect Your Personal Data, Marketing Communications and Social Media sections for details.
Some of these parties are based outside the UK. See the International Transfers section for how your data is protected when that happens.
7. INTERNATIONAL TRANSFERS
Where you are within the United Kingdom:
We are subject to the provisions of the UK General Data Protection Regulations (UK GDPR) that protect your personal data. Where we transfer your data to third parties outside of the UK, we will ensure that certain safeguards are in place to ensure a similar degree of security for your personal data. As such:
· We may transfer your personal data to countries that the United Kingdom regulatory authorities have approved as providing an adequate level of protection for personal data; or
· If we use US-based providers that are part of the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework), we may transfer data to them, as they have equivalent safeguards in place; or
· Where we use certain service providers who are established outside of the UK, we may use specific contracts approved by the ICO (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses), or codes of conduct or certification mechanisms approved by the UK government, which give personal data the same protection it has in the UK.
If none of the above safeguards are available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.
Where you are within the EEA:
We are subject to the provisions of the EU General Data Protection Regulation (EU GDPR) that protect your personal data. Where we transfer your data to third parties outside of the EEA, we will ensure that certain safeguards are in place to ensure a similar degree of security for your personal data. As such:
· We may transfer your personal data to countries that the European Commission has approved as providing an adequate level of protection for personal data; or
· If we use US-based providers that are part of the EU-US Data Privacy Framework, we may transfer data to them, as they have equivalent safeguards in place; or
· Where we use certain service providers who are established outside of the EEA, we may use specific contracts (the EU Standard Contractual Clauses adopted by the European Commission in June 2021), or codes of conduct or certification mechanisms approved by the European Commission, which give personal data the same protection it has in the EEA.
If none of the above safeguards is available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.
8. DATA SECURITY
We have put in place security measures to prevent your personal data from being accidentally lost, used, altered, disclosed, or accessed without authorisation. We also allow access to your personal data only to those employees or subcontractors who have a business need to know such data. They will only process your personal data on our instructions and they must keep it confidential.
9. DATA RETENTION
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
When deciding what the correct time is to keep the data for we look at its amount, nature and sensitivity, potential risk of harm from unauthorised use or disclosure, the processing purposes, if these can be achieved by other means and legal requirements.
For tax purposes the law requires us to keep basic information about our customers (Customer Data) for six years after they stop being customers.
In some circumstances we may anonymise your personal data for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
10. YOUR LEGAL RIGHTS
Under data protection laws you have rights in relation to your personal data that include the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data and (where the lawful ground of processing is consent) to withdraw consent.
If you are within the UK, you can see more about these rights at:
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/
If you wish to exercise any of the rights set out above, please email us at alex@multipliconsult.co.uk.
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive or refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
When responding to a request to access your personal data, we are only required to carry out searches that are reasonable and proportionate in the circumstances (as now expressly recognised in the Data (Use and Access) Act 2025). This means we will take into account factors such as the nature of the information sought, the context in which it is held, any difficulty involved in locating it and the potential benefit to you of receiving it.
We try to respond to all legitimate requests within one month of receiving the request (or, where applicable, of receiving the identity verification information or clarification we have asked for - the response period is paused, or "stopped", while we wait for that information, in line with the Data (Use and Access) Act 2025).
Occasionally it may take us longer than one month if your request is particularly complex or you have made a number of requests, in which case we may extend the response period by up to a further two months. We will notify you within one month of receiving your request if an extension is needed and explain why.
11. HOW TO COMPLAIN
If you have a complaint about how we handle your personal data, we ask that you contact us first so that we can try to resolve it for you.
You can submit a data protection complaint to us by:
· emailing us at alex@multipliconsult.co.uk
· writing to us at Multipli Consulting Ltd, The White House, Greenall’s Avenue, Warrington, WA4 6HL
We will acknowledge your complaint within 30 days of receiving it. We will investigate your complaint without undue delay, keep you informed of our progress, and communicate the outcome to you clearly with sufficient detail for you to understand how we reached our conclusion.
If you are within the UK and are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
If you are within the EU and are not satisfied with our response, you have the right to complain to the data protection authority of the country in which you are based.
12. THIRD-PARTY LINKS
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
13. COOKIES
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see www.multipli.co.uk/cookie-policy.