Privacy notice

1. Who we are and what this notice covers

This website is run by Scout Atlas Limited ("the Company", "we"), a company registered in England and Wales, company number 16625642. Our registered office is 1 Armstrong House, High Street, Uxbridge, UB8 1GJ. Scout Agency is a division and trading name of the Company. It is not a separate legal person.

For the personal data described below we are the controller. This notice covers the Scout Agency website, including the call booking service and the enquiry form, and email sent to us from the site. It does not cover personal data we handle for a client as their processor. A written agreement with the client governs that data. Scout Ledger and our other products will have their own notices.

2. What personal data we collect

• Booking a call. Your name, email address, organisation (if you give one), who you are (a business, a public sector body or an individual), what you need (if you say), the kind of call, the time you choose, your time zone, and anything you write in the message box. Without a name, email address and time we cannot arrange the call.
• Sending an enquiry. Your name and email address, and, if you answer, your organisation, who you are, what you need and anything else you write. Only the name and email address are required.
• The calendar entry. A booking creates an event in our Google Calendar with a Google Meet link, and you are added as a guest. The event title holds your name and your client type (Business, Public sector, Individual, or not stated). The event description holds the same name and client type and your time zone. Your email address is on the event as the guest address. Your organisation and your message are not put in the event; they go only to the private spreadsheet and our enquiry mailbox.
• The record of each booking and enquiry. Each booking and each enquiry is added as one row to a private Google Sheet that only our staff can open, and is also emailed to our enquiry mailbox (inquiry@scoutatlas.uk). The row and the email hold the date and time received, a reference, your name, email address, organisation, client type, needs, call type, time, time zone, your message and a status. They hold no IP address and no browser details.
• Email. The address, name and content of messages you send to us, and our replies.
• Technical data. Our host receives your IP address, browser and device type, the pages requested and timestamps whenever a page is loaded, and keeps them in server logs. When you send a booking or enquiry, the bot check (described in clause 5) and our booking service also receive your IP address. The booking service uses it only to limit how often one address can send requests, and passes it to the bot check.
• Storage on your device. The site keeps your theme choice and a flag that the loading sequence has played in your own browser. We set no cookies. These items stay on your device and are not sent to us. See the Cookie notice.

The message boxes can hold anything you choose to write. Please do not put sensitive personal data in them, such as health information, or anything about other people that you do not need to give.

We do not use cookies or tools to measure how visitors use the site, and we do not profile visitors.

3. Why we use it, and our legal basis

• To arrange a call and reply to an enquiry. If you are, or are asking to become, a customer in your own name, we do this to take steps at your request before a contract (UK GDPR Article 6(1)(b)). If you contact us for an organisation, or no contract is in prospect, we rely on our legitimate interest in replying to people who contact us (Article 6(1)(f)).
• To keep a record and follow up. We keep the calendar entry, the spreadsheet row and the emails to manage our enquiries, to deal with any later question about them, and to protect our legal position. The basis is our legitimate interest (Article 6(1)(f)).
• To keep the site and the forms secure. Server logs, the bot check and the request limits stop abuse of the forms and keep the site available. The basis is our legitimate interest (Article 6(1)(f)).
• To meet legal duties, such as keeping accounting records once you become a client (Article 6(1)(c)).

Where we rely on legitimate interests we have weighed them against your rights and can give you a summary of that assessment on request. You can object to this processing at any time (clause 8). We rely on none of the "recognised legitimate interests" that the Data (Use and Access) Act 2025 added to the UK GDPR. We do not send marketing from this site and it collects no marketing sign-ups. If that changes we will use a clear opt-in and update this notice first. We take no decision about you solely by automated means.

4. How long we keep it

• Bookings, enquiries, emails, the calendar entry and the spreadsheet row: for up to 24 months after our last meaningful contact with you, then deleted. We keep them longer only if we need them to establish, exercise or defend a legal claim, or the law requires it.
• If you become a client: your contact, engagement and billing records are kept for 6 years after the engagement ends, as part of the records of that contract.
• Complaints: 6 years from the day the complaint is closed.
• Booking service records at Cloudflare: a record of each booking response for 24 hours, so a repeated request does not book twice; and a one-way hash of your email address (not the address) until your last booked call has passed plus one day, so that we can limit each address to three future bookings. Daily counters hold no personal data.
• Server logs at our host: Vercel keeps its request logs for a short time that depends on its plan, from about one hour up to 30 days. We do not choose a longer period for this site.

5. Who we share it with

We do not sell personal data. We use the following service providers as processors, on our instructions and under their data processing terms.

• Vercel Inc. (United States) hosts and serves the website and holds its server logs.
• Cloudflare, Inc. (United States) runs the domain name system for our domain, and the service that receives bookings and enquiries (Cloudflare Workers). It stores the short-lived booking records in clause 4 (Cloudflare KV) and provides the bot check, Cloudflare Turnstile. Turnstile loads from Cloudflare only when you send a booking or enquiry, never when a page loads. It runs in your browser and may use your IP address and browser details to tell people from automated programs.
• Google LLC (United States) provides our calendar and video meetings (Google Calendar and Google Meet), our email (Gmail and the enquiry mailbox) and the private spreadsheet (Google Sheets). Google sends you a calendar invitation. Our booking service reaches these Google services through a small script, a Google Apps Script web app, that runs under the Company's own Google account. The booking confirmation email, with a calendar file, is sent to you from the Company's Google account.

Our staff and professional advisers (under a duty of confidence) can see this data, and we may disclose it where the law requires, for example to a court or regulator. No analytics company receives visitor data from this site. Our staff may use an AI assistant, such as Anthropic's Claude, to help read and answer enquiries. It sees only what a member of staff chooses to give it, under the Company's own account, and we make no decision about you by automated means alone.

Transfers outside the UK. Vercel, Cloudflare and Google process data in the United States and elsewhere. We make such transfers only where UK regulations approve the destination; where the provider is certified under the UK extension to the EU-US Data Privacy Framework (the UK-US data bridge); or where an appropriate safeguard applies, such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, and we are satisfied the protection is not materially lower than UK law gives. A narrow exception under Article 49 applies only where none of these fits. Our staff may also read this data from outside the UK, through secured company accounts and under the same rules. You can ask us for a copy of the safeguard that applies (clause 10).

6. Children

This website is for adults and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, tell us and we will delete it.

7. Security and breaches

We limit access to this data to the people who need it, protect our accounts with two-step verification, and send traffic over encrypted connections. The site sends security headers, including a strict content security policy. If a personal data breach is likely to put people at risk we will report it to the ICO within 72 hours of becoming aware of it, and we will tell the people affected without undue delay where the risk is high.

8. Your rights

You can ask us for a copy of your personal data, to correct it, to erase it or to restrict how we use it. You can object to processing that rests on our legitimate interests, and we will stop unless we can show compelling grounds that override your interests, rights and freedoms. You can ask for your data in a portable form where that applies, and withdraw consent at any time where we rely on it. When you ask for a copy we search for your data in a reasonable and proportionate way.

We reply within one month of receiving your request, or of receiving the proof of identity we ask for if that is later. For a complex request we may extend this by up to two further months, and we will tell you why within the first month. There is no fee unless a request is clearly unfounded or excessive. Send requests to legal@scoutatlas.uk.

If you are in Saudi Arabia, the Saudi Personal Data Protection Law gives you rights to be informed and to access, correct and ask us to destroy your data; we answer within 30 days and you may complain to the Saudi Data and Artificial Intelligence Authority. If you are in Jordan, Jordan Law No. 24 of 2023 gives you equivalent rights. This site is written to UK law, and local law prevails where it differs.

9. Complaints

Please tell us first. Complain by email to legal@scoutatlas.uk, by post to our registered office, or through the enquiry form (say that it is a complaint). We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain at any time to the Information Commission, which regulates data protection in the UK and continues to use the name ICO, at ico.org.uk or on 0303 123 1113.

10. Contact

Questions about this notice, rights requests and complaints go to legal@scoutatlas.uk, or by post to Scout Atlas Limited, 1 Armstrong House, High Street, Uxbridge, UB8 1GJ. The directors are responsible for data protection. We have not appointed a data protection officer, as we do not currently think the law requires one.

11. Accessibility and changes

This notice is available in plain text on request; see the accessibility statement. We may update this notice. The effective date at the top shows when it last changed, and we will tell active clients of material changes.