PRIVACY POLICY
RPNA Consulting · ICO Registration: ZB541978 · Last updated: 31 March 2026
1. WHO WE ARE
This privacy policy applies to the website therpna.co.uk and is issued by:
RPNA
Unit 5 Brockley Road
Elsworth
Cambridge
CB23 4EY
Email: speaktous@therpna.co.uk
RPNA is registered as a Data Controller with the Information Commissioner's Office (ICO). Our ICO registration number is ZB541978.
We are the Data Controller for the personal data collected through this website. This means we determine the purposes and means of processing your personal data.
2. WHAT PERSONAL DATA WE COLLECT
Through this website we collect the following categories of personal data:
- First name
- Last name
- Email address
This data is collected when you submit an enquiry or contact form, sign up to receive communications from us, or otherwise interact with our website.
Where we indicate that certain data is mandatory, failure to provide it may prevent us from responding to your enquiry or providing the service requested.
3. WHY WE COLLECT IT — OUR LAWFUL BASIS
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we must have a lawful basis for processing your personal data. We rely on the following:
- Consent: Where you have given us clear consent to process your data for a specific purpose, such as subscribing to receive communications from us. You may withdraw your consent at any time by contacting us at speaktous@therpna.co.uk.
- Contract performance: Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract. This applies, for example, where you engage RPNA to deliver services and we need to process your contact details to do so.
- Legitimate interests: Where processing is necessary for the purposes of our legitimate business interests, such as responding to unsolicited enquiries, improving our services, and managing our relationship with prospective clients, provided those interests are not overridden by your rights and interests.
If you are uncertain which basis applies to your data, or wish to understand more, please contact us using the details in Section 9.
4. HOW WE STORE, USE AND SHARE YOUR PERSONAL DATA
Platform and Hosting
Our website is hosted on the Wix.com platform. Wix provides us with the online platform that allows us to deliver our services and communicate with you. Your data may be stored through Wix's data storage systems, databases, and applications. Wix stores data on secure servers protected by firewalls.
International Data Transfers
As Wix is a global company, your personal data may be stored in data centres located in the United States, Ireland, South Korea, Taiwan, and Israel. We take steps to ensure your data is protected when transferred outside the United Kingdom, in accordance with UK GDPR requirements.
We rely on the following safeguards, as set out in the Wix Data Processing Agreement (DPA):
- Adequacy decisions: Wix is headquartered in Israel, which the UK Government and the European Commission both recognise as providing an adequate level of data protection.
- Standard Contractual Clauses (SCCs): For transfers to other countries (including the United States), Wix uses Standard Contractual Clauses, including the UK International Data Transfer Addendum (IDTA), to provide protection equivalent to that required under UK GDPR.
Our Role and Wix's Role
In legal terms, RPNA acts as the Data Controller and Wix.com acts as our Data Processor. Wix processes your data solely on our instructions and on our behalf. Wix is contractually committed to maintaining technical and organisational safeguards to protect your data, including encryption and, where relevant, PCI DSS compliance.
Other Sharing
We do not sell, trade, or otherwise transfer your personal data to third parties for their own marketing purposes. We may share data with trusted service providers who assist us in operating our business, subject to confidentiality obligations.
We may disclose personal data where required to do so by law, in response to legal process, or to protect our rights and interests or those of our users.
5. HOW LONG WE KEEP YOUR DATA
We retain personal data only for as long as necessary for the purpose it was collected, and in accordance with our legal obligations.
- Enquiry and contact data: retained for 24 months from the date of last contact. This reflects the typical length of a business relationship or sales conversation in our sector. If you become a client, your data will be retained for the duration of our engagement and for 6 years thereafter, in line with our statutory obligations.
- Newsletter and marketing data: retained for as long as you remain subscribed. If you unsubscribe, your data will be deleted within 30 days, except where we are required to retain a record of your preference to ensure we do not contact you again.
Once the relevant retention period expires, personal data is securely deleted or anonymised. Please note that once data is deleted, the rights of access, erasure, rectification, and portability can no longer be exercised in relation to it.
6. COOKIES AND TRACKING TECHNOLOGIES
Our website uses cookies — small text files placed on your device — to support its operation and, where you consent, to help us understand how the site is used.
Types of Cookies We Use
- Strictly necessary cookies: These are essential to the functioning of the website and do not require your consent. They include session management and security cookies set by Wix.
- Analytics cookies: Used to understand how visitors interact with our website (for example, pages visited and time spent). These are only set with your consent.
- Marketing and tracking cookies: Used to help deliver relevant content. These are only set with your consent.
Your Cookie Choices
When you visit our website, you will be presented with a cookie consent banner. You can accept all cookies, decline all non-essential cookies, or manage your preferences by category. Accepting and declining options are given equal prominence.
Non-essential cookies are not placed on your device until you have actively consented. You can change your preferences at any time by clearing your browser cookies and revisiting the site, which will prompt the banner to reappear.
We comply with the UK Privacy and Electronic Communications Regulations (PECR) in addition to UK GDPR.
7. YOUR RIGHTS UNDER UK GDPR
You have the following rights in relation to your personal data, subject to certain conditions and exemptions:
- The right to access: you may request a copy of the personal data we hold about you.
- The right to rectification: you may ask us to correct inaccurate or incomplete data.
- The right to erasure: you may ask us to delete your personal data in certain circumstances.
- The right to restrict processing: you may ask us to limit how we use your data.
- The right to data portability: you may request your data in a structured, machine-readable format.
- The right to object: you may object to processing based on legitimate interests or for direct marketing purposes.
- The right to withdraw consent: where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact us at speaktous@therpna.co.uk. We will respond within one month. Requests are free of charge.
8. HOW TO MAKE A COMPLAINT
If you have concerns about how we handle your personal data, please contact us in the first instance at speaktous@therpna.co.uk and we will do our best to resolve the matter.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
9. CONTACT US
For any questions about this policy or how we use your personal data:
Email: speaktous@therpna.co.uk
Post: RPNA, Unit 5 Brockley Road, Elsworth, Cambridge, CB23 4EY
10. CHANGES TO THIS POLICY
We may update this policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the date at the top of this page. Where changes are material, we will make reasonable efforts to notify you. We recommend checking this page periodically.
Last updated 31 March 2026