Registered name: Annika de Friend Advisory Ltd
Last updated: November 2026
This privacy notice explains how Annika de Friend Advisory Ltd (“we”, “us”, “our”) collects, uses, shares and protects personal information about the people we deal with in running our strategic and commercial advisory business and the rights those people have.
We are the controller of your personal information. For more information on controllers and their responsibilities, please see the ICO’s guidance on data protection principles, definitions and key terms.
20 Wenlock Road, London, N1 7GU
07956 283816
This notice applies to:
Clients – the individuals we deal with at businesses that engage us, such as founders, directors and managers.
Prospective clients – individuals at businesses we would like to work with, or who have enquired about our services.
People who complete our online scorecards or assessments and ask us for a personalised report.
Visitors to our website and people who contact us through it.
People whose information our clients share with us – for example, members of a client’s team who are referred to in performance or other business information a client provides so that we can advise them.
Suppliers and other business contacts – individuals at organisations that provide services to us (for example, our IT support provider and professional advisers), referral partners and other professional contacts.
We collect or use the following information to provide our advisory services to clients:
Names, job titles and business contact details;
LinkedIn profile URLs;
Meeting notes, records of meetings and decisions, and correspondence;
Audio and video recordings and transcripts of meetings, where meetings are recorded;
Business information a client shares with us so that we can advise them, such as company financial information, client spend data and team performance information. This may include personal information about the client’s staff (for example, names, roles and performance or sales figures); and
Feedback, compliments or complaints.
We collect or use the following personal information to provide our online scorecards and personalised reports:
First name, surname, email address and mobile number;
Agency name, team size and how long the business has been trading;
Your answers to the scorecard or assessment questions and any written reflections; and
The personalised report we prepare for you, and our correspondence about it.
We collect or use the following personal information to run, secure and improve our website:
Information you give us through website forms, such as your name, business contact details and message;
Technical information, such as your IP address, browser and device type, collected to deliver and protect the website; and
Information about how you use the website (for example, pages visited), where you have agreed to analytics cookies or the law otherwise allows it.
We collect or use the following personal information for the operation of client accounts:
Names and business contact details;
Billing addresses;
Service history, agreed terms of business and records of acceptance;
Invoices and payment information; and
Marketing preferences.
We collect or use the following personal information for prospecting and marketing:
Names, job titles and business email addresses;
LinkedIn profile URLs and other professional profile information;
Company information used to decide whether a business fits our target client profile (for example, whether the contact is a founder and the size of their team);
Notes of our contact and interactions with you; and
Marketing preferences, including any opt-out.
We collect or use the following personal information to manage our suppliers and business contacts:
Names, job titles and business contact details;
Correspondence, contracts and records of services provided; and
Invoices and payment information.
We collect or use the following personal information to comply with legal requirements:
Names and contact information; and
Client account, invoicing and accounting records.
We collect or use the following personal information for dealing with queries, complaints or claims:
Names and contact details;
Service history and client records;
Financial transaction information; and
Correspondence.
Sensitive information. We do not need, and do not ask for, special category information (such as information about health, ethnicity, religion or sexual orientation) or criminal offence information. We ask clients not to include this type of information in anything they share with us. If it is shared with us unexpectedly, we will delete it unless we have a lawful reason to keep it.
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. Which lawful basis we rely on may affect your data protection rights, which are set out in brief below.
Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which mean you may not receive all the information you ask for.
Your right to rectification – You have the right to ask us to correct or complete personal information you think is inaccurate or incomplete.
Your right to erasure – You have the right to ask us to delete your personal information.
Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.
Your right to object to processing – You have the right to object to the processing of your personal information. You have an absolute right to object to direct marketing, and we will stop as soon as you tell us.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis, you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for collecting or using personal information to provide our advisory services to clients are:
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our legitimate interests are:
We have a legitimate interest in providing and improving our strategic and commercial advisory services to recruitment businesses. We use client representatives’ names, contact details, relevant correspondence, meeting notes and advisory records to communicate with them, understand their business priorities, tailor our advice and maintain continuity between sessions.
Clients may also share business information with us, such as financial information, client spend data and team performance information, which may identify members of their staff. We use this only to understand the client’s business and give relevant advice. We ask clients to share only what we need, we keep it confidential, we restrict access to it, and we do not use it to make decisions about individual staff members – those decisions remain with the client.
We also use relevant feedback to improve our services, using anonymised information wherever possible. Clients would reasonably expect this use of their information within an advisory relationship. We balance these benefits against potential privacy impacts by limiting the information we collect, protecting its confidentiality and restricting access to those who need it. Individuals can object to processing based on legitimate interests, and we consider each objection.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details set out above.
Our lawful basis for collecting or using personal information to provide our online scorecards and personalised reports is:
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our legitimate interests are:
We have a legitimate interest in responding to founders who complete one of our scorecards or assessments and ask for a personalised report. We use the details and answers you submit to review your responses, prepare your report and send it to you. Nothing is sent to us unless you choose to submit your answers.
You would reasonably expect us to use your submission in this way, and we use it only for that purpose. We may follow up once to ask whether you would like to discuss your report. Completing a scorecard does not sign you up to our marketing emails, and we will only add you to them if you ask us to. Individuals can object to processing based on legitimate interests, and we consider each objection.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details set out above.
Our lawful bases for collecting or using personal information to run, secure and improve our website are:
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. You can withdraw your consent at any time.
Our legitimate interests are:
We have a legitimate interest in running a secure, working website, responding to enquiries sent through it, and understanding in general terms how it is used so that we can improve it. We use only the technical and contact information needed for these purposes. Visitors would reasonably expect this, and the privacy impact is low.
Where the law requires consent for cookies or similar technologies that are not strictly necessary, such as some analytics cookies, we will ask for it through our cookie banner, and you can change your choice at any time.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details set out above.
Our lawful bases for collecting or using personal information for the operation of client accounts are:
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our legitimate interests are:
We have a legitimate interest in managing client accounts efficiently and maintaining accurate records of our business relationships. We use client representatives’ names, contact details, billing addresses, service history and account correspondence to manage bookings, communicate about services, administer billing and resolve account queries. We also keep communication preferences so these can be respected.
This information is necessary to identify the correct client contacts, keep accounts accurate and provide a reliable service. Client representatives would reasonably expect this use of their information. We consider the limited privacy impact proportionate, provided we use only necessary information, keep it secure, restrict access and keep it only for as long as needed. Individuals can object to processing based on legitimate interests, and we consider each objection.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details set out above.
Our lawful bases for collecting or using personal information for prospecting and marketing are:
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. You can withdraw your consent at any time.
Our legitimate interests are:
We have a legitimate interest in identifying and contacting businesses that may benefit from our strategic and commercial advisory services, and in sharing relevant insights, service updates and event invitations with business contacts. We use names, job titles, business contact details, LinkedIn profile URLs, publicly available company information and marketing preferences to identify appropriate contacts, check whether a business fits our target client profile, make our communications relevant to the recipient’s role, and respect their preferences.
We contact people in their professional capacity only, about services relevant to their role. We assess whether recipients would reasonably expect this contact, taking account of their professional role, how we obtained their details and any existing relationship. We balance the benefits against possible intrusion by limiting the information we use, keeping communications relevant and proportionate, and providing a clear, easy opt-out in every marketing email.
We send marketing emails to people at limited companies and other corporate bodies on the basis of our legitimate interests. Where the law requires consent – for example, for sole traders and some partnerships, unless they are existing clients who have not opted out – we will only send marketing emails with consent. If someone objects to direct marketing, we stop immediately and keep only the details needed to make sure we do not contact them again.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details set out above.
Our lawful bases for collecting or using personal information to manage our suppliers and business contacts are:
Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our legitimate interests are:
We have a legitimate interest in managing our relationships with suppliers, referral partners and other business contacts, so that we can receive the services we need, pay for them and keep in touch. We use only names, business contact details, correspondence and records of the services provided. People acting in a business capacity would reasonably expect this, and the privacy impact is low.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details set out above.
Our lawful basis for collecting or using personal information to comply with legal requirements is:
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our legitimate interests are:
We have a legitimate interest in responding to queries, investigating and resolving complaints fairly, and establishing, exercising or defending legal claims. We use relevant names, contact details, correspondence, service history, client records and transaction information to understand what happened, check the facts, communicate with those involved and reach an appropriate resolution. People would reasonably expect relevant information to be reviewed when they raise a query, complaint or claim.
We recognise that these records may contain confidential information or disputed allegations. We balance the benefits against potential privacy impacts by considering only relevant information, checking its accuracy, restricting access and sharing it with advisers or insurers only where necessary. We keep records securely and only for as long as needed. Individuals can object to processing based on legitimate interests, and we assess objections in accordance with data protection law.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details set out above.
Directly from you – for example, when we meet, speak or correspond, or when you complete one of our scorecards, website forms or other forms
Our website – technical information collected automatically when you visit, as described above
Our clients – for example, business information about their teams that they share with us so that we can advise them
Publicly available sources – such as LinkedIn, company websites and Companies House
AI-assisted prospecting and research tools – including our prospecting system, Max OS, which identifies businesses that may fit our target client profile using Companies House, company websites, public LinkedIn profiles and company pages, Google search results and email finding and checking services, and provides business contact details (name, job title, employer, LinkedIn profile URL and work email address); and general AI assistants (ChatGPT and Claude) that we use to help find publicly available business email addresses and LinkedIn profile URLs
Professional contacts, referral partners and existing clients who introduce prospective clients and share their contact details with us
Where we obtain your details from someone other than you, we will give you this notice, or a link to it, when we first contact you or, if we do not contact you, within one month of obtaining your details.
We use AI tools to help us run the business efficiently, including to research and identify potential clients, and to help with drafting, summarising and analysing information. Our prospecting system, Max OS, finds UK companies that match our target client profile (for example, a founder-led business with two or more staff), identifies a suitable person to contact and drafts a first email or LinkedIn message. It never sends anything: Annika reviews every lead and sends every message herself.
These tools support our decisions; they do not make decisions about you that have legal or similarly significant effects. The only outcome is whether we decide to contact you about our services, and you can ask us to stop at any time. We check information produced by AI tools before relying on it, and we correct or delete contact details that turn out to be inaccurate. When we use AI tools to help prepare a personalised scorecard report, we remove your name, contact details and agency name first.
| Information | Retention period | Reason / action |
|---|---|---|
| Company accounting and tax records – invoices, receipts, payment and supporting records | Six years from the end of the company financial year they relate to, or longer where legally required. | Meet accounting and tax requirements. |
| Client agreements and essential advisory records – agreed scope, final advice, decisions and relevant correspondence | During the engagement, then six years after it ends. | Evidence the services provided and deal with any potential claims. We keep relevant records, rather than everything. |
| Business information shared by clients, including team performance information about client staff | During the engagement, then deleted or returned within three months of it ending. | Only needed to give advice. Anything forming part of our final advice is kept with the client record above. |
| Meeting or call recordings and full AI transcripts, where used | During the client relationship. | Allow us to check back on notes when needed. Key points are kept in our meeting notes. |
| Prospects who haven’t responded | 12 months from obtaining their details. | Deleted (including from Max OS) if there has been no meaningful engagement or documented reason to keep them. |
| Engaged prospects, unsuccessful enquiries and “not now” contacts | 24 months after the last meaningful interaction. | Allow for a longer buying cycle. Extended only for a documented reason, such as an agreed future follow-up. |
| Scorecard and assessment submissions and personalised reports from people who don’t become clients | 24 months after the last meaningful interaction. | Support follow-up about the report. Submissions are deleted from our form provider once saved to our CRM. If you become a client, we keep only relevant information in your client record. |
| Recruitment Founder Reflection responses and discovery notes from people who don’t become clients | 24 months after the last meaningful interaction, deleting unnecessary details sooner. | Support relevant follow-up. If they become clients, we keep only relevant information within their client record. |
| Marketing subscribers and their preferences | While subscribed and marketing remains relevant; reviewed after 24 months without meaningful engagement. | Inactive records removed unless continued retention is justified. Marketing stops immediately on withdrawal or objection. |
| Marketing opt-outs / suppression list | For as long as needed to make sure we do not contact you again. | We keep only the identifiers needed, plus the date and scope of the opt-out. |
| Evidence of marketing consent | While we rely on consent, then three years after the last marketing sent under it, unless needed for an ongoing complaint. | Show how permission was obtained. |
| Website technical and security logs | In line with our hosting provider’s settings, normally no longer than 12 months. | Deliver and protect the website. |
| Website analytics information, where used | No longer than 14 months. | Understand how the website is used, in aggregate, so we can improve it. |
| Routine queries (including website enquiries) that don’t lead to an engagement | 12 months after resolution. | Handle follow-up questions, then delete unless another category applies. |
| Substantive complaints, disputes and claims | Six years after final resolution, or longer where legal advice or insurance requirements justify it. | Keep the evidence needed to explain the outcome or handle related proceedings. |
| Data protection requests and responses | Three years after closure. | Show how the request was handled. Identity documents are deleted once verification is complete. |
| Supplier contact details and correspondence | During the relationship, then 12 months after it ends for routine information. | Contracts and essential dispute records are kept for six years; invoices under the accounting rule. |
For more information on how long we keep your personal information, or the criteria we use to decide this, please contact us using the details above.
We do not sell personal information, and we do not share client or prospect contact details with other businesses for their own marketing.
These organisations provide services to us and use personal information only on our instructions:
| Name of processor | What the data processor does for us |
|---|---|
| HubSpot | Provides our CRM system, storing and organising prospect and client contact details, correspondence, marketing preferences and service records, and sending our marketing emails. |
| Max OS (Russell Bennett Ltd) | Provides our AI-assisted prospecting system, which finds businesses that match our target client profile, provides business contact details for a suitable contact and drafts first messages for us to review. Data is stored on a dedicated server in London. |
| Formspree | Receives and stores submissions from our online scorecards and forms and passes them to us. |
| Cloudflare (Cloudflare Pages) | Hosts our online scorecards, this privacy notice and, when launched, our website, processing technical information such as IP addresses to deliver and secure the pages. |
| Microsoft – Microsoft 365 | Provides business email, document storage, collaboration and online meetings, processing personal information within correspondence, files and meeting records. |
| Avensys Tech | Provides IT management, support, security and backup services, with access to personal information where necessary to deliver those services. |
| Xero | Provides accounting and invoicing software, storing client and supplier details, invoices and financial transaction records. |
| Calendly | Manages appointment bookings, including names, contact details, booking responses and calendar information. |
| Jotform | Provides online forms and document workflows for sending terms of business and collecting client details, responses and acceptance records, including electronic signatures where used. |
| Otter.ai | Records and transcribes meetings and produces summaries, processing participants’ names, voices and information discussed during meetings. |
Providers of the general AI assistants we use for research, drafting, summarising and analysis – OpenAI (ChatGPT) and Anthropic (Claude). We use these services under the providers’ standard terms, so they process information we submit as independent controllers under their own privacy policies. We limit what we submit to what is needed (for example, a name and company when looking up publicly available business contact details), we do not submit clients’ staff information, and we have switched off the use of our content to train the providers’ models.
Our accountants, JKS Outsourcing, who provide accounting and tax services using our invoicing and payment records
Professional advisers, such as our lawyers and insurers
Organisations we are legally obliged to share personal information with, such as HMRC
Some of the organisations we use are based outside the UK, or use support teams and infrastructure outside the UK. When personal information is transferred outside the UK, we make sure it is protected in line with the UK GDPR, either because the country has been assessed by the UK as providing adequate protection, or by using an approved safeguard such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
For further information, or to obtain a copy of the safeguard for any of the transfers below, please contact us using the details above.
Organisation name: HubSpot, Inc. and its affiliates
Category of recipient: CRM and marketing email provider
Country the personal information is sent to: United States (and other countries where HubSpot’s support teams and sub-processors are based)
How the transfer complies with UK data protection law: The UK Addendum to the EU Standard Contractual Clauses in HubSpot’s Data Processing Agreement, and the UK Extension to the EU-US Data Privacy Framework.
Organisation name: Microsoft Corporation and its affiliates
Category of recipient: Email, document storage, collaboration and cloud provider
Country the personal information is sent to: European Union (where our Microsoft 365 data is stored), with limited remote access by Microsoft support teams in other countries, including the United States
How the transfer complies with UK data protection law: European Union: UK adequacy regulations. Remote support access from other countries: the UK Addendum to the EU Standard Contractual Clauses in Microsoft’s Data Protection Addendum, and, for the United States, the UK Extension to the EU-US Data Privacy Framework.
Organisation name: Specialist services used by Max OS (Anthropic, Apify, Hunter, Bouncer and MillionVerifier)
Category of recipient: Message drafting, public profile research, and email finding and checking for our prospecting system. Max OS stores our data in the UK and sends each service only the minimum information it needs
Country the personal information is sent to: United States (Anthropic; some Apify and Hunter processing) and the European Union
How the transfer complies with UK data protection law: European Union: UK adequacy regulations. United States: the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, under each provider’s data processing terms.
Organisation name: Formspree, Inc.
Category of recipient: Online form provider for our scorecards and website forms
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: The safeguards set out in Formspree’s data processing terms (details available on request).
Organisation name: Cloudflare, Inc.
Category of recipient: Website hosting and security provider
Country the personal information is sent to: United States and other countries in Cloudflare’s global network
How the transfer complies with UK data protection law: The UK Extension to the EU-US Data Privacy Framework, and the UK Addendum to the EU Standard Contractual Clauses in Cloudflare’s Data Processing Addendum.
Organisation name: Xero Limited and its affiliates and sub-processors
Category of recipient: Accounting software hosting, infrastructure and support
Country the personal information is sent to: New Zealand, the United States, Australia and other countries listed by Xero
How the transfer complies with UK data protection law: New Zealand: UK adequacy regulations. Other countries: the safeguards set out in Xero’s data processing terms.
Organisation name: Otter.ai, Inc.
Category of recipient: AI meeting recording, transcription and summarisation provider
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: The recipient is certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which the UK Government has assessed as providing adequate protection.
Organisation name: Calendly, LLC
Category of recipient: Online appointment scheduling provider
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: The recipient is certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which the UK Government has assessed as providing adequate protection.
Organisation name: Jotform Inc.
Category of recipient: Online forms and electronic document/signature provider
Country the personal information is sent to: United States
How the transfer complies with UK data protection law: The recipient is certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which the UK Government has assessed as providing adequate protection.
Organisation name: JKS Outsourcing
Category of recipient: Accounting and tax services provider
Country the personal information is sent to: Sri Lanka
How the transfer complies with UK data protection law: We are putting a UK International Data Transfer Agreement (IDTA) in place with JKS Outsourcing.
Organisation name: OpenAI (ChatGPT)
Category of recipient: General AI assistant for research, drafting, summarisation and analysis
Country the personal information is sent to: United States and other countries where OpenAI operates
How the transfer complies with UK data protection law: We use this service under OpenAI’s standard terms. OpenAI is responsible for protecting the information it receives and, as described in its privacy policy, relies on adequacy regulations and standard contractual clauses for international transfers.
Organisation name: Anthropic (Claude)
Category of recipient: General AI assistant for research, drafting, summarisation and analysis
Country the personal information is sent to: United States and other countries where Anthropic operates
How the transfer complies with UK data protection law: We use this service under Anthropic’s standard terms. Anthropic is responsible for protecting the information it receives and, as described in its privacy policy, relies on adequacy regulations and standard contractual clauses for international transfers.
We use appropriate technical and organisational measures to protect personal information, including access controls, security software and backups managed by our IT support provider. Access to personal information is limited to those who need it.
If you have any concerns about our use of your personal information, you can make a data protection complaint to us:
Email: annika@annikadefriend.co.uk
We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
This notice covers our website and online scorecards. Our scorecard pages do not currently use cookies or analytics. If we use cookies that are not strictly necessary, for example on our website, our cookie banner and cookie notice will explain them and ask for your consent where the law requires it.
We keep this notice under review and will update it if we change how we use personal information, for example if we start using a new supplier or tool. The date at the top shows when it was last updated.