Privacy Policy
Last updated: 10 November 2026
This Privacy Policy explains how MAXWELLSTONE LTD collects, uses and looks after personal data when you use https://consultmws.com (the "Website") or contact us about our AI, data and process consulting services, including the AI Leadership Workshop.
We handle personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
This Website is operated by MAXWELLSTONE LTD, a company registered in England and Wales with company number 13563568. Our registered office is 30 Churchill Place, Canary Wharf, London, England, E14 5RE. We trade as mws+ and MaxWellStone Consulting.
MAXWELLSTONE LTD is the data controller for personal data collected through this Website and through the enquiry, workshop and booking channels described below.
We are part of the MaxWellStone network. The group site at https://maxwellstone.co.uk is operated by a separate organisation, registered in the Netherlands under KVK 58213864, at Denariusstraat 25D, 4903 RC Oosterhout. That organisation is not the controller of personal data collected through this Website.
MAXWELLSTONE LTD is registered with the Information Commissioner's Office (ICO) as a data controller.
Our contact page also lists office locations in Zurich and Dubai. Those are additional places of contact. They do not change the identity of the UK controller or our registered office.
2. How to contact us
For questions about this policy or your personal data:
- Email: [email protected]
- Telephone: +44 131 381 7671
- Post: MAXWELLSTONE LTD, 30 Churchill Place, Canary Wharf, London, England, E14 5RE
3. Personal data we collect
Information you provide
- Enquiry and lead forms: name, email address, company, role or job title, and your message. Some forms may also ask for a telephone number or other details you choose to include.
- Calls and bookings: your name, email address, company, role, the time you book, and any notes about the call.
- Newsletter or updates: your name and email address, if you ask to hear from us.
- Email, telephone or post: the contact details and information you include in your correspondence.
Please do not send us special category data (for example, health information) or anyone else's personal data unless we have asked for it and it is necessary.
Information collected when you use the Website
- Technical data such as IP address, browser type, device type, pages viewed, dates and times of visits, and referral source.
- Cookie and similar identifiers, as described in section 6.
- Form metadata, such as the time a form is submitted.
We do not knowingly collect personal data from children. Our services are aimed at businesses and professional contacts.
4. How we collect personal data
We collect personal data when you complete an enquiry, workshop or contact form, book a consultation or workshop discussion, email, telephone or write to us, subscribe to updates if we offer them, or allow optional cookies or similar technologies after you make a choice on our cookie banner.
We may also receive information about you from a colleague who refers you, or from a scheduling tool where that is part of an engagement. We do not buy marketing lists.
5. Purposes and lawful bases
We only use personal data where we have a lawful basis under UK GDPR.
- Responding to an enquiry, workshop information request or other message: steps at your request before entering a contract (Article 6(1)(b)), and our legitimate interests in answering business enquiries (Article 6(1)(f)).
- Arranging and holding a call or booking: steps at your request before entering a contract, or performance of a contract (Article 6(1)(b)).
- Providing consulting services and managing a client relationship: performance of a contract (Article 6(1)(b)).
- Sending newsletters or other electronic marketing to you as an individual: consent (Article 6(1)(a)), and PECR consent rules for electronic mail to individual subscribers.
- Sending relevant business-to-business service information to a corporate email address: legitimate interests (Article 6(1)(f)), with a simple way to opt out, in line with PECR for corporate subscribers.
- Operating, securing and maintaining the Website, including strictly necessary cookies: legitimate interests (Article 6(1)(f)), and PECR's exception for cookies that are strictly necessary.
- Analytics, advertising measurement, retargeting and website visitor identification, including Google Analytics 4, Cloudflare Web Analytics, LinkedIn Insight, the Meta pixel, Microsoft Clarity and Apollo: consent (Article 6(1)(a)), and PECR consent for non-essential cookies and similar technologies.
- Keeping records required by law, including tax and accounting records: legal obligation (Article 6(1)(c)).
- Establishing, exercising or defending legal claims: legitimate interests (Article 6(1)(f)).
Where we rely on legitimate interests, we have considered your rights and what you would reasonably expect. You can object to that processing. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before you withdrew consent.
We do not use your data for automated decisions that produce legal or similarly significant effects.
6. Cookies and similar technologies
A cookie is a small file placed on your device. We also use similar technologies, such as pixels, tags and scripts, including through Google Tag Manager.
Strictly necessary cookies are used to make the Website work, to keep a form secure, or to store your cookie choice. They may be set without consent.
The following are used only after you give consent through our cookie banner. If you refuse, or if you do not make a choice, they are not used:
- Google Analytics 4, loaded through Google Tag Manager, to understand how the Website is used.
- Cloudflare Web Analytics, to measure visits and performance.
- The LinkedIn Insight Tag, to measure LinkedIn campaign results and to support LinkedIn advertising.
- The Meta pixel, to measure Meta campaign results and to support advertising on Meta platforms.
- Microsoft Clarity, which may record session interactions such as mouse movements, clicks and scrolling, to help us understand how pages are used.
- Apollo website visitor tracking, which may help us identify organisations that visit the Website.
You can change your mind later by clearing your cookies and using the banner again, or by adjusting your browser settings. Blocking all cookies may affect parts of the Website.
Full details are in our Cookie Policy at https://consultmws.com/cookie-policy.
7. Who we share personal data with
We share personal data with service providers who process it on our instructions, and only where this is needed to run the Website or our services:
- GoHighLevel / LeadConnector, which hosts the Website, forms and related marketing tools.
- Google, including Google Analytics, Google Tag Manager, and Google Workspace or similar services if used for email or documents.
- Microsoft 365, for email, documents and related workplace tools.
- Close CRM, for managing leads and client relationships.
- Apollo, for sales and website visitor insight, and only where you have consented to that tracking or where you otherwise provide data to us for a sales conversation.
- Cloudflare, for website delivery and analytics.
- LinkedIn and Meta, where you have consented to their tags or pixels.
- Professional advisers, such as accountants or lawyers, where needed.
- A purchaser or successor, if we reorganise or transfer our business.
We may also disclose personal data if the law requires it, or if it is necessary to protect our rights, your safety or the safety of others. We do not sell your personal data.
8. International transfers
Some of the providers named above are based outside the United Kingdom, or may store or access data outside the United Kingdom, including in the European Economic Area and the United States.
Where a transfer is not covered by a UK adequacy regulation, we use a lawful transfer mechanism. This will usually be the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, together with any supplementary measures that are appropriate. Where a provider participates in a UK-recognised framework, such as the UK-US data bridge for certified organisations, we may rely on that framework.
You can contact us if you would like more information about the mechanism used for a particular transfer.
9. How long we keep personal data
We keep personal data only for as long as we need it for the purposes set out in this policy, including legal, accounting or reporting requirements.
- Enquiry or lead records, where no contract follows: 24 months from the last meaningful contact.
- Call or booking records, where no client relationship follows: 24 months after the appointment.
- Client and contract records: six years after the relationship ends, which aligns with ordinary UK limitation and tax record periods.
- Newsletter or marketing lists: until you unsubscribe or we close the list, and for a short period afterwards so we can honour your opt-out.
- Cookie consent records: for the life of the consent, and for a period afterwards so we can show that we complied with PECR.
- Analytics or advertising data: for the period set by the relevant tool, typically no longer than 26 months for Google Analytics 4.
We may keep data for longer if we need it for a legal claim, or if the law requires us to do so. When we no longer need it, we delete it or irreversibly anonymise it.
10. Your rights
You have the following rights, in the circumstances set out in UK GDPR:
- Access: to ask for a copy of the personal data we hold about you.
- Rectification: to ask us to correct inaccurate or incomplete data.
- Erasure: to ask us to delete your data, in certain cases.
- Restriction: to ask us to limit how we use your data, in certain cases.
- Objection: to object to processing based on legitimate interests, and to object to direct marketing at any time.
- Portability: to ask for data you provided to us on the basis of consent or contract, in a structured, commonly used and machine-readable format.
- Withdraw consent: where we rely on consent, to withdraw it at any time.
To use any of these rights, contact us using the details in section 2. We may need to confirm your identity. We will respond within one month, or we will tell you if we need more time, as the law allows. These rights are not always absolute. If we cannot comply with a request, we will explain why.
11. Complaints
Please contact us first if you are unhappy with how we have used your personal data. We will try to resolve the matter.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection:
- Website: https://ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Changes to this policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page, with a new "Last updated" date. Please check the page when you return to the Website. If a change is significant, we will take additional steps to bring it to your attention where it is reasonable to do so.
