Privacy Notice

1. Who we are

NRK Forma is the data controller for most personal data collected through this website, direct enquiries, business development activity and our own operations. This means we decide why and how that personal data is processed.

Where we process personal data on behalf of a client as part of a client project, campaign, website, CRM, analytics setup, automation flow or other service, we may act as a data processor. In those circumstances, the client will usually be the controller and our processing will be governed by the relevant written agreement, statement of work, data processing terms or instructions.

2. What this notice covers

This Privacy Notice applies to personal data we process in connection with our website, enquiries, discovery calls, proposals, audits, client onboarding, service delivery, supplier relationships, marketing activity, security, administration and business operations.

Separate client agreements, data processing agreements, statements of work or other written terms may apply to specific engagements. Where a signed agreement applies to a specific project or service, that agreement will normally take priority for that engagement.

3. Personal data we may collect

• Website and technical data, including IP address, browser, device, operating system, approximate location, referral source, pages visited, interactions, diagnostics, performance data, security logs and request metadata.
• Contact and enquiry data, including name, email address, telephone number where provided, company or brand name, role, location, website details, service interests, budget range, project information, message content, meeting notes and communication preferences.
• Client and project data, including business contact details, project requirements, briefs, strategy documents, brand assets, website data, analytics data, CRM data, advertising or email platform information, access permissions, approvals, feedback, billing records and delivery records.
• Marketing and relationship data, including communication preferences, consent or opt-out status, content engagement, event or meeting attendance, service interests and business development notes.
• Supplier, contractor and partner data, including contact details, professional background, portfolio information, contracts, invoices, payment details, tax information, access permissions and correspondence.
• Information from public sources and third parties, including company websites, professional networks, social media platforms, business directories, public registers, referrals, clients, suppliers, analytics platforms, CRM tools, email providers, hosting providers and communication platforms.

4. Sensitive personal data and children

We do not actively seek to collect sensitive personal data through our website or standard business processes. Please do not send us sensitive personal data, confidential information or unnecessary third-party personal data through public forms unless we specifically request it or it is clearly required for the matter you are raising.

Our website and services are intended for business users and are not directed at children. We do not knowingly collect personal data from children through this website.

5. How we use personal data

6. Lawful bases

Where UK data protection law applies, we process personal data under one or more lawful bases depending on the context. These may include contract performance, steps before entering into a contract, legitimate interests, consent, legal obligation and the establishment, exercise or defence of legal claims.

Our legitimate interests may include operating and improving our business, responding to relevant enquiries, maintaining accurate records, developing client relationships, protecting our systems, preventing misuse, improving our services and communicating with appropriate business contacts.

7. Testimonials, project material and public content

NRK may publish testimonials, portfolio material, project descriptions, performance scenarios, and service examples. Genuine testimonials are based on experiences communicated by people for whom NRK has performed work or provided relevant support. Permission will be obtained before a testimonial is attributed to an identifiable individual.

Certain case-study narratives, figures, audit examples, and performance outcomes are illustrative. They are used to demonstrate the types of challenge, strategy, opportunity, and potential result that NRK’s services may address and should not be interpreted as audited records relating to an identifiable client.

Where public material is derived from a genuine engagement, NRK may remove, replace, generalise, or condense identifying information to protect confidentiality, provided that doing so does not materially misrepresent the underlying experience.

8. Aliases and pseudonymisation

NRK may replace names and other direct identifiers with aliases, role descriptions, broad locations, or generalised business categories when presenting testimonials or project material. This is intended to reduce unnecessary identification and protect the privacy of the people and organisations involved.

Where NRK retains information that can reconnect an alias to a specific person, that information remains personal data. Any identifying key or mapping information will be kept separately, access-restricted, and protected using appropriate organisational and technical measures.

9. Accuracy and correction of public material

NRK takes reasonable steps to ensure that attributed testimonials accurately reflect the contributor’s experience and that privacy-protective edits do not change their substantive meaning. A contributor may contact NRK to request correction, further anonymisation, or removal of attributed personal information, subject to any applicable legal or contractual considerations.

10. Marketing communications

We may send information about our services, insights, events, updates, content or opportunities where you have requested it, where you have consented, or where we are otherwise permitted to do so.

In a business-to-business context, we may contact relevant professional contacts where we believe our services may be of legitimate interest to them, provided this is lawful and balanced against their rights and expectations. You can ask us to stop sending marketing communications at any time by contacting nrkdirector@gmail.com or using any unsubscribe option provided.

11. Analytics and similar technologies

Our website may use privacy, performance, analytics, diagnostic or similar technologies to operate the website, understand usage, measure performance, improve content, protect security and support business decisions.

Some technologies are necessary to operate and protect the website. Others may only be used where lawful and, where required, with consent. We do not use this notice to claim that a separate cookie policy exists unless one is published.

12. AI-assisted tools and automation

NRK Forma may use AI-assisted tools, automation and software systems to support internal research, drafting, analysis, quality assurance, content development, strategy work, technical review, administration and service delivery.

We aim to use these tools responsibly, proportionately and in line with confidentiality, security and data protection obligations. We do not intend to submit highly sensitive, unnecessary or clearly confidential personal data into AI-assisted tools unless suitable safeguards are in place, the processing is necessary for the relevant purpose, or this has been agreed with the relevant client.

13. Sharing personal data

We may share personal data where reasonably necessary with trusted service providers, clients, project stakeholders, contractors, collaborators, professional advisers, regulators, public authorities, courts, law enforcement, insurers and parties involved in a business transfer, investment, restructuring or similar transaction.

Service providers may include hosting, infrastructure, database, CRM, lead management, email delivery, analytics, advertising, project management, collaboration, design, development, testing, payment, banking, accounting, bookkeeping, cloud storage and document management providers.

We do not sell or rent personal data.

14. International transfers

Some service providers, contractors, platforms, infrastructure providers or business partners may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we will take steps designed to ensure that appropriate safeguards are in place where required by law. These may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, standard contractual clauses, transfer risk assessments and other lawful transfer mechanisms available from time to time.

15. Retention

16. Security

We maintain reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, unlawful use, accidental loss, alteration, disclosure or destruction.

These safeguards may include access controls, authentication, permission management, secure hosting, encryption where appropriate, monitoring, logging, backup practices, supplier due diligence, confidentiality obligations, internal security procedures, secure development practices and incident assessment processes.

No website, platform, database, communication channel or storage system can be guaranteed to be completely secure. You should only provide information that is appropriate for the channel used.

17. Your rights

To exercise your rights, contact nrkdirector@gmail.com. We may need to verify your identity before responding. Some rights are subject to legal limits, exceptions and competing obligations.

• Object to processing where we rely on legitimate interests, including profiling related to direct marketing.
• Request access to personal data we hold about you.
• Ask us to correct or update inaccurate or incomplete personal data.
• Ask us to delete personal data in certain circumstances.
• Ask us to restrict processing in certain circumstances.
• Request portability of certain personal data where applicable.
• Withdraw consent where we rely on consent.
• Complain to the UK Information Commissioner’s Office or another relevant data protection authority.

18. Third-party websites and changes

Our website, emails or services may link to third-party websites, platforms, applications, tools or services. We are not responsible for the privacy practices, security, content, availability or policies of third-party services.

We may update this Privacy Notice from time to time to reflect changes in law, regulatory guidance, technology, our services, our suppliers, our website or the way we process personal data. The latest review date appears at the top of this page.