naked Agility Limited is committed to protecting your privacy and handling your personal data responsibly. This policy explains what we collect, why we collect it, who we share it with, how long we keep it, and your rights under UK GDPR and the Data Protection Act 2018.
We follow a fit-for-purpose information security model tailored to the nature and scale of a small consulting practice. Our privacy and security practices align with the intent of ISO/IEC 27001 and NIST CSF as they apply to that model.
Please also refer to our Terms of Business for the conditions governing engagements and bookings.
Who We Are
naked Agility Limited is registered in Scotland, company number SC451660, with its registered office at 47 Ballantrae Crescent, Newton Mearns, Glasgow, G77 5TX. naked Agility Limited is the data controller for the personal data described in this policy. Martin Hinshelwood, Managing Director, is responsible for information security and privacy.
Contact: clientservices@nkdagility.com
Data We Collect
Consulting Engagements
When you enquire about or engage us for consulting we collect and process:
- Names and contact details of the people we work with, including email addresses
- Organisation name, job title, billing address and VAT number where applicable
- Correspondence and meeting content, including audio or video recordings and transcriptions where a meeting is recorded
- Notes and documentation created during the engagement
- Source code, configuration and system data we are given access to in order to do the work
- Security keys and passwords used to access your infrastructure, stored only in our password manager
Payment details are processed by our invoicing provider; we do not store card numbers.
Website Visits and Measurement
Our websites count how their pages are found, read and returned to. When you view a page we record the view, how far down the page you scrolled, how long you were actively reading, whether you copied anything, whether you followed a link to another of our sites, and playback progress on pages that carry a video. These are statistics about pages, not about you. No IP address, no browser fingerprint, no full referring URL, only the referring site’s hostname, and nothing you type is ever recorded. Each site describes this on its own /measurement/ page, where a single button switches it off.
Enquiry and Contact Forms
If you use an enquiry form we collect your name, email address, organisation, the content of your message, and any context the form asks for. The form is protected by Cloudflare Turnstile, which checks that a request came from a person; Cloudflare processes your request to do that. We do not store your IP address. The submission is delivered to us by email and also held in the website’s own store, which deletes it automatically after twelve months. Only operators holding a specific clearance can read that store.
Accounts, Hearts, Bookmarks and Notifications
You can use every site without an account. If you choose to sign in we hold the email addresses you sign in with, a profile photo if you add one, and the features that are yours: your hearts, bookmarks, votes and a viewing history you can clear or turn off from your account pages. If you subscribe to email notifications we hold your address and the topics you chose. Your account and your notification preferences are never joined to website measurement. You can heart a page without an account; that adds one to the page’s count and records nothing about you.
Why We Use Your Data
| Purpose | Lawful basis |
|---|---|
| Scope and contract an engagement or booking, and issue an invoice | Contract |
| Deliver the engagement or training, and register a credential with the certifying body | Contract |
| Send engagement, course and booking communications | Contract |
| Respond to enquiries | Legitimate interest |
| Send the email notifications you subscribed to, and occasional updates about relevant services or content, which you can stop at any time | Consent |
| Provide the account features you signed up for | Contract |
| Comply with tax and accounting obligations | Legal obligation |
| Improve our websites and understand how they are used | Legitimate interest |
We do not use your data for automated decision-making or profiling, and we never sell it.
Cookies and Measurement
Our websites set no advertising or tracking cookies and load no third-party trackers or pixels, except nkdagility.com, which still loads Google Analytics while it is being removed. Measurement uses one first-party cookie, nkda_mid, a random identifier that means nothing outside the site, kept for thirteen months, whose only job is to tell one person returning apart from many people visiting once. There is no cookie banner because there is nothing to trade consent for: the measurement is statistics about the site, used only to improve it, under the statistical exception in the UK Privacy and Electronic Communications Regulations. Every site pairs the cookie with a plain-language /measurement/ page and a one-click opt-out toggle in its footer; opting out removes the cookie and stops all measurement for you. When an operator signs in, measurement is switched off for that browser so our own visits do not distort the numbers.
A second first-party cookie, nkda_appearance, remembers the colour mode and text font you chose. If you sign in, the sign-in provider sets the cookies it needs to keep you signed in, and your appearance choices are also saved to your account.
Third-Party Services
We share personal data only with the services we need to operate. Where a service processes personal data on our behalf, it does so under a data processing agreement. Where a service is the data controller, it processes data under its own terms and privacy policy.
Consulting Practice Tooling
| Service | Purpose | Data controller | Data processor | Data region |
|---|---|---|---|---|
| Microsoft 365 | Email, calendar, document storage, meeting recordings and transcriptions, including Copilot | naked Agility Limited | Microsoft | United Kingdom |
| FreshBooks | Invoicing, billing and customer management | naked Agility Limited | FreshBooks | United States and other countries |
| reMarkable | Note-taking and documentation | reMarkable | reMarkable | European Union |
| Azure DevOps | Software development, work item management and migration activities | naked Agility Limited | Microsoft | European Union and United States |
| GitHub | Software development and collaboration | naked Agility Limited | GitHub | Global, primarily United States |
| GitHub Copilot | AI-supported engineering. Model training is switched off | GitHub | GitHub | Global, primarily United States |
| 1Password | Secure storage of passwords, keys and sensitive information, end-to-end encrypted | 1Password | 1Password | United States |
| ChatGPT | Structured analysis, summarisation and AI-supported engineering insight. Model training is switched off | OpenAI OpCo, LLC | OpenAI | United States |
| Anthropic (Claude) | Analysing, summarising and organising engagement material, including meeting transcripts, into the engagement record (decisions, reports and follow-up), and AI-supported engineering and content work. Model training is switched off | Anthropic Ireland Ltd | Anthropic | United States |
Model training is switched off on every AI tool we use.
Website Services
| Service | Purpose | Data controller | Data processor | Data region |
|---|---|---|---|---|
| Microsoft Entra External ID | Sign-in to your account by email one-time code, Google, or a Microsoft work account | naked Agility Limited | Microsoft | United States |
| Cloudflare Turnstile | Checking that a form submission came from a person | naked Agility Limited; Cloudflare for improving Turnstile | Cloudflare | Global |
| Microsoft Azure Communication Services | Sending the email notifications you subscribed to | naked Agility Limited | Microsoft | United Kingdom |
Removed Services
These services are no longer used. The table says what happens to data they held.
| Service | What it did | Data it held |
|---|---|---|
| GitHub Discussions, via giscus | Comments on our content | Comments already posted remain as GitHub Discussions in a public GitHub repository, governed by GitHub’s terms |
| Mailchimp | Newsletter subscriptions | Subscribers were moved to our own subscription service |
Use of AI for Legal Document Review
To support efficient and accurate legal and policy comparison, naked Agility Limited may use ChatGPT, with model training switched off, to review and analyse customer-submitted legal documents, for example Data Processing Agreements, information security questionnaires and Master Service Agreements. This includes comparing customer terms to our published Terms of Business, Privacy Policy and engagement model, identifying potential conflicts, gaps or redlines for discussion, and drafting suggested responses to customer-supplied clauses. We do not process sensitive personal data, such as health, financial or identity documents, through AI, and we redact or anonymise sensitive content before use.
Data Retention
| Data type | Retention period |
|---|---|
| Contract and invoice records | 7 years, UK tax law |
| Consulting and migration engagement records | 5 years |
| Training attendance records | 5 years |
| Enquiry form submissions | 12 months in the website’s store, deleted automatically; the email copy 2 years from last contact |
| Website measurement records | Indefinitely, because a library is judged over years. They are anonymous and identify no one |
| Account data | Until you delete your account |
| Notification subscriptions | Until you unsubscribe |
| Notification suppression list | Permanently. When you unsubscribe or complain, your address is kept so that we never email you again |
Your Rights
Under UK GDPR you have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate data
- Erasure: ask us to delete your data, subject to legal retention obligations
- Restriction: ask us to pause processing while a dispute is resolved
- Objection: object to processing based on legitimate interest, including marketing
- Portability: receive your data in a machine-readable format
To exercise any of these rights, contact us. We will respond within 30 days. If you are not satisfied with our response you have the right to lodge a complaint with the Information Commissioner’s Office at ico.org.uk.
Security
All our infrastructure uses encryption at rest on hardware equipped with Trusted Platform Module technology, and every system is kept current with operating system and application patches. We rely on automatic patching, Microsoft Defender for real-time threat protection, and ongoing security hygiene: system health monitoring, access review and secure configuration baselines. Our websites use HTTPS throughout. Engagement and booking administration data is held within Microsoft 365 and FreshBooks, both of which provide encryption at rest and in transit, and access is restricted to authorised personnel.
Changes to This Policy
We review this policy periodically. The date at the top of this page reflects the most recent update, and the latest version is always available on our websites. Significant changes will be communicated by email to active customers.
Contact
For privacy questions or data requests, email clientservices@nkdagility.com or use our contact form.