Legal
Privacy policy.
How we collect, use, store and protect personal data, and the rights you hold over it.
ADL-PP-001 · Version 1.2 · Updated 6 August 2026 · All policies and statements
Version 1.2 | Last updated: 6 August 2026
This policy applies to: www.adliora.com and all related subdomains
First issued in June 2026. Version 1.1 records the change of the company name from Heracles CS Limited to Adliora Ltd, registered at Companies House on 23 July 2026, rewrites the section on where data is held so that it describes our arrangements precisely, and names the provider that delivers our website forms. Version 1.2 records the firm's Cyber Essentials certification in the section on security, so that the technical and organisational measures we describe can be checked against an independent assessment.
This Privacy Policy explains how Adliora Ltd collects, uses, stores, and protects personal data. We are committed to handling your personal data responsibly and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read this policy carefully. It applies whenever you visit our website, contact us, receive our services, or otherwise interact with us.
1. WHO WE ARE
Adliora Ltd is an AI strategy and management consultancy. We are the data controller for the personal data described in this policy. Our contact details are:
Arden Hall, Brooklands Road, Sale M33 3SJ
Email: dpo@adliora.com
Website: www.adliora.com
ICO Registration Number: ZC138723
If you have any questions about this policy or about how we handle your personal data, please contact us at the email address above.
2. WHAT PERSONAL DATA WE COLLECT
We collect and process the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Identity data | Name, job title, employer, professional background | Directly from you |
| Contact data | Email address, telephone number, postal address | Directly from you, your employer |
| Communications data | Content of emails, enquiry forms, meeting notes | Directly from you |
| Technical data | IP address, browser type, device type, time zone, pages visited, referring URL | Automatically via our website |
| Usage data | Information about how you use our website and services | Automatically via our website |
| Marketing preferences | Your preferences for receiving communications from us | Directly from you |
| Contract data | Details of services provided, payment information, correspondence | Directly from you or your employer |
We do not intentionally collect Special Category Data (such as data about health, race, religion, or political views) in the ordinary course of our business. If you provide such data to us voluntarily, we will treat it with the highest level of care and process it only with your explicit consent or as otherwise required by law.
We do not knowingly collect personal data from children under the age of 18.
3. HOW WE USE YOUR PERSONAL DATA
The table below sets out the purposes for which we process personal data, the lawful basis relied upon, and our legitimate interest where that basis applies.
| Purpose | Lawful Basis | Legitimate Interest (where applicable) |
|---|---|---|
| Responding to your enquiries and providing information about our services | Legitimate interests / Pre-contract steps | To respond to potential clients and grow our business |
| Providing consultancy services under a contract | Contract performance | N/A |
| Sending marketing communications (where you have opted in or are an existing client) | Consent / Legitimate interests | To promote our services to contacts likely to be interested |
| Administering our website and improving user experience | Legitimate interests | To maintain a functional and effective website |
| Complying with legal obligations (e.g. tax, accounting, AML) | Legal obligation | N/A |
| Protecting our legal rights and interests, including debt recovery | Legitimate interests | To protect the business and enforce our contractual rights |
| Conducting and improving our business operations | Legitimate interests | To run an efficient consultancy and improve our services |
We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis on which we do so.
4. WHO WE SHARE YOUR DATA WITH
We do not sell, rent, or trade your personal data. We may share your personal data with the following categories of recipient, where necessary:
- IT and technology service providers (e.g. cloud storage, email platforms, CRM systems) acting as our data processors under written agreements.
- Professional advisers, including solicitors, accountants, and insurers, where necessary in connection with our legal and financial obligations.
- Associates and subcontractors engaged to assist in the delivery of services to you, who are subject to confidentiality obligations.
- HM Revenue and Customs, regulators, and other authorities where required by law.
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or assets, in which case personal data may be transferred as part of that transaction.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.
The enquiry and mailing list forms on our website are delivered by Web3Forms, a relay service that passes what you submit to our email under its published data-protection terms. Where we then arrange a call with you, we use Microsoft Bookings, part of our Microsoft 365 subscription, to manage the appointment. Microsoft acts as our processor and the booking details, your name, email address and any message you provide, are held within our Microsoft 365 environment. Microsoft's processing is governed by the Microsoft Products and Services Data Protection Addendum.
5. WHERE WE HOLD YOUR DATA
Client information is processed only within the environments, accounts and processors approved for the engagement, subject to documented access, retention and security controls. For most work that means our Microsoft 365 environment, where data is held under Microsoft's published data residency commitments for our tenancy.
Some of the providers we use process limited data outside the United Kingdom, for example for support, backup or service telemetry. Where any processing takes place outside your country, we rely on the safeguards required by law, including the UK International Data Transfer Agreement or Addendum and, for the United States, the UK Extension to the EU-US Data Privacy Framework. We do not promise that data never crosses a border. We promise to know where it goes, to control who can reach it, and to have the required safeguards in place before it moves.
You can ask for more detail on how your data is held by emailing us at dpo@adliora.com.
6. HOW LONG WE KEEP YOUR DATA
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. Our general retention periods are:
- Client data: seven years from the end of the engagement.
- Prospective client data: two years from the date of last meaningful contact, unless you ask us to stop contacting you sooner.
- Website enquiry data: 12 months from the date of the enquiry.
- Marketing contact data: until you withdraw consent or object, or two years from the date of last meaningful engagement.
- Financial and accounting records: seven years as required by HMRC.
When the retention period expires, your personal data will be securely deleted or anonymised.
7. YOUR RIGHTS
Under UK GDPR, you have the following rights in relation to your personal data:
- Access: to request a copy of the personal data we hold about you.
- Rectification: to request that we correct any inaccurate or incomplete personal data.
- Erasure: to request that we delete your personal data in certain circumstances.
- Restriction: to request that we restrict the processing of your personal data in certain circumstances.
- Portability: to receive your personal data in a structured, machine-readable format and to transfer it to another organisation, where technically feasible.
- Objection: to object to our processing of your personal data where we rely on legitimate interests, including an absolute right to object to direct marketing.
- Automated decision-making: to not be subject to a decision based solely on automated processing that produces a significant legal or similarly significant effect on you.
To exercise any of these rights, please contact us at dpo@adliora.com. We will respond within one calendar month. We do not charge a fee for exercising your rights, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act.
You also have the right to complain to the Information Commissioner's Office (ICO) at any time. The ICO can be contacted at: ico.org.uk, by post at Wycliffe House, Water Lane, Wilmslow, SK9 5AF, or by telephone on 0303 123 1113.
8. COOKIES
Our website uses cookies and similar technologies. A cookie is a small text file placed on your device by a website. For full information about the cookies we use and how to control them, please read our Cookie Policy, available at www.adliora.com/cookies.
9. AUTOMATED DECISION-MAKING
We do not use automated decision-making processes, including profiling, which produce legal or similarly significant effects on individuals.
10. LINKS TO OTHER WEBSITES
Our website may contain links to third-party websites. This Privacy Policy does not apply to those websites. We encourage you to read the privacy policy of any website you visit.
11. SECURITY
We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, accessed, altered, or disclosed in an unauthorised way. These measures include encryption, access controls, and regular security assessments. Those measures have been assessed independently. Adliora holds Cyber Essentials certification across the whole organisation, issued on 5 August 2026 with recertification due on 5 August 2027, and the certificate can be verified through the registry badge on our trust and assurance page. We will notify you and the ICO of any data breach where we are legally required to do so.
12. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of the policy. Where changes are material, we will take reasonable steps to bring them to your attention. We encourage you to review this policy periodically.
Registered in England and Wales | Company Number: 17155734 | ICO Registration: ZC138723
www.adliora.com | dpo@adliora.com | Privacy Policy Version 1.2 | Last updated: 6 August 2026