Start with one process

Privacy policy

What personal information Prodro holds, why we hold it, and what you can ask us to do about it. Written to be read rather than to be survived.

Last updated
12 September 2026
Applies to
prodro.co.uk
Controller
Prodro Group Limited
Company no.
17268651
In shortFive lines. The rest of the page is the detail.
  1. We collect what you type into a form: your name, work email, company, and what you tell us about the work.
  2. We use it to reply to you, and for nothing else unless you tick the box for occasional notes.
  3. Cookies: none until you choose. Analytics only if you accept, and the site works the same either way.
  4. We never sell it or share it for anyone else’s marketing. Google processes analytics data only if you consented.
  5. Your rights: ask to see, correct or delete it at hello@prodro.co.uk. Enquiries that go no further are deleted after twelve months.

01Who we are

Prodro Group Limited is the data controller for the personal information described in this policy. We are registered in England and Wales, company number 17268651.

Registered office71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Contact for privacyhello@prodro.co.uk

This policy covers prodro.co.uk and the enquiries we receive through it. It does not cover Grantary, which is operated by Prodro Group Limited as a separate service with its own terms and privacy notice at grantary.co.uk. Where we act as a processor for a client’s own data during a consultancy engagement, that processing is governed by the agreement with that client, not by this policy.

02What we collect

When you contact us

You can reach us by email or through the enquiry form. The form asks for your name, a work email address we can reply to and the name of your business, and for what is on your mind. It also offers, and never requires, your role, what you need help with, when you would want to start, a phone number, the size of the business, how you heard about us, and where the process starts and ends and which systems it touches. If you write to us instead we receive whatever you choose to put in that message: typically your name, email address, organisation and a description of the problem you want help with. Every form has a box for occasional notes from us, and records your answer as a no if you left it blank, so we can show what you chose. The field guide has no form: it is free to read and print. If you send yourself the Process Opportunity Canvas we receive what you typed into it, your email address and, if you give it, your name; the canvas itself stays in your browser’s session storage until you send it or close the tab, and reaches us only if you send it. We do not ask for more than you offer.

When you visit the site

Our hosting provider records standard server logs when a page is requested. These normally include the IP address, the time of the request, the page requested, and the browser and operating system reported by your device. We do not use these logs to build a profile of you, and we do not combine them with anything else.

If you accept analytics

Where you consent to analytics cookies, Google Analytics collects information about how the site is used: pages viewed, approximate location derived from your IP address, referring site, device type, browser and screen size, and a randomly generated identifier stored in a cookie so that repeat visits within a session can be counted once rather than several times.

Google Analytics 4 does not store full IP addresses. We do not use the analytics data for advertising, we have not enabled Google Signals or advertising features, and we do not attempt to identify individual visitors from it. Full detail is in the cookie policy.

What we do not collect

We do not collect special category data, we do not buy contact lists, and we do not track you across other websites.

03Cookies

No cookie is set on this site until you choose one.

Nothing is written to your browser when you arrive. Analytics cookies are set only if you accept them, and declining is a single click that costs you nothing. The site works identically either way.

We use one category of non-essential cookie: analytics, via Google Analytics. There is no advertising cookie, no social embed, and no cross-site tracking. Three features (the checklist, the calculator and the pause control) keep your own choices in your browser’s local storage, only when you use them and only on your device. Each cookie and stored item, its purpose and its lifespan is listed in the cookie policy, along with how to change or withdraw your choice at any time.

04Why we use it, and our lawful basis

Under the UK GDPR we must have a lawful basis for using personal information. Ours are as follows.

Responding to your enquiryLegitimate interests: you contacted us and expect a reply. Where a reply leads towards an engagement, steps taken at your request before entering a contract.
Sending you something you asked forLegitimate interests: for example your completed Process Opportunity Canvas, which we send once to the address you give us and nothing further. The field guide itself is free to read and print with no form.
Occasional notes about what we publishConsent: only if you tick the box on a form. Two or three a year at most, with an unsubscribe link in every one; you can withdraw at any time and nothing else changes.
Delivering an engagementPerformance of a contract with you, or with the organisation you represent.
AnalyticsConsent. Storing or reading anything on your device for analytics also requires consent under PECR, which is why we ask before setting the cookie. You can withdraw it at any time.
Keeping the site available and secureLegitimate interests in operating a working, secure website.
Meeting our legal obligationsLegal obligation: for example retaining accounting records.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can object at any time using the contact address above.

05Who we share it with

We do not sell personal information and we do not share it for anyone else’s marketing. We use a small number of service providers who process information on our behalf under contract, and only on our instructions.

Google (Analytics)Website analytics, where you have consented. Google acts as our processor for this data under Google’s data processing terms.
Microsoft (Azure)Receiving what you type into the enquiry form. The form is handled by a small function on our Azure web host, which sends it straight to our mailbox as an email; the form itself keeps no copy. Microsoft processes it on our behalf under Microsoft’s data processing terms, in data centres in the United Kingdom and European Union.
Microsoft (Microsoft 365)Receiving and storing the enquiries you send us, whether from the form or directly by email. Microsoft processes our email on our behalf and does not use it for anything else.
Web hostServing this website and keeping short-lived server logs.

We may also disclose information where we are required to by law, or to establish, exercise or defend legal claims.

Transfers outside the UK

Some providers, including Google, may process information outside the United Kingdom. Where that happens we rely on UK adequacy regulations, on the UK Extension to the EU–US Data Privacy Framework, or on the International Data Transfer Agreement or Addendum, so that your information continues to be protected to a UK standard.

06How long we keep it

Enquiries that do not proceed12 months from our last exchange, then deleted.
Client recordsFor the duration of the engagement and 6 years afterwards, to cover contractual and limitation periods.
Accounting records6 years from the end of the accounting period, as required by the Companies Act 2006.
Analytics data14 months, then deleted automatically by Google. This is the shortest useful setting Google Analytics offers above two months.
Server logsKept by our host for a short operational period, then overwritten.

07Your rights

You have the following rights over the personal information we hold about you. They are free to exercise, and we will respond within one month.

AccessAsk for a copy of the information we hold about you.
RectificationAsk us to correct anything inaccurate or incomplete.
ErasureAsk us to delete information where we no longer need it.
RestrictionAsk us to pause using information while a question about it is resolved.
ObjectionObject to processing we carry out on the basis of legitimate interests.
PortabilityReceive information you gave us in a structured, machine-readable form.
Withdraw consentChange your analytics choice at any time. Withdrawing is as easy as giving it, and does not affect anything done beforehand.

To exercise any of these, email hello@prodro.co.uk. We may ask you to confirm your identity before we act.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

08How we protect it

We keep the amount of personal information we hold deliberately small, which is the most reliable protection available. Beyond that, access to systems is limited to people who need it, accounts use multi-factor authentication, and information in transit is encrypted.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly where the risk is high.

09Changes to this policy

If we change how we use personal information we will update this page and change the date at the top. Where a change is significant, for example adding a new category of cookie or a new recipient, we will say what changed rather than quietly reissuing the document, and we will ask for your consent again where consent is the basis we rely on.