Text Link
Inclusive Leadership
Training & Consultancy
☰

Privacy Notice

Last updated: 13 August 2026

Who we are

NLX Consultancy and Training Ltd (“NLX”, “we”, “us” or “our”) is the controller responsible for the personal information described in this notice.

NLX Consultancy and Training Ltd is registered in England and Wales under company number 16966920.

Registered office: 35 Hall Road, Leamington Spa, England, CV32 5RA.

For questions, information-rights requests or data-protection complaints, contact:
Email: darrel.cresswell@wearenlx.com

What this notice covers

This notice explains how we collect and use personal information when someone:

  • Visits our website
  • Submits our contact form
  • Contacts us by email
  • Makes an initial enquiry about our services

If you subsequently become a client, supplier, associate or training participant, we may provide additional privacy information if we need to use your information for purposes not covered by this notice.

Personal information we collect

When you contact us, we may collect:

  • Your first and last name
  • Your email address
  • Your organisation, role or telephone number if you choose to provide them
  • The subject and content of your enquiry
  • Our subsequent correspondence with you
  • Records of any information-rights request or data-protection complaint you make

Our website hosting, form and security systems may also automatically process technical information such as:

  • Your IP address
  • Browser and device information
  • The date and time of your visit or submission
  • Website access, security and error logs

We do not ask you to provide health information or other sensitive personal information through our general contact form. Please do not include this information in your initial message.

If you need to discuss an accessibility requirement or reasonable adjustment, contact us by email. We will only request information that is necessary and will explain how it will be handled, including seeking explicit consent where this is the appropriate legal basis.

Why we use your information

Responding to enquiries

We use your name, contact details and message to receive, assess and respond to your enquiry and manage any necessary follow-up.

Our lawful basis is:

  • Legitimate interests, under Article 6(1)(f) of the UK GDPR, because we have a legitimate business interest in responding to enquiries and communicating with prospective clients, partners and other business contacts; or
  • Taking steps at your request before entering into a contract, under Article 6(1)(b), where your enquiry concerns services that you may purchase personally.

Maintaining appropriate business records

We may retain relevant correspondence to maintain accurate records, manage our business and establish, exercise or defend legal claims.

Our lawful basis is our legitimate interests under Article 6(1)(f), or compliance with a legal obligation under Article 6(1)(c) where applicable.

Operating and protecting our website

We may process technical information to maintain the availability and security of our website, identify technical problems and prevent misuse.

Our lawful basis is our legitimate interests under Article 6(1)(f) in operating and protecting our website and information systems.

Responding to information-rights requests and complaints

We use the information contained in a request or complaint to investigate it, communicate with the person concerned and comply with our legal responsibilities.

Our lawful basis is compliance with a legal obligation under Article 6(1)(c).

Do you have to provide your information?

You are not legally or contractually required to use our contact form. However, we need sufficient contact information to understand and respond to your enquiry. If you do not provide this, we may be unable to respond.

Marketing

Submitting an enquiry does not subscribe you to marketing communications.

We will not add your details to a mailing list or use them to send newsletters or general promotional emails without a separate lawful basis and, where required, your consent.

Who we share information with

Access is limited to NLX directors and any authorised person who reasonably needs the information to handle the enquiry or operate the business.

We may also share information with:

  • Website hosting, contact-form, email, IT support and security providers acting on our behalf
  • Professional advisers, including legal advisers, accountants and insurers, where necessary
  • Regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law

We require service providers acting on our behalf to protect personal information and only process it for authorised purposes.

We do not sell personal information.

International transfers

Some website, hosting, email or other technology providers may process personal information outside the United Kingdom.

Where this happens, we take steps to ensure the transfer is legally protected. This may include using a provider located in a country covered by UK adequacy regulations or using approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

You can contact us for further information about the safeguards applying to a particular transfer.

How long we keep information

We apply the following retention periods:

  • Any copy of a contact-form submission temporarily held within our website form system is deleted within 30 days.
  • If an enquiry does not result in a client relationship, the enquiry and related email correspondence are normally deleted 12 months after the last meaningful contact.
  • If an enquiry results in a contract or client relationship, relevant business and contractual records may be retained for up to six years after the relationship ends, unless a different period is required by law.
  • Records of information-rights requests and data-protection complaints may be retained for up to six years after the matter is closed.
  • Technical and security logs are kept only for as long as reasonably necessary for security, troubleshooting, legal compliance and the operation of provider backup cycles.

Information may be retained for longer where this is necessary to meet a legal obligation or establish, exercise or defend a legal claim.

When information is no longer required, we delete it securely or anonymise it so that it can no longer identify anyone. Residual copies may remain within secure backups until those backups are overwritten through the normal backup cycle.

How we protect information

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

Access is restricted to people who reasonably need it for an authorised purpose. However, no method of electronic transmission or storage can be guaranteed to be completely secure.

Your information rights

Depending on the circumstances, you may have the right to:

  • Ask for a copy of the personal information we hold about you
  • Ask us to correct inaccurate or incomplete information
  • Ask us to delete your information
  • Ask us to restrict how we use your information
  • Object to our use of your information
  • Receive certain information in a portable format
  • Withdraw consent where we are relying on consent

These rights are not absolute and may not apply in every situation. We may need to confirm your identity before acting on a request.

Your right to object

Where we rely on legitimate interests, you have the right to object to our use of your personal information.

If you object, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds to continue or the processing is needed to establish, exercise or defend legal claims.

To exercise any of your rights, email darrel.cresswell@wearenlx.com.

Data-protection complaints

If you believe we have not handled your personal information properly, you can complain by emailing darrel.cresswell@wearenlx.com with “Data protection complaint” in the subject line.

Please explain:

  • What you believe has happened
  • The personal information or communication concerned
  • Any relevant dates
  • What you would like us to do

We will help you make a complaint if you require assistance or an accessible alternative.

We will:

  • Acknowledge your complaint within 30 days
  • Investigate it without undue delay
  • Keep you informed about material progress
  • Explain the outcome without undue delay

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/data-protection-complaints/

Cookies and similar technologies

Our website may use strictly necessary cookies or similar technologies required for security and basic operation.

We will not use non-essential analytics, advertising or tracking technologies unless we have first provided appropriate information and obtained consent where required.

More detailed information about any cookies in use should be provided through the website’s Cookie Notice.

Automated decision-making

We do not use information collected through our contact form to make solely automated decisions that have legal or similarly significant effects.

Changes to this notice

We will review this notice regularly and update it when our services, systems, suppliers or legal obligations change.

The date at the top of this page shows when it was last updated.