Privacy policy

1. Who is the data controller

Phoenix Consulting acts as the data controller for personal data collected through this site. For matters related to your personal data, contact us at privacy@phoenix-mea.com.

2. What personal data we collect

We collect only the personal data that you provide voluntarily through the site, plus the minimum operational data our infrastructure needs to serve pages reliably.

• Contact form submissions — name, work email, company, phone (optional), subject and the free-text message body.
• Career applications, if you apply through us — name, email, CV/resume attachment, and any additional information you provide.
• Newsletter or event registrations, where applicable — name and email address only.
• Technical operational data — IP address, user-agent, request timing and paths, retained short-term for security and rate limiting.
• Cookie-scoped preferences — your consent choice under the phoenix-consent key in localStorage (no personal data).

3. Why we process it

We only process personal data for the following purposes:

• To respond to enquiries submitted through the contact form (lawful basis: legitimate interest / contract preparation).
• To evaluate applications for open roles (lawful basis: legitimate interest / consent).
• To send you invitations or updates you have explicitly asked for (lawful basis: consent).
• To protect the service against abuse and to maintain security (lawful basis: legitimate interest).

4. Who we share it with

We do not sell personal data. We share it only with the processors we need to operate the site:

• Cloudflare — content delivery, edge security and (where enabled) cookieless analytics.
• Web3Forms — form-submission relay to Phoenix inboxes; access-key domain-restricted to phoenix-mea.com.
• Google Analytics 4, if enabled and you have consented — pseudonymised page-view and conversion metrics.
• Our staff and contractors, bound by confidentiality, strictly on a need-to-know basis to serve the enquiry.

5. Where the data is processed

Data is processed at Cloudflare edge locations globally, with the primary origin infrastructure in the European Union. Certain sub-processors (e.g. Google Analytics if enabled) may transfer data to the United States under Standard Contractual Clauses.

6. How long we keep it

Retention periods depend on the type of data:

• Contact-form submissions — up to 24 months from receipt, then deleted unless we have an active business relationship with you.
• Career applications — up to 12 months after the last recorded interaction, then deleted or (with your explicit consent) retained in our talent pool.
• Newsletter subscriptions — until you unsubscribe, which you can do from any Phoenix email.
• Operational logs — 30 days at the edge; longer only if required to investigate a security incident.

7. Your rights

Under UK-GDPR, EU-GDPR and equivalent regional frameworks, you have the right to:

• Access the personal data we hold about you.
• Request that we correct inaccurate data.
• Request that we erase your data (subject to legal retention obligations).
• Restrict or object to processing based on legitimate interest.
• Receive your data in a structured, machine-readable format (data portability).
• Withdraw consent at any time, without affecting the lawfulness of processing done before withdrawal.
• Lodge a complaint with your local data protection authority.

8. Security

We keep the site and its infrastructure current with reasonable security controls: HSTS, TLS 1.2+, a scoped Content-Security-Policy, no third-party scripts outside those declared here, and application-layer rate limiting on form endpoints. No system is perfect — please tell us at security@phoenix-mea.com if you believe you have found a vulnerability.

9. Changes to this policy

We may update this policy from time to time as our practices or the law evolve. The effective date at the top reflects the most recent update. Material changes will be surfaced on the site.

10. Contact

Questions, requests, or complaints regarding this policy should be sent to privacy@phoenix-mea.com. We aim to respond within 30 days.