PRIVACY NOTICE

This notice explains how we use personal information about website visitors, enquirers and prospective clients, direct-marketing contacts, clients and their personnel, suppliers, freelancers and business partners, job and work-experience applicants, meeting participants, and users of any client portal we make available.

It is written for our activities as a controller under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended.

1. WHO WE ARE

The Curious Way Ltd, trading as The Curious, is the controller for the activities described in this notice. We are registered in England and Wales under company number 07207075.

Registered office: 5 Claremont Bank, Shrewsbury, Shropshire, United Kingdom, SY1 1RW

Privacy enquiries, rights requests and complaints: hello@thecurious.agency

Telephone: 01743 354444

2. WHEN A CLIENT IS THE CONTROLLER

A client may give us personal information in project materials and instruct us to use it solely to deliver services for that client. In that situation, the client will usually be the controller and we will act as its processor. The client’s privacy notice explains that use, and our processing is governed by our contract and any applicable data-processing terms.

We remain a controller for our own business purposes, including managing enquiries and client relationships, billing, security, legal records, recruitment and our own marketing. This notice applies to those activities.

3. PERSONAL INFORMATION WE USE

Depending on how you interact with us, we may use:

• identity and business contact information, such as your name, job title, employer, work email address, telephone number, business address and professional profile;
• enquiry, relationship and communication information, including correspondence, meeting details, preferences, proposals, contracts, instructions, survey responses and feedback;
• project information, content and materials supplied by clients or prospective clients, including plans, research, approvals and other working documents, which may contain personal information about other people;
• call and meeting recordings, transcripts, summaries, notes and attendance information;
• client and project profile information derived from enquiries, communications, recordings, transcripts, project records and interactions, used to understand a client’s organisation and needs;
• client-portal or account information, such as login identifiers, permissions and relevant activity records;
• billing and payment-administration information, including invoices, transaction references and payment status. Payment providers may handle full bank or payment-card details directly;
• recruitment and work-experience information, such as a CV, employment and education history, availability, application correspondence and interview or placement notes; and
• website, device and marketing information, such as IP address, browser and device details, cookie identifiers, pages viewed, email delivery or engagement information, interactions with adverts, advertising-audience matches, and consent or opt-out preferences.

We do not usually ask for special-category information. If you choose to give us limited health or accessibility information so that we can make appropriate arrangements, we use only what is necessary and rely on explicit consent or another applicable legal condition where required. Please avoid sending special-category or financial information in project materials unless it is necessary and has been agreed with us.

4. WHERE PERSONAL INFORMATION COMES FROM

We obtain personal information:

• directly from you when you contact us, work with us, use our website or portal, attend a meeting, subscribe to communications, or apply for a role or placement;
• from your employer, colleagues, clients, advisers, referrers or other business contacts;
• from publicly available professional and business sources, including company websites, Companies House, search engines and professional networking platforms;
• from business-contact, lead-generation and email-verification providers. We may infer a likely work email address from an employer’s publicly available email format and use a verification service to check whether it is valid; and
• automatically through our website, cookies and similar technologies, subject to your choices.

If we contact you using information obtained elsewhere, you may ask us for the specific source of your details.

5. WHY WE USE PERSONAL INFORMATION AND OUR LAWFUL BASES

We use personal information only where we have a lawful basis. The appropriate basis depends on the purpose and our relationship with you.

Where we use AI-assisted or other automated tools, the lawful basis is the basis for the underlying activity described above; using a tool does not create a separate lawful basis.

6. OUR LEGITIMATE INTERESTS

Our legitimate interests include operating and managing our business; responding to enquiries; developing and managing relationships with clients, prospective clients, suppliers, freelancers and business partners; providing and administering our services; organising client and project information to understand needs, maintain continuity and tailor support; maintaining appropriate business, communication and project records; and requesting and using feedback to evaluate and improve our services.

They also include carrying out proportionate business-to-business marketing, including identifying and contacting appropriate professional contacts at limited companies and other corporate bodies where we reasonably believe our services may be relevant, and, where our documented assessment supports it, using appropriate corporate business-contact data for matched-audience advertising. They include considering job, internship and work-experience applications; protecting our website, systems and information; preventing fraud or misuse; recovering unpaid amounts; and establishing, exercising or defending legal claims. We rely on legitimate interests only where the processing is necessary and proportionate and is not overridden by the individual’s rights, interests or freedoms.

7. DIRECT MARKETING AND YOUR RIGHT TO OBJECT 

You have the right to object to the use of your personal information for direct marketing at any time. You can opt out by replying to any marketing email and asking us not to contact you again, or by emailing hello@thecurious.agency. We will stop using your information for direct marketing and retain a minimal suppression record so that we can make sure you are not contacted again.

We focus this outreach on relevant professional contacts at limited companies, limited liability partnerships and other corporate bodies where we reasonably believe our services may be relevant to their role or organisation. We do not ordinarily use this approach for sole traders, ordinary partnerships or personal email addresses. Where PECR requires consent, we send electronic marketing only if we have valid consent or another permitted exception.

We may send relevant business contacts initial outreach, reasonable follow-up messages and periodic newsletters containing case studies, articles, information about our services and agency updates. Every marketing email identifies us and provides a clear and easy way to opt out of further marketing. We use email delivery or engagement tracking only where permitted and, where consent is required, after obtaining it.

If we use business contact details to create or match advertising audiences, we do so only for proportionate corporate business-to-business advertising where our documented assessment supports legitimate interests or we have valid consent. We do not use sole-trader or personal email addresses for this purpose without valid consent, and we remove people from future marketing audiences when they object.

If we obtained your details from a public or third-party source, we provide this privacy information no later than our first communication and within one month of obtaining the information, unless a lawful exception applies.

8. COOKIES AND ONLY ADVERTISING

We use cookies and similar technologies to operate and protect our website. Strictly necessary technologies may operate without consent. Analytics, advertising and social-media tracking technologies are activated only after you have consented through our cookie settings. You can reject non-essential technologies or withdraw your consent at any time.

Our current cookie categories, providers and durations are set out in our Cookie Policy.

9. RECORDING AND TRANSCRIPTS

Telephone calls, video calls, and in-person meetings may be recorded, transcribed or summarised to maintain accurate records, document decisions and deliver our services. We will give notice before or at the start of a recording. You may raise a concern or ask for a non-recorded alternative where reasonably practicable.

We normally retain an original recording and full transcript for no more than 12 months after the call or meeting. We may retain either for longer only where reasonably necessary for an active project, complaint, dispute, legal claim, legal obligation or specifically agreed purpose, and delete it when that need ends. Summaries, agreed decisions and project notes may be retained as part of the relevant enquiry or project record.

10. AI-ASSISTED TOOLS AND AUTOMATED DECISIONS

We may use AI-assisted tools to support research, drafting, design, development, analysis, transcription and other service delivery. Where project information is used with such tools, we seek to minimise personal information and apply appropriate access, configuration and contractual controls. Substantive work remains subject to meaningful human review.

We may also use automated tools within our workflow to organise and summarise information from enquiries, communications, recordings, transcripts and project records and to create client or project profiles. These records and profiles are used by our team to understand the client’s organisation and needs, maintain continuity and tailor our services. We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

11. WHO WE SHARE PERSONAL INFORMATION WITH

We disclose personal information only where reasonably necessary for the purposes in this notice.

Recipients may include:

• website hosting, IT, security, cloud email, collaboration and storage providers;
• client-relationship, project-management, workflow and client-portal providers;
• email, newsletter, business-contact, email-verification, analytics, advertising and social-media platforms;
• telephone, video-meeting, recording and transcription providers;
• AI-assisted service providers used to support our work;
• accounting, banking and payment providers, insurers and professional advisers;
• freelancers, contractors and specialist subcontractors working under appropriate confidentiality and data-protection obligations; and
• clients, regulators, courts, law-enforcement bodies or other parties where disclosure is necessary to provide services, comply with law, protect rights, deal with a claim, or complete a business sale or reorganisation. 

Some recipients act as our processors and others act as independent controllers. We require processors to protect personal information and use it only as instructed. We do not sell personal information.

12. INTERNATIONAL TRANSFERS

Some service providers or recipients may process personal information outside the United Kingdom. Where the destination is not covered by UK adequacy regulations, we use an applicable safeguard or other lawful transfer mechanism, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or EU Standard Contractual Clauses where relevant. We also carry out any assessment required by law.

Contact us if you would like more information about the safeguard used for a particular transfer or how to obtain a copy.

13. HOW LONG WE KEEP PERSONAL INFORMATION

We keep personal information only for as long as needed for its purpose, taking account of contractual, legal, accounting, security and dispute requirements.

Our usual periods or criteria are:

When information is no longer required, we delete it, anonymise it, or securely isolate it until deletion is possible, including where it remains temporarily in backups.

14. SECURITY

We use appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful use and accidental loss, destruction, alteration or disclosure. Access is limited to people and providers who need it for their work and are subject to appropriate duties. No system can be guaranteed completely secure.

15. CHILDREN AND WORK EXPERIENCE

Our website and services are not directed at children. We may receive and use limited information about people under 18 in connection with work-experience enquiries or placements, or where a client lawfully includes such information in project materials. We use only what is necessary, take the child’s interests into account and, where appropriate, involve a parent, guardian or school. We do not knowingly use children’s personal information for direct marketing.

16. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances, you may have the right to ask for access to your personal information, correction, deletion, restriction, or transfer of information you provided to us. You may object to processing based on legitimate interests and may withdraw consent at any time where we rely on consent. Withdrawing consent does not affect earlier lawful processing.

These rights are not absolute and exemptions may apply. We may need information to verify your identity. We do not usually charge a fee and normally respond within one month, subject to any lawful extension or pause. To exercise a right, email hello@thecurious.agency.

17. IF INFORMATION IS REQUIRED

Some personal information is needed to enter into or perform a contract, give access to a client service, or meet a legal requirement. If you do not provide it, we may be unable to respond fully, enter into the arrangement or provide the relevant service. Information requested for other purposes is optional unless we explain otherwise.

18. COMPLAINTS

Please send any data-protection complaint to hello@thecurious.agency. We will acknowledge it within 30 days, take appropriate steps to investigate and respond without undue delay, keep you informed as appropriate, and tell you the outcome without undue delay.

You can also complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the ICO. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.

19. CHANGES TO THIS NOTICE

We may update this notice to reflect changes in our activities or the law. The latest version will be published on our website with when it was last updated. We will use an appropriate additional method to draw attention to a material change where necessary.

Last updated: 10 September 2026