Privacy notice
Last updated 2 October 2026.
Who we are
We are the controller of the personal data described in this notice. You can reach us about it through our contact form.
When you browse the site
This site sets no cookies, uses no analytics or advertising trackers, and loads its fonts and images from our own domain. Our hosting provider, Netlify, keeps standard server logs (IP address, browser type, the page requested and the time) to deliver the site and keep it secure. We rely on our legitimate interest in running a secure website.
When you contact us or send us something
Our forms are processed by Netlify. We collect only what each form asks for:
- Contact form: your name, email, the subject, an optional page link and your message, used to reply to you.
- Audit requests: your name, job title, work email, firm and details of the firm, used to respond with a proposal.
- Re-audit requests: your name, job title, company email, your reasons and any documents you attach, used to assess the request. Evidence you send may be cited in the audit report; your name and contact details are not published.
- Press release submissions: your name, job title, work email, firm and the release, used to consider it for the Bulletin.
We rely on our legitimate interest in answering enquiries and, for audit and re-audit requests, on taking steps at your firm's request before entering into a contract.
The newsletter
If you subscribe to The TBR Briefing, your email address is passed to our newsletter provider, beehiiv, which sends the newsletter and records whether it is delivered and opened. We rely on your consent, which you can withdraw at any time with the unsubscribe link in every issue.
Who else sees your data
Only our service providers, acting on our instructions: Netlify (hosting and forms) and beehiiv (newsletter). Both are based in the United States; transfers rely on the safeguards recognised under data protection law, such as standard contractual clauses or certification under the EU-US Data Privacy Framework. We do not sell your data or share it with the firms we cover.
How long we keep it
- Messages and submissions: for up to 24 months after we last deal with them, unless they become part of an audit record.
- Audit and re-audit records: for as long as the related report and its version history are published, and for six years after.
- Newsletter subscriptions: until you unsubscribe.
- Server logs: for the period set by our hosting provider, typically no more than 30 days.
Your rights
You can ask us for a copy of your data, and ask us to correct it, delete it, restrict or object to our use of it, or transfer it. Where we rely on consent you can withdraw it at any time. Use our contact form and we will reply within one month. You also have the right to complain to your data protection authority.
Links to firms
Links to firms' websites are plain links with no tracking added. Once you leave this site, the firm's own privacy policy applies.
Children
This site is intended for adults and is not directed at anyone under 18.
Changes
We will post any change to this notice here, with a new date at the top.