This notice explains who we are, what personal information we collect about you, why we collect it, how we use it, and what your rights are. Please read it alongside any other privacy information we provide when we collect your data. If you have questions, contact us at the details in Section 1.
1. Who We Are
Atago Green Ltd is a data controller for the personal information described in this notice. We are registered in England and Wales.
| Company name | Atago Green Ltd |
|---|---|
| Registered in | England and Wales |
| Company number | 16435021 |
| Correspondence address | Level 5A, Maple House, 149 Tottenham Court Road, London W1T 7NF |
| hello@atago-green.com | |
| Website | www.atago-green.com |
| ICO registration number | ZB963098 |
If you have any questions about how we handle your personal information, or if you wish to exercise any of the rights described in Section 8, please contact us using the details above.
2. Who This Notice Applies To
This notice applies to personal information we hold about:
- visitors to our website at www.atago-green.com;
- individuals who contact us with an enquiry, whether through our website, by email, or by telephone;
- named contacts at organisations that are our clients or prospective clients;
- named contacts at organisations that are our suppliers or professional advisers;
- individuals whose information appears in publicly published regulatory or ombudsman decisions that we analyse as part of our core products.
It does not apply to information about organisations as legal entities (as distinct from the named individuals within them), or to anonymised information from which you cannot be identified.
3. What Personal Information We Collect
3.1 Information you give us directly
When you contact us, register an interest in our products, or enter into a contract with us, you may provide us with:
- your name and job title;
- your work email address and telephone number;
- the name of your employer or organisation;
- your LinkedIn profile URL or other professional contact details;
- the content of any messages or enquiries you send us.
3.2 Information we collect when you visit our website
When you visit our website, our website platform sets a small number of strictly necessary technical cookies that allow the page to load and be served correctly. These are session cookies that do not track you, identify you, or follow you across other websites. We do not use Google Analytics or any other analytics tool, and we do not collect information about how visitors use our website. For full details, please see our Cookie Notice.
3.3 Information from published public sources
Our core products involve the analysis and structuring of publicly published decisions by the Financial Ombudsman Service (FOS) and other regulatory bodies. These decisions are published by those bodies in the public domain. Where a published decision names a business, adviser, or other professional party (as opposed to a consumer, whose details are ordinarily redacted by the FOS before publication), that name may appear in our structured dataset as part of the published decision record. We do not seek out or add to the personal information as published; we process it as part of the public record.
3.4 What we do not collect
We do not intentionally collect sensitive personal information (known as special category data under data protection law), such as information about health, religion, ethnicity, or sexual orientation. If you send us information of this kind, please let us know and we will delete it promptly.
4. Why We Use Your Personal Information and Our Legal Basis for Doing So
Data protection law requires us to have a legal reason (known as a lawful basis) for using your personal information. The table below explains what we use your information for and the legal basis we rely on in each case.
| Purpose | Information used | Lawful basis |
|---|---|---|
| To respond to your enquiry or request for information | Name, contact details, message content | Legitimate interests — responding to unsolicited business enquiries is a normal and expected commercial activity that does not override your rights. |
| To manage our commercial relationship with you or your organisation | Name, job title, contact details, employer | Contract performance — where we have a contract with your organisation, processing your contact details is necessary to deliver that contract. |
| To send you information about our products and services | Name, work email, employer, role | Legitimate interests — we only contact business professionals in roles relevant to our products, and you can opt out at any time (see Section 8). |
| To conduct pilots, trials and product demonstrations | Name, contact details, employer, role, feedback | Legitimate interests / contract performance depending on the stage of engagement. |
| To manage our supplier and adviser relationships | Name, contact details, employer, role | Contract performance and legitimate interests — administering our supplier contracts and professional relationships. |
| To maintain our financial records and comply with our legal obligations | Name, employer, contact details as they appear on invoices | Legal obligation — we are required to maintain financial records under HMRC and Companies Act rules. |
| To analyse publicly published FOS and regulatory decisions as part of our core products | Names of businesses and professionals as published in public FOS decisions | Legitimate interests — processing public-domain regulatory records for insight and analytics purposes. This data is already in the public domain by the decision of the relevant regulatory body. |
More about legitimate interests
Where we rely on legitimate interests as our legal basis, we have assessed that our interests in processing your information are not overridden by your rights and interests. In each case, we only use the minimum information needed, and you have the right to object to this processing at any time (see Section 8).
5. Who We Share Your Personal Information With
We do not sell your personal information to anyone. We share it only where necessary, in the following circumstances:
5.1 Service providers (data processors)
We use a small number of trusted third-party technology and professional service providers to help us run our business. Where these providers handle personal information on our behalf, they do so under our instructions and are contractually bound to protect it. Categories of provider include:
- cloud platform and database providers (for data storage and product infrastructure);
- productivity and communication platforms (for email, document management, and internal collaboration);
- accounting and bookkeeping software providers (for financial records);
- professional advisers such as accountants and legal advisers (subject to professional confidentiality obligations).
We do not name specific providers in this notice as our supplier base may change over time. Our Supplier Register records all providers and their data protection status.
5.2 Legal and regulatory disclosure
We may disclose personal information to regulatory authorities, law enforcement, or other statutory bodies where we are required to do so by law — for example, to HMRC, Companies House, or the Information Commissioner's Office. We will only disclose what is required and will verify the lawfulness of any request before doing so.
5.3 Business transfers
If Atago Green Ltd is involved in a merger, acquisition, or sale of business assets, personal information we hold may be transferred as part of that transaction. We will notify affected individuals before their information is transferred and becomes subject to a different privacy notice.
6. International Transfers
Some of our service providers store or process personal information outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place to protect your information in accordance with UK data protection law. These safeguards may include:
- transferring to countries that the UK government has determined provide an adequate level of data protection (known as adequacy decisions);
- using contractual protections approved by the Information Commissioner's Office, such as the International Data Transfer Agreement (IDTA) or the Addendum to the EU Standard Contractual Clauses.
You can request further information about the international transfers we make and the safeguards we rely on by contacting us using the details in Section 1.
7. How Long We Keep Your Personal Information
We keep your personal information only for as long as is necessary for the purposes set out in this notice, or as required by law. The table below gives an overview of our standard retention periods.
| Type of information | How long we keep it |
|---|---|
| Client and prospective client contact details | For the duration of our relationship and for 3 years afterwards, to manage any follow-up or queries. Prospective client data is deleted if there has been no engagement within 18 months. |
| Financial records (including invoices and receipts) | 6 years from the end of the relevant financial year, as required by HMRC. |
| Supplier and professional adviser contact details | For the duration of the relationship and 3 years after it ends. |
| Website enquiry and contact form data | 12 months if no commercial relationship develops; merged into our client records if it does. |
| Published FOS and regulatory decision records | Indefinitely, as this information is already permanently in the public domain. We will remove specific records from our internal datasets on request where we have a legal basis to do so. |
When personal information is no longer needed, we securely delete or anonymise it so that you can no longer be identified from it.
8. Your Rights
Under UK data protection law, you have the following rights in relation to your personal information. These rights apply in most circumstances, though some have exceptions. We will respond to any request within one calendar month.
| Your right | What it means |
|---|---|
| Access | You have the right to ask us whether we hold personal information about you, and to receive a copy of it. This is called a Subject Access Request. |
| Correction | You have the right to ask us to correct personal information about you that is inaccurate or incomplete. |
| Erasure | You have the right to ask us to delete your personal information in certain circumstances — for example, if it is no longer needed for the purpose it was collected, or if you withdraw your consent. |
| Restriction | You have the right to ask us to restrict how we use your personal information while a dispute about its accuracy or use is resolved. |
| Portability | Where we process your information by automated means on the basis of your consent or a contract with you, you have the right to receive that information in a structured, machine-readable format. |
| Object | You have the right to object to us processing your personal information where we rely on legitimate interests as our legal basis. You also have an absolute right to object to us using your information for direct marketing — we will stop immediately on receipt of your objection. |
| Withdraw consent | Where we rely on your consent to process personal information, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal. |
To exercise any of these rights, please contact us using the details in Section 1. We will not charge you for making a request in ordinary circumstances. We may ask you to verify your identity before we act on your request.
9. How to Complain
If you are unhappy with how we have handled your personal information, please contact us in the first instance using the details in Section 1. We will do our best to resolve your concern promptly.
If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO), which is the UK's independent data protection regulator:
| ICO website | www.ico.org.uk |
|---|---|
| ICO helpline | 0303 123 1113 |
| ICO address | Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
You also have the right to seek judicial remedy through the courts if you believe your data protection rights have been infringed.
10. Cookies
Our website sets only strictly necessary cookies — session cookies set by our website platform that allow the page to load correctly. We do not use analytics, marketing, or third-party tracking cookies. Because we set only strictly necessary cookies, we do not display a cookie consent banner.
You can control cookies through your browser settings. For full details of the cookies we use, please see our Cookie Notice.
11. Links to Other Websites
Our website may contain links to third-party websites. This notice does not apply to those websites. We encourage you to read the privacy notice of any website you visit. We are not responsible for the privacy practices of third-party sites.
12. Changes to This Notice
We may update this notice from time to time — for example, if we change the way we collect or use personal information, or if data protection law changes. When we make material changes, we will update the 'last updated' date at the top of this notice. We encourage you to review it periodically. Where a change significantly affects how we use your personal information, we will take steps to bring it to your attention.
Document Information
| Version | v0.6 |
|---|---|
| Last Updated | 5 May 2026 |
| Published at | atago-green.com/privacy |
| Document Owner | Director, Atago Green Ltd |
| Review Cycle | Annual, or on any material change to processing activities |
Version History
| Version | Date | Author | Notes |
|---|---|---|---|
| v0.2 | 25 February 2026 | amt | Publish at /privacy on Atago Green website. |
| v0.3 | 5 May 2026 | amt | Link updated to www.atago-green.com/#privacy. |
| v0.4 | 5 May 2026 | amt | URL migrated from hash anchor (www.atago-green.com/#privacy) to dedicated Carrd subdomain (privacy.atago-green.com), mirroring the corresponding change to the Cookie Notice. |
| v0.5 | 5 May 2026 | amt | Analytics references removed throughout to align with the Cookie Notice no-analytics position. §3.2 rewritten to confirm strictly necessary session cookies only and explicit non-use of analytics tools. §4 lawful basis table: 'To operate and improve our website' row removed. §7 retention table: 'Website analytics data' row removed. §10 Cookies rewritten to reflect strictly necessary cookies only and confirm no consent banner is displayed. |
| v0.6 | 5 May 2026 | amt | Administrative correction: ICO registration number updated from CSN1339486 to ZB963098 (the correct number on the ICO public register; CSN prefix is not a valid ICO registration prefix). No substantive policy change beyond the registration number. |
| v0.6.1 | 27 May 2026 | amt | URL references updated for new path-based hosting: §3.2 and §10 Cookie Notice link changed from cookies.atago-green.com to /cookies; Document Information 'Published at' changed from privacy.atago-green.com to atago-green.com/privacy. No substantive policy change. |