Privacy Policy
Last updated: 2 October 2026
This policy explains how Clavaro Ltd uses personal data from our website, enquiries, outreach and public content.
Who we are
Clavaro Ltd, trading as Clavaro Consulting, is a HubSpot and RevOps consultancy. We are registered in England and Wales, company number 17277874, registered office 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE. Our ICO registration number is ZC264276.
For the personal data in this policy, we decide how and why it is used, so we are the “controller”. When we work inside a client’s HubSpot and handle their customer data, we are the “processor” and the client is the controller. That work is covered by our Data Processing Agreement with each client, not by this policy.
Contact us through the form at clavaroconsulting.com/book.
What data we collect
We collect different data depending on how you deal with us.
- Website visitors: pages viewed, device and browser type, and approximate location from your IP address, through cookies (see Cookies below).
- People who contact or book with us: name, email address, phone number, company, job title, and what you tell us in a form, email, call or booking.
- Prospects we contact: name, work email, company, job title and publicly available professional details, such as your LinkedIn profile. We find these on LinkedIn and other public sources, and we tell you this when we first contact you.
- Newsletter readers: name, email address and which issues you open or click. Tracking opens and clicks uses small images and links, and we only do it with your consent.
- Clients: contact details, billing details, and recordings or notes of calls and workshops.
- People named in case studies or testimonials: your name, job title, company, your quote, and your photo or video if you give them.
We do not ask for special category data (for example health, ethnicity or religion). Please do not send it to us. We do not use automated decision-making that has a legal or similar effect on you.
Why we use your data and our legal basis
UK GDPR says we must have a legal reason for each use. These are ours.
| What we do | Legal basis |
|---|---|
| Reply to enquiries and set up calls | Legitimate interests (running our business and answering you), or steps you asked for before a contract |
| Deliver client work, invoice and take payment | Contract |
| Contact business prospects about HubSpot services we think are relevant to them | Legitimate interests, with an easy opt-out. For sole traders and partnerships, we only email with consent |
| Send our newsletter | Consent |
| Record calls and workshops | Legitimate interests (keeping an accurate record of calls and doing the work well). A visible notetaker joins the call, and you can ask us not to record or to delete a recording |
| Publish testimonials and case studies that name you | Consent, which you can withdraw at any time |
| Use analytics and marketing cookies | Consent |
| Keep accounts and tax records | Legal obligation |
Where we rely on legitimate interests, we have checked that they are not outweighed by your rights. Ask us if you want to see how we reached that view.
Cookies
Our website uses cookies. Cookies that are not strictly needed, such as analytics and tracking, only run after you accept them in our cookie banner. You can change your choice at any time. The tools on our site that use cookies are the HubSpot tracking code, HubSpot forms and our HubSpot booking link. We use no other analytics or tracking tools.
A full list of cookies, what they do and how long they last is in our Cookie Policy.
Who we share data with
We do not sell your data. We share it only with the people and tools we need to run the business, under contracts that protect it:
- HubSpot for our CRM, website forms, booking and email.
- Google Workspace for email, calendar and files.
- Xero and Monzo Business for invoicing and payments, and our accountant for tax and accounts.
- Fathom for recording and transcribing calls and workshops.
- Anthropic (Claude) for drafting and analysis. We remove or minimise personal data before using AI tools.
- LinkedIn, when we message you or publish content there.
- Professional advisers and insurers, if we need advice or have to make a claim.
- Subcontractors, if we use them on client work, under a written agreement.
We may also share data if the law requires it.
Transfers outside the UK
Some of the tools above, including HubSpot, Google, Anthropic and Fathom, are based in the US or store data there. When your data leaves the UK, we make sure an approved transfer method protects it. HubSpot is certified under the UK-US data bridge, with approved contract clauses as a backup. Google, Anthropic and Fathom use approved contract clauses in their data processing terms.
How long we keep data
We keep personal data only as long as we need it. These are our usual periods.
| Data | How long |
|---|---|
| Enquiries that did not become work | Until we have dealt with your enquiry and no longer need it |
| Prospect details | Until you ask us to stop or tell us you are not interested, or 3 years after we last had contact with you, whichever is sooner |
| Newsletter subscribers | Until you unsubscribe |
| Client records, contracts and invoices | 6 years after the work ends, for tax and legal reasons |
| Call and workshop recordings | Until you ask us to delete them, or 6 years after the work ends, whichever is sooner |
| Testimonials and case studies | Until you withdraw consent |
How we keep it safe
We protect personal data with passwords, device encryption and access limited to people who need it. We use two-factor sign-in on our main accounts, including HubSpot, Google and Xero. If there is a breach that puts your rights at risk, we will tell you and the ICO, within the time the law sets (72 hours for the ICO).
Your rights and complaints
You can ask us to:
- show you the data we hold about you
- correct it if it is wrong
- delete it
- stop or limit how we use it
- send it to you in a usable format
- stop contacting you for marketing, or object to us using your data where we rely on legitimate interests
If we rely on your consent, you can withdraw it at any time. This includes consent to a testimonial, case study or recording. Withdrawing does not affect what we did before, but we will stop using it from then on and take it down where we reasonably can.
Use the contact form at clavaroconsulting.com/book and we will reply within one month. If you are unhappy with how we handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.
Changes to this policy
We will update this policy when what we do with data changes. The date at the top shows when it was last updated.