Privacy policy

Lighthouse cares about your privacy. This policy explains what personal information we collect, why, and what we do with it. It also sets out your rights and how to exercise them.

Who we are

For the purpose of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is:

Lighthouse Policy Design Ltd
Registered office: 86–90 Paul Street, London, EC2A 4NE.
Registered in England and Wales. Company number 15652494.
Registered with the Information Commissioner’s Office, registration reference ZC232416.

Contact for privacy matters: info@lighthousepolicydesign.co.uk

We are not required to appoint a Data Protection Officer. Responsibility for data protection sits with a Director, who you can reach at the address above.

What this policy covers

We process your personal data when you:

• visit this website
• get in touch through the site, by email, or by phone
• create or use an account to access tools and downloads on the site
• work with us as a client or client representative
• take part in research we carry out as part of our work
• work with us as an associate, contractor or supplier
• apply for a role at Lighthouse

What information we collect

Depending on how you interact with us, we may collect some or all of the following:

• name, email address, phone number, job title, organisation
• the content of messages you send us
• account details if you register to access tools and downloads on the site
• information you share when taking part in user research, such as interview responses or survey answers
• CVs, covering letters and recruitment information if you apply for a role
• if you work with us as an associate or contractor: identity and right-to-work documents, the results of pre-engagement checks such as the Baseline Personnel Security Standard, CVs, engagement records, and bank and payment details
• technical information about your device when you visit the site, including IP address, browser type, and how you use the site

When we collect it

We collect information when you:

• fill in a contact form or email us
• take part in a meeting, call or workshop
• create or sign into an account on the site
• participate in research we run
• apply for a role
• are engaged by us as an associate, contractor or supplier
• visit our website

How we use it

We use your information to:

• respond to your enquiries
• deliver work we have been contracted to do
• carry out research and analysis as part of our work
• provide and manage accounts for access to tools and downloads on the site
• engage, onboard, check and pay associates, contractors and suppliers
• manage recruitment
• keep our website working well and secure
• meet our legal obligations

Our lawful basis for processing varies by purpose. Where we process data to deliver a contract, or to engage and pay an associate, contractor or supplier, the basis is contractual necessity. Where we process data for recruitment, or to run and develop our business, the basis is our legitimate interest: we have considered the effect on you and are satisfied our interest does not override your rights, and you can object at any time. Where we process data for research participation, the basis is your consent, which you can withdraw at any time. Where the law requires us to hold information, such as right-to-work and tax records, the basis is our legal obligation.

Research on behalf of clients

Much of our work involves research with the people who use public services or are affected by policy decisions. When we run research on behalf of a client, the client is the data controller and Lighthouse acts as a data processor on their instructions.

We follow ethical research practice. Participation is always voluntary, consent is informed, and participants can withdraw at any point. We store research data securely, use it only for the purpose we gathered it, and return or delete it at the end of the engagement as agreed with the client.

Who we share it with

We do not sell your information.

We share information only where we need to:

• with the providers who help us run the business, each of which acts for us under a contract: our cloud and email provider, Google Workspace; our internal knowledge and operations system, hosted on Supabase and Vercel; our accountants and accounting software, Crunch; our website host, Vercel; and the providers who carry out pre-engagement checks on associates and contractors
• with our professional advisers, such as lawyers and accountants, where this is necessary for running the business
• with regulators, law enforcement or others where we are required to do so by law, or to protect Lighthouse’s rights, property or safety

Cookies

When you first visit our website, you’ll see a banner where you can choose your preferences for non-essential cookies before they are set. Some cookies are essential to how the site works and are always on. Some pages also include content served by other organisations — see Embedded content below — and those providers may set their own cookies as part of that content.

Embedded content

Some pages on this site include content served by other organisations. Our event pages embed a Google Map showing the venue, and pages with video embed a player served by Cloudflare Stream.

Embedded content behaves as though you had visited that provider directly. The provider receives your IP address and information about your browser, and may set its own cookies or use other tracking technologies. We do not control what they collect. Google’s handling of that data is covered by its own privacy policy.

How we protect it

We hold information in secure, access-controlled cloud services, with multi-factor authentication on every account and encryption in transit and at rest. We are certified under the UK Government’s Cyber Essentials scheme. Anyone working for us, including associates and contractors, has to meet the device and account standards set out in our IT and Information Security Policy, and their access is removed when their engagement ends.

Where we store it

We store your information in the UK or the European Economic Area wherever possible. Some of the services we rely on may process data in other regions, including the United States. Where that happens, we only rely on services that provide an adequate level of protection under UK data protection law, either through an adequacy decision or through approved contractual safeguards such as the International Data Transfer Agreement.

How long we keep it

We keep your information only for as long as we need it. That depends on why we collected it:

• Enquiries: up to 12 months after your last contact
• Contracts and client work: for the duration of the work, plus six years for financial records
• Associate, contractor and supplier records: for the duration of the engagement, plus six years
• Accounts: for as long as the account is active, and up to 12 months after it is closed
• Recruitment: up to 12 months after a decision, unless you agree we can keep your details on file
• Research data: for the length of the client engagement, then deleted or returned as agreed

Your rights

Under UK data protection law, you have the right to:

• ask what personal data we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete information, in certain circumstances
• ask us to restrict how we use your information
• ask us to transfer your information to another organisation
• object to us using your information in particular ways
• withdraw consent at any time, where consent was the basis for processing
• complain to the Information Commissioner’s Office

How to exercise your rights

To exercise any of these rights, email us at info@lighthousepolicydesign.co.uk. We may need to verify your identity before we respond. We aim to reply within one month.

Changes to this policy

We may update this policy from time to time. The version on this page is always the current one.

How to complain

If you have a concern about how we have handled your data, please get in touch with us first. If you are not satisfied with our response, you can complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk
0303 123 1113

Contact us

For any questions about this policy or how we handle your information, email info@lighthousepolicydesign.co.uk.

Lighthouse Policy Design Ltd, 86–90 Paul Street, London, EC2A 4NE.