Privacy policy

Last Updated: 18 February 2026
Next Review: June 2026

1. Who We Are

Layercake CX Ltd is a UK‑based consultancy specialising in strategy, analytics, and digital delivery for membership organisations.
We operate as:
  • Data Controller when processing personal data for our own operations, marketing, and website analytics.
  • Data Processor when processing personal data on behalf of our clients within their systems.
We comply with UK GDPR, EU GDPR (where applicable) and the Data Use and Accountability Act (DUAA) 2026.

Registered Office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ 
Company Number: 14529453 
Data Protection Lead: Damian Watson
Contact:

2. Acting as a Data Processor (Client Work)

When providing analytics, strategy, or digital delivery services, we typically access personal data hosted in client-owned systems.
The client remains the Data Controller.
  • We only process personal data based on the client’s documented instructions.
  • We only access data necessary for delivery of the services.
  • We do not store, copy, extract, or re‑use client data for our own purposes.
  • We do not transfer client data to our own systems unless explicitly required and authorised.
For questions about personal data handled by a Layercake client, please contact that organisation directly.

3. Personal Data We Collect as a Controller

When you interact with us directly (email, meetings, workshops, events, website), we may collect:
  • Name, job title and organisation
  • Business email address
  • Business telephone number
  • Billing and invoicing information
  • Communications you send us
  • Website usage data through cookies (see our Cookie Policy)
We do not collect sensitive data.

4. How We Use Your Personal Data 

We use personal data for:

Business communications 

Managing enquiries, responding to requests, maintaining relationships.

Contract delivery

Managing proposals, agreements, invoicing, and service delivery. 

Marketing (B2B)

Sending information about events, insights, workshops, and relevant services to membership‑sector professionals. 

Website analytics 

Understanding how our website is used, improving content and usability.

Legal obligations

Accounting, tax records, preventing fraud, record keeping.

5. Lawful Basis for Processing

Under UK GDPR, EU GDPR and DUAA 2026, we rely on:
  • Performance of a contract – service delivery, invoicing. 
  • Legitimate interests – B2B marketing, business operations, analytics. 
  • Legal obligation – tax, accounting, compliance. 
  • Consent – for optional marketing or non‑essential cookies. 
We only use non‑essential cookies with your consent. 

6. Marketing Communications 

We may send marketing communications if: 
  • you are a relevant professional in the membership sector
  • you requested information from us
  • you attended one of our workshops/events
  • you provided consent (where required)
You can unsubscribe at any time using the link in our emails or by sending us a message through our Contact Us form.

7. Sharing Your Data

We do not sell personal data.
We may share limited personal data with: 
  • accountants, auditors, legal advisers 
  • IT and software providers (email, CRM, project tools) 
  • subcontractors supporting client delivery 
All providers are subject to confidentiality and data protection obligations.
As a processor, we only share or access client data based on client instructions. 

8. International Transfers

If a third‑party provider processes data outside the UK, we ensure:
  • adequacy regulations, or
  • ICO‑approved safeguards (UK IDTA, SCCs)
Client data used in delivery projects normally remains within client‑controlled systems.

9. Data Retention

We retain personal data only as necessary for:
  • the duration of client relationships
  • tax and accounting obligations
  • legitimate business record keeping
Retention for client datasets is determined by the client (when we act as processor).

10. Security

We implement proportionate technical and organisational measures including:
  • access controls and least‑privilege permissions
  • secure devices (encrypted, password‑protected)
  • approved cloud systems
  • staff confidentiality and data protection training
  • incident response and breach management procedures
  • data minimisation and secure deletion practices
When working inside client systems, infrastructure security remains under client governance.

11. Your Rights

You have rights under data protection law, including:
  • access to your data
  • correction
  • deletion
  • restriction
  • objection
  • portability (where applicable)
If your request is broad or unclear, we may request clarification.
Under DUAA 2026, the statutory timeline pauses until clarification is received.

Complaints:

If you are unhappy with how we process personal data:

1. Send us a message through our Contact Us form. 
2. If you remain dissatisfied:  
  • UK: Information Commissioner’s Office (ICO)
  • EU: your local supervisory authority
We acknowledge complaints within 30 days. 

11. Contacting Us

For questions about this Privacy Notice or personal data processing:
Damian Watson
Data Protection Lead
Layercake CX Ltd
71–75 Shelton Street
Covent Garden, London, WC2H 9JQ 
Created with