1. Who we are

Layercake CX Ltd is a UK-based consultancy specialising in strategy, analytics, and digital delivery for membership organisations. We operate as a Data Controller when processing personal data for our own operations, marketing, and website analytics, and as a Data Processor when processing personal data on behalf of our clients within their systems.

We comply with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the Data (Use and Access) Act 2025 and, where applicable, the EU GDPR.

  • Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
  • Company number: 14529453
  • Data Protection Lead: Damian Watson
  • Website: www.layercake-cx.biz

2. Acting as a data processor (client work)

When providing analytics, strategy, or digital delivery services, we typically access personal data hosted in client-owned systems. The client remains the Data Controller. We only process personal data based on the client's documented instructions, only access data necessary for delivery of the services, and do not store, copy, extract, or re-use client data for our own purposes, nor transfer it to our own systems unless explicitly required and authorised. For questions about personal data handled by a Layercake client, please contact that organisation directly.

3. Personal data we collect as a controller

When you interact with us directly (email, meetings, workshops, events, website), we may collect:

  • Name, job title and organisation
  • Business email address and telephone number
  • Billing and invoicing information
  • Communications you send us
  • Website usage data collected through cookies and similar technologies (see our Cookie Policy)
  • Interactions with our marketing communications, such as email opens, link clicks and subscription preferences, where permitted by applicable law
  • Business contact information obtained from third-party B2B sales intelligence and data enrichment platforms

We do not intentionally collect special category personal data. If such information is provided to us inadvertently, we will process it only where necessary and in accordance with applicable law.

4. How we use your personal data

  • Business communications — managing enquiries, responding to requests, maintaining relationships.
  • Contract delivery — managing proposals, agreements, invoicing, and service delivery.
  • Marketing (B2B) — newsletters, insight reports, event invitations, product updates, workshops and research findings relevant to membership organisations.
  • Marketing analytics — understanding engagement with our communications to improve them, where permitted by applicable law.
  • Website analytics — understanding how our website is used, improving content and usability.
  • Legal obligations — accounting, tax records, preventing fraud, record keeping.

5. Lawful basis for processing

Under the UK GDPR, the Data (Use and Access) Act 2025 and, where applicable, the EU GDPR, we rely on:

  • Performance of a contract — service delivery, invoicing.
  • Legitimate interests — maintaining business relationships, providing services, improving our website and conducting proportionate B2B marketing, assessed via a documented Legitimate Interests Assessment.
  • Legal obligation — tax, accounting, compliance.
  • Consent — where required for marketing communications, non-essential cookies, or email engagement tracking.

We only use non-essential cookies with your consent.

6. Marketing communications

We may send marketing communications where you have requested information, subscribed to updates, attended an event or workshop, we reasonably believe our services are relevant to your professional role in accordance with applicable electronic marketing legislation, or you have provided consent where required. Where permitted by applicable law, we may use technology provided by our marketing platform (currently HubSpot) to understand how recipients interact with our communications, including opens, clicks and subscription preferences. You can unsubscribe at any time using the link in our emails or via our Contact Us form.

7. Sharing your data

We do not sell personal data. We may share limited personal data with trusted service providers, including accountants, auditors and legal advisers; IT and cloud hosting providers; CRM and marketing platform providers (including HubSpot); sales intelligence and prospecting platforms (including Apollo.io); project management and collaboration platforms; and subcontractors supporting client service delivery. All third parties are contractually required to protect personal information and process it only in accordance with our instructions and applicable data protection legislation.

8. International transfers

Some third-party service providers may process personal data outside the United Kingdom or European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, including UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other legally recognised transfer mechanisms. Client data processed during consultancy engagements normally remains within client-controlled systems unless otherwise agreed.

9. Data retention

We retain personal data only for as long as necessary to fulfil the purpose it was collected for, including legal, accounting, tax and reporting requirements. Typical periods:

  • Client contracts, proposals and project documentation — duration of the relationship plus up to 6 years
  • Financial and accounting records — 6 years, or longer where required by law
  • Business contact information used for marketing — until you unsubscribe, or up to 2 years after our last meaningful interaction
  • General enquiries and correspondence — up to 2 years
  • Website analytics data — in accordance with the relevant analytics provider's retention settings
  • Personal data processed on behalf of clients — in accordance with that client's instructions

10. Security

We implement proportionate technical and organisational measures including access controls and least-privilege permissions, encrypted and password-protected devices, approved cloud systems, staff confidentiality and data protection training, incident response and breach management procedures, and data minimisation and secure deletion practices. When working inside client systems, infrastructure security remains under client governance.

11. Your rights

You have rights under data protection law, including access, correction, deletion, restriction, objection, portability where applicable, the right to withdraw consent at any time, the right to lodge a complaint with the ICO, and the right not to be subject to solely automated decision-making where applicable. If your request is broad or unclear, we may request clarification, and under the Data (Use and Access) Act 2025 the applicable response period may be paused until clarification is received.

If you have concerns about how we process personal data, contact us using the details below. We will acknowledge receipt within 30 days, investigate without undue delay, keep you informed where appropriate, and notify you of the outcome. If you remain dissatisfied, you may lodge a complaint with the Information Commissioner's Office (UK) or your local supervisory authority (EU).

12. Contact details

Damian Watson, Data Protection Lead, Layercake CX Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. Website: www.layercake-cx.biz. Or use our Contact Us form.

13. Automated decision-making

Layercake does not use personal data for solely automated decision-making or profiling that produces legal or similarly significant effects. We may analyse website usage, marketing engagement and service interactions to better understand user interests and improve our services, but this does not result in automated decisions that significantly affect individuals.

14. Related policies

See also our Cookie Policy and our Website Terms & Conditions.

15. Changes to this notice

We may update this notice from time to time to reflect changes in our services, legal obligations, regulatory guidance or business practices. Updates will be published on this page with a revised "last updated" date.