Privacy Policy

Last updated: 28 September 2026

AfterUs Advisory takes a simple position on personal data: we collect as little as we can, we tell you plainly what we do with it, and we do not sell it or share it for anyone else's marketing.

This notice explains what happens to your information when you visit afterusadvisory.com, get in touch, use the Sustainability & Resilience Maturity Assessment, or work with us.

In short

  • You can read every page on this site — including every insight piece — without telling us anything about yourself.

  • We ask for personal details in two places: the contact forms (on the home, Contact Us and Appointments pages) and the final step of the maturity assessment. Both are optional.

  • The maturity assessment runs in your browser. Your answers stay on your device unless you choose to send them to us.

  • We use no advertising cookies, no retargeting and no tracking pixels. There is no Google Analytics, no Meta pixel and no LinkedIn tag on this site.

  • You can ask us to delete your details at any time: [email protected].

Who is responsible for your data

AfterUs Advisory Ltd, a company registered in England and Wales, company number 17251278, registered office 47 Anchorage, Bristol, BS1 6UW, is the data controller for the personal data described in this notice. We are registered with the Information Commissioner's Office under registration number ZC247683.

For anything to do with privacy or your data, contact [email protected].

When you browse the site

This website is built and hosted on Squarespace. Like any web host, Squarespace records technical information when a page is requested — your IP address, browser and device type, the page you asked for and when. This is used to serve the site, keep it secure and produce visitor statistics.

We look at those statistics in aggregate — which pages are read, roughly where visitors come from — to understand what is useful. We do not try to identify individual visitors, and we do not combine this with anything else to build a profile of you.

The maturity assessment page loads its software from Cloudflare, which serves the file and sees the same kind of technical request information in doing so.

The cookie banner on your first visit lets you accept or refuse the analytics cookies. Refusing them does not stop you using any part of the site. See Cookies and similar technologies below.

When you get in touch

Three pages carry a form: the home page, Contact Us, and Book a Sustainability Strategy Session on the Appointments page. They ask for:

  • Home page and Contact Us — First name, last name, email address, and your message

  • Appointments — First name, last name, email address, a subject, your message, and an optional tick box to hear from us

Submissions are delivered through Squarespace and arrive in our email. We keep the message and your contact details so we can reply and keep a record of the conversation.

All three pages use Google reCAPTCHA Enterprise to block automated spam. It runs invisibly, and Google receives technical information about your device and how you interact with the page in order to judge whether you are a person. This is Google's own processing under their terms, and we cannot switch it off for one form without losing the form's spam protection.

News and updates

The Appointments form has a tick box marked "Sign up for news and updates".

We are not currently sending a newsletter, and no mailing list is being mailed. If you tick the box, we record that you are happy to hear from us, and if we start sending occasional writing about sustainability, resilience and the regulation around them, we will use it then. We would be relying on your consent, and you can withdraw it whenever you like — reply to any message and say so, or email [email protected]. Withdrawing it does not affect our replying to an enquiry you have made.

When you use the maturity assessment

The assessment asks about your organisation and your maturity across six sustainability and resilience disciplines, then produces a results page, a PDF report and a 90-day plan. It is worth being precise about what happens where.

What stays on your device

While you are answering, the assessment saves your progress in your browser's local storage, so a refresh or an interruption does not lose ten minutes of work. This is not sent to us. It stays on your device, and consists of:

  • Answers in progress — Your profile answers and question answers — never your name, email or job title. Kept for: 14 days, then automatically deleted

  • Completed results — Up to the last 12 completed assessments in this browser, so a retake can show what changed. Kept for: Until you clear it

  • Plan progress — Which steps in your 90-day plan you have ticked off. Kept for: Until you clear it

You can delete all three at any time with the "Clear them" link at the bottom of your results, or by clearing your browser's data for this site. Because this storage exists only to provide the tool you asked for, it is not used to track you, profile you or advertise to you.

What you send to us, and when

Nothing reaches us until you complete the details step and press submit. If you do, we receive:

  • Your details: name, job title (optional), email address, and whether you ticked the box agreeing to hear from us.

  • Your organisation profile: organisation name, sector, approximate revenue band, employee band, number of sites, countries or regions of operation, whether you are listed and on which exchanges, whether you hold public sector contracts, how sustainability is governed and resourced, and the exposure statements you selected.

  • Your results: your overall maturity level and level per discipline, how many questions you answered, your priority focus area, the regulatory items flagged for you, the first 30 days of your action plan, a link that reopens your results, and whether a previous assessment was completed in the same browser.

We ask for this so we can send your results and have a useful conversation about them. If you would rather not give us anything, read your results on screen, download the PDF and the spreadsheets, and close the tab.

These submissions are delivered by Formspree, a form processing service in the United States, and arrive in our email.

Things the assessment deliberately does not do

  • It does not send your answers anywhere as you go.

  • Your results link carries your answers in the part of the address after the #. Browsers do not send that part to web servers, so a link you keep to yourself stays between you and your browser. Anyone you send it to can see that organisation's answers, which is why the page says to share it deliberately.

  • The PDF report, compliance register, action plan and calendar file are built inside your browser. They are not generated on a server and are not sent to us.

  • "Email me a summary" opens your own email program with the text already written. Nothing is sent to us when you use it.

About the scoring

The assessment scores your answers and flags regulations that may apply to you. It is indicative and directional: it is not legal, regulatory or financial advice, and it makes no decision about you. It is not automated decision-making of the kind that produces legal or similarly significant effects, so the related rights under Article 22 of the UK GDPR do not arise. A person — usually Tristram — reads anything you send us.

When you work with us

If you become a client, or we are discussing work, we hold the contact details and correspondence needed to run the relationship, along with contracts, invoices and the material we produce for you.

Project material sometimes contains personal data belonging to your organisation — names of people we interview, staff data inside a report. Where that happens we handle it under our engagement terms and only for the purposes of that project. We can put a separate data processing agreement in place where the work calls for it.

We hold the same kind of contact and payment information for suppliers and associates.

Why we use your information, and the legal basis

  • Reply to enquiries and arrange conversations — You have asked us to. Legal basis (UK GDPR): Legitimate interests — running a professional services business

  • Send your assessment results and follow up about them — You asked for the results and gave us your details for that purpose. Legal basis (UK GDPR): Legitimate interests — responding to someone who has asked us to get in touch. You can object at any time

  • Send news and updates, if we start sending them — Only if you ticked the box. Legal basis (UK GDPR): Consent — which you can withdraw at any time

  • Deliver work and manage the client relationship — To do what we have agreed. Legal basis (UK GDPR): Performance of a contract

  • Understand how the site and the assessment are used, and improve them — To fix what confuses people and keep the regulatory content current. Legal basis (UK GDPR): Legitimate interests — improving services we provide

  • Keep the site and our systems secure, and block spam — To stay available and unabused. Legal basis (UK GDPR): Legitimate interests — security

  • Keep accounting and tax records — We are required to. Legal basis (UK GDPR): Legal obligation

How long we keep it

  • Enquiries and assessment submissions: 24 months from our last contact with you, unless you become a client.

  • News and updates preferences: until you withdraw consent or ask to be removed.

  • Client and supplier records: for the engagement and six years afterwards, for tax and professional reasons.

  • Website statistics: as retained by Squarespace under their own retention periods.

  • Anything on your device: as set out above — you control it.

Who else is involved

We keep the list short. These process personal data on our behalf, or as part of delivering the site:

  • Squarespace — Hosts the website, delivers form submissions, provides visitor statistics. Where: United States / Ireland

  • Google (reCAPTCHA Enterprise) — Blocks automated spam on the three forms. Where: United States

  • Formspree — Delivers maturity assessment submissions to our inbox. Where: United States

  • Cloudflare — Serves the assessment software to your browser. Where: Global network, including the UK and EU

  • Microsoft 365 — Our email and files. Where: United Kingdom / European Union

Some are outside the UK. Where that is so, the transfer is covered by the UK International Data Transfer Addendum, or equivalent safeguards in our agreements with them.

We do not sell your personal data, and we do not share it with anyone for their own marketing.

Cookies and similar technologies

  • Strictly necessary — Squarespace sets a small number of cookies that keep the site secure and working, including crumb, which protects forms against cross-site request forgery, and test, which checks whether your browser accepts cookies at all. Do you have a choice?: No — the site cannot work without them, and they are not used to track you

  • Analytics — Squarespace's own visitor statistics use cookies including ss_cid, ss_cvisit, ss_cvr, ss_cvt and ss_cpvisit to count visits and pages. They are only populated once you accept. Do you have a choice?: Yes — accept or refuse them in the cookie banner, and change your mind any time through it

  • Your cookie choice — ss_performancecookiesAllowed and ss_marketingcookiesAllowed remember what you chose in the banner. Do you have a choice?: No — they exist to honour your choice

  • Google reCAPTCHA — Runs on the pages carrying a form, to tell people from bots. Do you have a choice?: No, while the forms are protected — but it only runs on those pages

  • The maturity assessment — Sets no cookies at all. It uses your browser's local storage as described above, only to run the tool. Do you have a choice?: Yes — clear it from the results page at any time

We use no advertising cookies, no retargeting and no tracking pixels.

Keeping it secure

The site is served over HTTPS. Our email and files sit in Microsoft 365, protected by multi-factor authentication. We keep the number of people and systems touching your data as small as a one-person consultancy naturally can. No system is perfectly secure, but we will tell you and the ICO promptly if something goes wrong in a way that affects you.

Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal data we hold about you;

  • ask us to correct anything that is wrong;

  • ask us to delete it ("right to erasure");

  • object to or ask us to restrict how we use it, including for direct marketing, which you can stop at any time;

  • ask for it in a portable format; and

  • withdraw consent where we relied on it, without affecting anything done beforehand.

To exercise any of these, email [email protected]. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you raised it with us first, so we can put it right.

Links to other sites

Our pages link to other organisations — regulators, standards bodies, sources behind the assessment's regulatory content — and our footer links to our LinkedIn page. Once you follow a link, you are on someone else's site under their privacy notice, not this one.

Children

This site and the assessment are for people acting for an organisation. They are not aimed at children, and we do not knowingly collect personal data about anyone under 18.

Changes to this notice

We update this page when what we do changes. The date at the top tells you when it was last revised.