Privacy Policy

1. About This Policy

EBA Group Limited ("we", "us", "our") is committed to protecting your personal data and being transparent about how we use it. This policy explains what data we collect, why we collect it, how we use it and what your rights are.

This policy applies to data collected through our website eba-group.co.uk, our contact and enquiry forms, our referral form, and our job application process.

This policy should be read alongside our Cookie Policy, which explains how we use cookies on our website.

Last updated: 21 August 2026. This version was rewritten to describe what the rebuilt website actually does. The previous version described analytics, a newsletter sign-up and event registration forms that this site does not have, and did not name two processors that it does use.

2. Who We Are

EBA Group Limited is the data controller for personal data collected through this website and our associated processes.

EBA Group Limited
Ground Floor, Rear Barn, Knutsford, Cheshire, WA16 0SR
Email: hello@eba-group.co.uk
Tel: 0333 358 0117
Web: eba-group.co.uk

We are regulated by the Institute of Chartered Accountants in England and Wales (ICAEW). Company number: 06700320. VAT number: 944373214.

3. What Data We Collect and Why

3.1 Our Website Forms

There are three forms on this website: the contact form, the enquiry form on our quarterly advisory page, and the referral form. Between them they collect your name, your business name, your email address, your telephone number, and whatever you choose to write in the message.

Submissions are handled by Netlify Forms, the service that hosts this website, and are stored there. Our team reads them there and through an internal dashboard on this site that is protected by a password. They are not fed into any marketing platform. If you become a client, your details are then set up in our practice systems in the ordinary way, and that is covered by the engagement letter we send you rather than by this policy.

We use this data to respond to you. Our lawful basis is legitimate interests: we have a legitimate interest in replying to somebody who has asked us to.

3.2 Referrals: Somebody Else's Details

Our referral page lets one person give us the details of another. If somebody has put your name forward, we will have been given your name, your business, and an email address or telephone number, along with any context they chose to add. We did not get that from you, so you are entitled to know how we came by it.

We use it once, to make contact and ask whether you would like a conversation. Our lawful basis is legitimate interests in responding to a personal introduction. When we first contact you we will tell you who put your name forward, unless they specifically asked us not to, and we will tell you where to find this policy. You can ask us to delete your details at that point or at any time afterwards, and we will, immediately and without asking why. We do not add referred contacts to any mailing list.

3.3 Job Applications

If you apply to join the eba team through our careers pages, you will be directed to a Typeform application form. We collect your name, email address, phone number and any information you provide as part of your application.

We use this data to assess your application and, if relevant, contact you about the role. Our lawful basis is legitimate interests in recruiting suitable candidates. If your application is unsuccessful, we will retain your data for up to six months and then delete it, unless you give us permission to keep it on file for future opportunities.

3.4 Spam Protection on Our Forms

The three pages that carry a form are protected by Cloudflare Turnstile, which works out whether you are a person from how the browser behaves. Cloudflare acts as a processor for us and sees your IP address and technical information about your browser for the moment the check takes. It sets no cookies, and it is contractually prevented from using anything it sees for advertising or profiling. We previously used Google reCAPTCHA and replaced it for exactly those reasons.

3.5 Website Analytics

We do not use any. There is no Google Analytics on this website, no tag manager, no advertising pixel and no visitor tracking of any kind. An earlier version of this policy said otherwise; it was describing the previous website. If that ever changes we will update this policy and ask for your consent before setting anything.

4. How We Store and Protect Your Data

Your data is stored securely within the following platforms, all of which operate under their own data processing agreements with us:

• Netlify — hosts this website and stores every form submission. Netlify is based in the US and operates under standard contractual clauses approved for international data transfers under UK GDPR.
• Cloudflare — provides the Turnstile spam protection on our three form pages, described in Section 3.4, under standard contractual clauses approved for international data transfers under UK GDPR.
• Typeform — for job applications. Typeform is based in the EU and complies with UK GDPR requirements.
• ActiveCampaign — our marketing platform, based in the US and operating under standard contractual clauses. Nothing from this website is written into it automatically. It holds the contact records of people who have separately agreed to hear from us.
• Internal email — enquiries are also forwarded to a secure internal inbox at eba-group.co.uk.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse. Access to personal data is restricted to team members who need it to do their job.

5. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes it was collected, or as required by law. As a general guide:

• Enquiry and contact form data is retained for as long as the enquiry remains active, and for up to twelve months afterwards in case of follow-up. If you become a client, the engagement letter takes over.
• Referral details, where somebody has given us a third party's contact details, are deleted within three months if that person does not want a conversation, and immediately if they ask.
• Newsletter subscriber data is retained until you unsubscribe.
• Job application data is retained for up to six months after the application process concludes, unless you give permission for longer retention.

6. Sharing Your Data

We do not sell your personal data to third parties. We share data only with the platforms listed in Section 4 that help us operate our services, and only to the extent necessary. We may also disclose data where required to do so by law or by a regulatory authority.

7. Marketing Communications

We will only send you marketing communications if you have given us your consent to do so, or where we have a legitimate interest in contacting you based on a prior enquiry or relationship. Every marketing email we send includes an unsubscribe link. You can also contact us directly at hello@eba-group.co.uk to opt out at any time.

8. Cookies

We use cookies on our website. For full details of what cookies we use and how to control them, please read our Cookie Policy, available on this site.

9. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your data in certain circumstances.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can request that we transfer your data to another organisation in a structured, machine-readable format.
• Right to object — you can object to us processing your data where we rely on legitimate interests as our lawful basis.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@eba-group.co.uk. We will respond within one month. There is no charge for making a request.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us in the first instance at hello@eba-group.co.uk and we will do our best to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Web: ico.org.uk

11. Client Portal

We are in the process of introducing a secure client portal. When live, a separate notice will be provided explaining how personal and financial data submitted through the portal is collected, stored and protected. This policy will be updated accordingly.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in how we operate or changes in the law. The "last updated" date at the top will always reflect the current version. Where changes are significant, we will take reasonable steps to bring them to your attention.

13. Contact Us

If you have any questions about this policy or how we handle your personal data, please get in touch:

EBA Group Limited
Ground Floor, Rear Barn, Knutsford, Cheshire, WA16 0SR
Email: hello@eba-group.co.uk
Tel: 0333 358 0117
Web: eba-group.co.uk