PRIVACY
We take your privacy seriously.
Forest Konsept works with organisations, people and information. Trust matters to that relationship.
We only collect and use personal information where we have a legitimate reason to do so. We aim to collect no more information than we need, keep it only for as long as it is needed, protect it appropriately and be clear about how it is being used.
This privacy notice explains how Forest Konsept collects, uses, stores and protects personal information when you visit our website, contact us, work with us or take part in research or consultancy activities we deliver.
1. Who we are
Forest Konsept is an independent UK consultancy working across customer experience, service design, communications, content, strategy and organisational improvement.
For the purposes of UK data protection law, the data controller is:
Forest Konsept LTD
Suite 9G, The Business Centre, Cardiff Road, Barry CF63 2AW
Company No. 17487058 - Registered in England and Wales
References to “Forest Konsept”, “we”, “us” or “our” in this notice mean the legal entity identified above.
For some client projects, Forest Konsept may instead process personal information on behalf of a client. In those circumstances, the client may be the data controller and Forest Konsept will act as its processor in accordance with the client's instructions and the applicable contract.
2. The information we collect
The information we collect depends on how you interact with us.
When you contact us
If you contact Forest Konsept through our website, email, telephone, a meeting or another channel, we may collect:
your name;
email address and telephone number;
job title and organisation;
information contained in your enquiry;
correspondence between you and Forest Konsept; and
information you choose to provide about a potential project or opportunity.
When we work with you
If you are a client, prospective client, supplier, associate, partner or other professional contact, we may also process:
business contact information;
project and contractual information;
meeting notes and correspondence;
proposals, briefs and project documents;
invoices, payment and transaction records;
records of decisions, approvals and project activity; and
information reasonably required to manage our professional relationship.
Research, interviews and workshops
Some Forest Konsept projects may involve interviews, workshops, surveys, observation or other research.
Depending on the project, this may include information provided by participants about their experiences, opinions, interactions with services or organisations, and other information relevant to the research.
Where Forest Konsept conducts research on behalf of a client, we will establish appropriate arrangements with that client regarding responsibility for personal information, confidentiality, retention and security.
Where appropriate, participants will also receive specific privacy information explaining how their information will be used for that particular research activity.
Website information
When you visit our website, certain technical information may be collected automatically, such as:
IP address;
browser and device information;
pages visited;
approximate location derived from technical information;
referral source; and
information collected through cookies and similar technologies.
Where cookies or similar technologies require consent, they will not be used for those purposes until you have made your choice.
3. Why we use personal information
We may use personal information to:
respond to enquiries;
discuss potential projects;
prepare proposals and tender responses;
enter into and manage contracts;
deliver consultancy and research services;
communicate with clients and project stakeholders;
arrange and conduct meetings, interviews and workshops;
manage suppliers, associates and delivery partners;
maintain appropriate project and business records;
issue invoices and manage our accounts;
improve our website and understand how it is used;
maintain the security of our systems and website;
meet legal, regulatory and contractual obligations; and
establish, exercise or defend legal claims where necessary.
We do not collect personal information simply because it might be useful someday.
4. Our lawful bases
UK data protection law requires us to have a lawful basis for processing personal information.
Depending on the circumstances, Forest Konsept may rely on:
Contract — where processing is necessary to enter into or perform a contract with you.
Legitimate interests — where processing is reasonably necessary for Forest Konsept's legitimate business interests or those of another organisation, provided those interests are not overridden by your rights and interests. This may include managing professional relationships, responding to business enquiries, improving our services and protecting our business.
Legal obligation — where we need to process information to comply with the law.
Consent — where you have actively agreed to a particular use of your information. Where we rely on consent, you may withdraw it at any time.
Where special category information is processed, we will ensure that an appropriate additional legal condition applies.
5. Who we share information with
We do not sell personal information.
We may share information where reasonably necessary with organisations or people that help us operate or deliver our work, including:
technology and cloud-service providers;
website hosting and analytics providers;
professional advisers such as accountants or lawyers;
carefully selected consultants, researchers, associates or subcontractors working on a project;
clients where information is collected or produced as part of work we undertake for them;
payment, accounting and administrative service providers; and
public authorities, regulators or law-enforcement bodies where we are legally required to do so.
Where another organisation processes personal information on our behalf, we expect appropriate contractual, confidentiality and security arrangements to be in place.
6. AI and technology
Forest Konsept may use technology, including AI-assisted tools, to support aspects of our internal work such as organising information, analysing material, preparing working notes or improving efficiency.
We do not treat the use of technology as permission to disregard confidentiality or data-protection obligations.
Where AI or other third-party technology is used in connection with client information, we will consider the sensitivity of the information, our contractual obligations, the client's requirements, the provider's data-handling arrangements and applicable data-protection law.
We will not knowingly upload confidential or personal client information into external AI systems where doing so would be inconsistent with our contractual, confidentiality or data-protection obligations.
Where a client has specific restrictions governing AI or particular technology, we will respect those requirements.
Human judgement remains an integral part of our work.
7. Meeting recording and transcription
We may occasionally use recording or transcription tools during meetings, interviews or research activities.
Where we intend to record or transcribe a conversation, we will make this clear to participants and obtain any consent or other authority required before doing so.
Recordings and transcripts will be handled in accordance with the purpose for which they were created, our contractual obligations and applicable data-protection requirements.
8. International transfers
Some of the service providers, consultants or technology providers we use may process or store information outside the United Kingdom.
Where this involves a restricted international transfer of personal information, we will take appropriate steps required by UK data-protection law. These may include relying on UK adequacy regulations or implementing appropriate contractual safeguards and any required risk assessment.
The ICO requires organisations to consider specific safeguards where personal information is transferred internationally rather than simply assuming use of an overseas cloud provider is acceptable. ICO
9. How long we keep information
We do not intend to keep personal information indefinitely.
How long we retain information depends on why we hold it and may take account of:
the duration of a client or supplier relationship;
contractual requirements;
legal, tax and accounting obligations;
potential legal claims;
client instructions;
research requirements; and
whether the information remains necessary for the purpose for which it was collected.
When information is no longer reasonably required, we will delete, anonymise or securely dispose of it where appropriate.
10. How we protect information
We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.
Depending on the information and systems involved, these measures may include access controls, authentication, secure cloud services, appropriate device security, backups, confidentiality arrangements and restricting access to people who genuinely need the information.
No method of electronic transmission or storage is completely risk-free, but we aim to use safeguards proportionate to the information we hold.
11. Your rights
Depending on the circumstances, UK data-protection law may give you rights relating to your personal information, including the right to:
access personal information we hold about you;
ask us to correct inaccurate or incomplete information;
ask us to erase your information in certain circumstances;
ask us to restrict how information is used;
object to certain processing;
receive certain information in a portable format;
withdraw consent where processing is based on consent; and
raise concerns about how your information is being handled.
Not every right applies in every circumstance.
We may need to verify your identity before responding.
12. Cookies
Our website may use cookies and similar technologies required for the website to function and, where enabled, to understand website usage or provide additional functionality.
We will provide information about the cookies we use and, where legally required, ask for your consent before placing non-essential cookies on your device.
You can change or withdraw your cookie choices where the website provides those controls.
This is important for your Squarespace setup: merely having a privacy policy isn't sufficient. The ICO currently requires clear information about cookies and active consent before non-essential cookies are placed; rejecting non-essential cookies should also be as straightforward as accepting them. ICO
We should therefore build you a separate Cookie Policy after this page and configure the Squarespace cookie banner properly.
13. Marketing
We may occasionally contact existing or prospective professional contacts about Forest Konsept's work where permitted by law.
Where consent is required for electronic marketing, we will obtain it.
You can ask us to stop sending marketing communications at any time.
We will not sell your contact details to third parties for their marketing.
14. Links to other websites
Our website may contain links to websites operated by other organisations.
Forest Konsept is not responsible for the privacy practices of those websites. We recommend reviewing their privacy information when visiting them.
15. Changes to this notice
We may update this privacy notice as Forest Konsept develops, our technology changes or legal requirements change.
The latest version will be published on this page and the date above will be updated where appropriate.
The ICO specifically expects privacy information to be reviewed and updated when processing changes. ICO
16. Questions or concerns
If you have a question about how Forest Konsept uses your personal information or would like to exercise one of your rights, please contact:
If you are unhappy with how we have handled your personal information, you also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.