Privacy and cookies

Dashon Consultancy is a strategy and measurement consultancy based in Birmingham, working worldwide. We are the data controller for this website and for any enquiry you send through it.

Dashon Consultancy is a trading name of [REGISTERED COMPANY NAME], a company registered in England and Wales. Company number [COMPANY NUMBER]. Registered office [REGISTERED OFFICE ADDRESS].

For anything in this notice, including a request to see or delete what we hold, write to hello@dashon.co.uk.

Last updated 7 August 2026.

Four things, and nothing else.

When you send an enquiry

The contact form asks for your name and email address. Those two are required. It also offers company, the service you are interested in, an indicative budget and a message, all optional. We record which page you sent it from and when.

When you subscribe

The subscribe form asks for your email address. Nothing else.

When you read the site

If you accept analytics, we record which pages you visit, how you arrived and which buttons you press. That is aggregate reporting, not a profile of you. Decline and none of it is collected.

To keep the form usable

Every submission passes a rate limit and an anti-spam challenge. Both need your IP address for a moment to do their job. The rate limit holds it in memory for ten minutes and writes it nowhere. It never reaches the enquiry record.

We do not buy personal data, and we do not sell or rent yours.

UK GDPR wants a lawful basis for every piece of processing. Ours are these.

• Enquiries. Legitimate interests. You asked us a business question and we would like to answer it. You can object at any time.
• Subscribers. Consent, given when you enter your address. Every email carries an unsubscribe link.
• Analytics and advertising cookies. Consent, given through the banner. Denied until you say otherwise.
• Spam and rate limiting. Legitimate interests. Keeping the form working for people and not for robots.
• Client data during an engagement. Under contract, and usually as your processor rather than as controller. That is governed by the engagement agreement, not by this page.

One cookie is set before you choose anything, and it is the one that remembers what you chose.

• dashon-consent — first party, six months. Records your answer to the banner. Strictly necessary: without it we would have to ask you again on every page.

Nothing else is written until you accept it. Decline, and no analytics or advertising cookie is set at all. We use Google Consent Mode v2 with every signal denied by default, so tags that do load store nothing until you say yes.

If you accept analytics

• Google Analytics sets _ga and _ga_XXXXXXXX, first party, up to two years, to tell one visit from another.
• Vercel Analytics counts page views. It sets no cookie and writes nothing to your device. We hold it behind the same consent choice anyway, because reporting on somebody who has just refused analytics would be hard to defend whatever the mechanism.

If you accept marketing

• Google Ads may set cookies to attribute a conversion to the advert that produced it. Where we send a conversion, your email address is hashed in your browser first, so the raw address never reaches the tag.

Always on

• Cloudflare Turnstile runs on the contact form to tell people from bots. It may set a short-lived token. It is strictly necessary and it does not follow you across sites.

Change your mind whenever you like. The Cookie settings link at the bottom of every page reopens the banner.

A short list, because a short list is easier to keep honest.

• Sanity. The content platform. Enquiries are stored here as records, in a dataset closed to the public and readable only with a key we hold.
• Vercel. Hosting, and the page analytics described above.
• Cloudflare. The anti-spam challenge on the contact form.
• Google. Analytics and Ads, and only if you have accepted the category that covers them.

Some of these process data outside the UK. Where personal data leaves the UK it moves under the safeguards UK GDPR requires, in practice an adequacy decision or the UK International Data Transfer Addendum.

Nobody else receives your data unless the law requires us to hand it over.

• Enquiries that do not become work. Twenty-four months from your last contact with us, then deleted.
• Enquiries that do become work. For the length of the engagement, then six years, because tax and contract records have to survive that long.
• Subscribers. Until you unsubscribe.
• Your consent choice. Six months, then we ask again.
• Analytics. The shortest retention window the platform offers, currently set at the account.

Ask us to delete something sooner and we will, unless we are required to keep it.

Under UK GDPR you can ask us to:

• show you what we hold about you
• correct it if it is wrong
• delete it
• stop or restrict what we do with it
• hand it over in a portable format
• stop relying on legitimate interests, by objecting

Write to hello@dashon.co.uk. We answer within one month and it costs you nothing.

If we get it wrong you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but it is your right either way.

When this notice changes, the date at the top changes with it. If a change materially affects what we do with data you have already given us, we will tell you directly rather than quietly editing the page.