Bowline Compliance

Privacy

Privacy notice

Last reviewed: 22 September 2026.

This notice covers the public Bowline Compliance website at bowlinecompliance.com, including website analytics.

1. Who we are

Bowline Compliance Limited is the data controller for personal data collected through this website.

  • Company number: 17192155
  • Registered in: England and Wales
  • Registered office: 11 Poplar Grove, London W6 7RF
  • Email: hello@bowlinecompliance.com

2. Data we collect and why

Contact enquiries

The website currently invites enquiries by email rather than through a website contact form. If you email Bowline, we receive the personal data you choose to include in that message, such as your name, email address, organisation, and the content of your enquiry.

We use this data to respond to your enquiry, arrange an initial conversation, and decide whether our services are likely to be relevant to you. We do not use contact enquiry data for marketing without a separate basis.

The lawful basis is legitimate interests (Article 6(1)(f) UK GDPR). Our interest is in responding to business enquiries from organisations that may benefit from our services. The processing is limited to what is necessary for that purpose.

Please do not include confidential, sensitive, or special category personal data in a website enquiry.

The Bowline Health Check

The Bowline Health Check asks questions about your organisation to suggest a suitable service route. Answers, categories, scores, risk levels and recommendations are processed on your device and are not sent to Bowline or analytics. If analytics are active, the site may record only generic Health Check started, completed or reset events. Personal data is collected only if you choose to contact Bowline.

Technical logs

Like most websites, our server may keep limited technical logs such as IP address, user agent, requested URL, response status, and timestamp. We use these logs to keep the site secure, investigate faults, and understand basic service operation.

Analytics

When enabled, we use self-hosted Umami analytics to understand how people use this website. We do not record videos of visits or replay your activity.

Analytics may record: page URL, referrer URL, approximate country (derived from IP address at the point of the request; IP addresses are not stored), browser type, device category, and aggregate event counts such as button clicks. No names, email addresses, message content, or other directly identifiable data are intentionally attached to analytics events by this website.

Umami can group activity during a visit using technical request data. We do not link it to a named visitor or customer account. We may count actions such as opening a menu or completing the Health Check, but never collect its answers, scores or recommendations through analytics.

We host Umami on infrastructure we control ourselves. Analytics data is not shared with advertising platforms and is not used for profiling or targeting.

Technical logs and analytics

We rely on legitimate interests under Article 6(1)(f) UK GDPR to keep the website secure, investigate faults, understand basic use of the site, and improve the service. We have considered the limited nature of the data, the absence of advertising tracking, the absence of session replay, and the analytics opt-out available on this page.

We assess analytics records by whether they are still needed to compare website use over time and evaluate changes to the site. Visit-level records are deleted or anonymised when that purpose no longer requires them; reports that no longer identify or single out visitors may be kept for longer-term comparison. We assess technical logs separately, according to whether they are needed to diagnose a fault, detect abuse or investigate an incident. Relevant evidence may be kept until that issue is resolved.

Analytics choice

You can disable analytics for this browser. This stores a small preference in your browser so the site knows not to send analytics events from this browser.

3. How long we keep enquiry data

Contact enquiry records are kept for up to 24 months from the date of the enquiry or the date of last relevant contact, whichever is later. Records are reviewed and deleted when they are no longer needed for the purpose for which they were collected.

Technical logs are kept only for as long as needed for security, fault investigation, and service operation.

4. Who we share data with

We do not sell personal data.

Bowline currently operates its website hosting, databases and backups in-house in the UK. We use external services where needed to deliver email and process payments. We review these arrangements when services change and update this notice when the change affects how your data is handled.

Website analytics is self-hosted on infrastructure we control and is not shared with advertising platforms.

The Bowline account has its own privacy notice and service-provider information. Stripe handles account payments and Resend delivers service emails; those providers may process information outside the UK. The account notice explains the information shared and how to obtain details of the applicable transfer safeguards.

5. Your rights

Depending on the circumstances and the lawful basis used, you may have the right to:

  • Access: request a copy of the personal data we hold about you
  • Rectification: ask us to correct inaccurate data
  • Erasure: ask us to delete your data where we have no overriding reason to keep it
  • Restriction: ask us to pause processing in certain circumstances
  • Portability: receive certain information you have provided to us in a structured, machine-readable form where the right applies
  • Object: object to processing based on legitimate interests

To exercise any of these rights, contact us at hello@bowlinecompliance.com. We will respond without undue delay and normally within one month. Where a request is complex or multiple requests have been made, the response period may be extended where the law permits, and we will explain this within the initial response period.

6. Data protection complaints

You can complain about how Bowline handles your personal data by emailing hello@bowlinecompliance.com. We will acknowledge your complaint within 30 days, take appropriate steps to investigate it, keep you informed where appropriate and communicate the outcome without undue delay. You may also complain to the Information Commissioner's Office.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office at https://ico.org.uk/ or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

7. Changes to this notice

We will update this notice if our data practices change. The date at the top of the page shows when it was last reviewed.