Privacy Policy

Atrium Activations Ltd (“Atrium”, “we”, “us”) is the data controller for personal data collected through atriumdiscovery.co.uk and atriumdiscovery.com.

We are registered in England and Wales under company number 16248068, with our registered office at Suite C, 4–6 Canfield Place, London NW6 3BT. We are registered with the Information Commissioner’s Office under registration number ZA000000.

For anything in this policy, contact us at hello@atriumdiscovery.co.uk.

Every page of this website you can reach on your own sets no cookies. We use no analytics, no advertising pixels, no session tracking and no browser storage of any kind. There is nothing to consent to, which is why you won’t see a cookie banner.

There is one exception, and we would rather spell it out than bury it: a private document link we send you directly does record how you read the document. Clause 3 explains precisely what that means. You will never arrive there by browsing — those pages are reachable only through a link addressed to you.

If anything else changes, we will update this policy and ask for your consent before setting anything that isn’t strictly necessary.

When we are raising investment or discussing a partnership, we sometimes send a private link to a document such as our investor deck. Those links live under atriumdiscovery.co.uk/deck/ and each one is issued to a named person or asks for your name and work email before it opens.

What we record. That the link was opened and when, the name and email address associated with it, how long you spent on each page and the furthest page you reached, the town and country your connection appears to come from, and your browser type.

What we don’t. We do not store your IP address — only an irreversible hash of it, which lets us tell a returning reader from a new one and nothing else. We do not use any of this for advertising, we do not combine it with data from anywhere else, and we do not share it.

Why. Knowing which parts of a document people actually read tells us what to explain better and what to follow up on. Our lawful basis is our legitimate interest in managing an investment or business development process. We have weighed that against your rights and concluded it does not override them: the link was sent to you personally in a business context, the record is limited to how you read one document, and we tell you before you open it.

You can object at any time, and ask us to delete your record, by emailing hello@atriumdiscovery.co.uk. Doing so does not affect the conversation we are having with you.

When you use our enquiry form, we collect the name, work email address, brand or organisation, and description of the activation you enter. These fields are all required to send the form. If you tick the box asking to hear from us, we also record that you opted in and when.

When you email us directly, we receive your email address, your name if you give it, and whatever you choose to put in your message.

When you simply visit, our hosting provider records your IP address, browser type and the pages requested in standard server logs. We use these only to keep the site running and secure, and we do not use them to identify you.

When you open a private document link, we collect the information set out in clause 3.

We do not collect special category data, and we ask that you don’t send it to us through the form.

Replying to your enquiry and discussing possible work — our legitimate interest in responding to someone who has asked us to get in touch.

Keeping a record of enquiries and who we have spoken to — our legitimate interest in running and developing our business.

Delivering work once you become a client — performance of a contract.

Sending you occasional news about our work — your consent, given by ticking the box on the form.

Understanding how you read a private document we sent you — our legitimate interest in managing an investment or business development process.

Keeping the website available and secure — our legitimate interest in protecting our systems.

Meeting our accounting and legal obligations — legal obligation.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and concluded they are not: you contacted us, the data is business contact information, and we use it only for the purpose you gave it to us for. You can object at any time.

We only send marketing to people who have asked for it. If you tick the opt-in box on our enquiry form, we may occasionally email you about our work, upcoming activations and what we are learning. That is the only way you end up on our list.

Every email carries a one-click unsubscribe link, and you can opt out any time by emailing hello@atriumdiscovery.co.uk. Unsubscribing has no effect on our reply to your enquiry, and we will not ask you to justify it.

If you do not tick the box, we will use your details only to answer you.

We do not sell your personal data, and we do not share it for anyone else’s marketing. We use a small number of service providers who process data on our instructions:

Amazon Web Services — hosts this website and receives enquiry form submissions. Our infrastructure runs in the AWS London region (eu-west-2), so this data stays in the UK.

Google (Workspace) — our business email, so enquiries reach our inbox.

Cloudflare — delivers some website code to your browser, and sees your IP address in doing so.

We may also disclose personal data to our professional advisers, or where we are required to by law.

Our website and enquiry form are hosted in the AWS London region, so your enquiry is stored in the UK.

Google may process email outside the UK depending on the service. Where that happens, we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, as approved by the Information Commissioner. You can ask us for a copy of the safeguards in place by emailing hello@atriumdiscovery.co.uk.

Enquiries that don’t become work — 24 months from our last contact with you, then deleted.

Client records and correspondence — six years after the end of our engagement.

Invoices and accounting records — six years from the end of the relevant financial year.

Marketing list — until you unsubscribe, and we review the list every two years.

Server logs — up to 90 days.

Private document link records — 24 months from the last time the link was opened, then deleted.

We chose 24 months for unconverted enquiries because activation work runs on annual planning cycles, and a brand that enquires one season often returns the next. Six years for client records matches the limitation period for contract claims and the statutory retention period for company accounting records.

Under UK data protection law you have the right to ask for a copy of the personal data we hold about you, to have inaccurate data corrected, to ask us to delete it, to ask us to restrict how we use it, to object to our use of it where we rely on legitimate interests, to receive it in a portable format, and to withdraw consent where we have relied on consent.

To exercise any of these, email hello@atriumdiscovery.co.uk. We will respond within one month. We won’t charge you, and we won’t treat you any differently for asking.

We make no decisions about you by automated means. Other than the record of how you read a private document, described in clause 3, we do not profile you.

If you think we have mishandled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We take appropriate technical and organisational measures to protect your data, including encrypted connections to this site and access controls on our email. No transmission over the internet is completely secure, and we cannot guarantee absolute security.

This site is aimed at businesses and is not directed at children. We do not knowingly collect data about anyone under 18.

We may update this policy. The version published here is always the current one, and the date at the top tells you when it last changed.