1. Who We Are

​

QuestElle Ltd, trading as QuestElle, operates questelle.com and provides structured advisory, LinkedIn positioning, business visibility, AI workflow, data enhancement and operational augmentation services.

​

For the purposes of UK GDPR and the Data Protection Act 2018, QuestElle Ltd is the data controller for personal data processed through questelle.com and in connection with its own business operations.

​

In some client engagements, QuestElle may also act as a data processor where it processes personal data on behalf of a client and in accordance with the client’s documented instructions.

​

This policy is intended to explain QuestElle’s general privacy approach. Specific client engagements may be subject to additional contractual terms, including data processing terms where QuestElle acts as a processor.

​

Where QuestElle works with clients outside the United Kingdom, additional terms may be required to address local privacy laws, international transfers, data residency requirements or client-specific compliance requirements.

​

Privacy contact: privacy@questelle.com

​

Registered office:
QuestElle Ltd
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom

​

Company number: 17200130

​

QuestElle Ltd may later operate through additional trading divisions or associated entities. Where this happens, this policy will be updated to make clear which legal entity is responsible for personal data.

​

2. Scope of This Policy

​

This Privacy Policy explains how QuestElle collects, uses, stores, shares and protects personal data when you:

• visit questelle.com;

• complete an intake form;

• contact us by email, phone, LinkedIn, website form or other communication channel;

• book or attend a diagnostic session;

• provide documents, links or other materials for review;

• engage QuestElle services;

• interact with QuestElle as a client, prospect, supplier, partner or contact;

• otherwise communicate with QuestElle.

​

This policy applies to personal data processed by QuestElle Ltd in connection with its current commercial advisory, LinkedIn authority, AI workflow, operational augmentation, data enhancement and business support services.

​

Separate privacy information may be provided for specific programmes, services, client projects or future entities where required.

​

3. Personal Data We Collect

​

QuestElle may collect and process the following types of personal data where relevant:

• name;

• email address;

• telephone number;

• business or organisation name;

• job title or professional role;

• LinkedIn profile URLs;

• LinkedIn company page URLs;

• website URLs;

• company information;

• intake form responses;

• documents uploaded or shared for review;

• CVs or professional profile materials, where provided;

• notes from diagnostic sessions, meetings and service delivery;

• call or video recordings, where consent has been given;

• correspondence by email, phone, LinkedIn or other channels;

• invoice, billing and payment-related information;

• website usage data, including cookie and analytics data where applicable;

• technical data such as IP address, device type, browser type and pages visited.

​

For some client projects, such as data enhancement, email validation, contact research, CRM data review, workflow analysis or operational data structuring, QuestElle may process personal data provided by or sourced on behalf of a client. In those cases, the client will usually act as the data controller and QuestElle will usually act as the data processor.

​

We only collect and process personal data that is reasonably necessary for the purposes described in this policy or for the agreed client service.

​

4. How We Collect Personal Data

​

We may collect personal data when you:

• complete a QuestElle intake form;

• contact us through questelle.com;

• email, call or message QuestElle;

• book or attend a diagnostic session;

• upload or share documents, links or other materials;

• engage QuestElle to provide services;

• interact with QuestElle on LinkedIn or other professional platforms;

• visit questelle.com and interact with cookies or analytics technologies.

​

We may also collect limited business contact information from publicly available professional sources, such as LinkedIn, company websites, business directories or professional databases, where relevant to legitimate business development, client delivery or agreed data enhancement activity.

​

5. How and Why We Use Personal Data

​

QuestElle uses personal data for the following purposes:

​

Responding to enquiries
Personal data used: Name, contact details, message content.
Lawful basis: Legitimate interests.

​

Reviewing intake forms
Personal data used: Name, business details, profile links, website links, documents and submitted answers.
Lawful basis: Steps before entering into a contract / legitimate interests.

​

Booking and managing diagnostic sessions
Personal data used: Name, contact details, availability, session notes.
Lawful basis: Contract / legitimate interests.

​

Delivering agreed services
Personal data used: Client documents, LinkedIn URLs, website URLs, business information, meeting notes and correspondence.
Lawful basis: Contract.

​

Recording diagnostic or delivery sessions
Personal data used: Voice, video and discussion content.
Lawful basis: Consent.

​

Improving service quality
Personal data used: Internal notes, project observations and non-sensitive service feedback.
Lawful basis: Legitimate interests.

​

Managing client relationships
Personal data used: Contact details, correspondence and service history.
Lawful basis: Contract / legitimate interests.

​

Invoicing and accounting
Personal data used: Name, business details, invoice details and payment records.
Lawful basis: Legal obligation / legitimate interests.

​

Protecting QuestElle’s legal and commercial interests
Personal data used: Correspondence, records of advice, session notes and service records.
Lawful basis: Legitimate interests.

​

Website functionality
Personal data used: Technical data and essential cookies.
Lawful basis: Legitimate interests / strictly necessary website operation.

​

Website analytics
Personal data used: Cookie identifiers, usage data, device and browser information.
Lawful basis: Consent.

​

Relevant business updates or marketing
Personal data used: Business contact details and communication preferences.
Lawful basis: Consent or legitimate interests, depending on context.

​

Data enhancement or validation for client projects
Personal data used: Contact data, company data, email addresses, professional profile data and validation results.
Lawful basis: Client’s lawful basis as controller / QuestElle acting as processor where applicable.

​

QuestElle does not sell personal data.

​

6. Where QuestElle Acts as a Processor

​

In some client engagements, QuestElle processes personal data on behalf of a client.

​

This may include:

• data enhancement;

• email validation;

• contact research;

• CRM data review;

• business data structuring;

• workflow analysis;

• operational reporting;

• AI-assisted analysis of client-provided data;

• preparation of structured outputs based on client data.

​​

In these cases, the client is usually the data controller and QuestElle acts as the data processor.

​

The client is responsible for confirming that it has a lawful basis to collect, provide, use and act on the personal data, including any subsequent marketing, sales outreach, CRM use or business development activity.

​

QuestElle will process the relevant personal data only:

• in accordance with the client’s documented instructions;

• for the agreed service purpose;

• using appropriate confidentiality and security measures;

• with access limited to those who need it for delivery;

• without using the data for unrelated QuestElle marketing or unrelated commercial purposes.

​

QuestElle may separately act as a data controller for its own business administration, client relationship management, invoicing, legal record keeping, service governance and dispute protection.

​

7. Structured Diagnostic Sessions and Recordings

​

Following completion of an intake form or initial enquiry, QuestElle may conduct structured diagnostic sessions by phone, video or online meeting.

​

These sessions may be recorded for:

• accuracy of advice;

• structured service delivery;

• internal record-keeping;

• quality assurance;

• training and service improvement;

• protection of both parties in the event of a dispute.

​

Recording will not take place without consent. Consent will be requested before or at the beginning of the session.

​

If consent is not given, QuestElle may still take written notes to support service delivery.

​

Recordings are stored securely and retained only for as long as reasonably necessary for the purposes set out in this policy.

​

Recordings are not shared externally unless required by law, needed to protect legal rights, or expressly agreed with the client.

​

8. Use of Third-Party Platforms and AI-Assisted Tools

​

QuestElle may use secure third-party platforms and AI-assisted tools to support service delivery, administration, analysis, drafting, workflow design, data enhancement and operational recommendations.

​

These may include:

• website and form platforms;

• email and calendar tools;

• cloud storage and document tools;

• LinkedIn and other professional platforms;

• analytics tools;

• AI-assisted analysis, drafting or workflow tools;

• accounting or invoicing tools;

• data validation or enrichment tools.

​

Where AI-assisted tools are used, QuestElle applies human review and does not rely solely on automated processing to make decisions that have legal or similarly significant effects on individuals.

​

QuestElle does not intentionally use client personal data to train public AI models.

​

Personal data shared with AI-assisted tools is limited to what is reasonably necessary for the agreed purpose.

​

Clients should not provide sensitive personal data, confidential third-party data or special category data unless it is necessary for the service and has been specifically discussed with QuestElle.

​

9. Special Category Data

​

QuestElle does not intentionally collect special category data unless it is necessary for a specific service and has been expressly agreed.

​

Special category data may include information about:

• health;

• disability;

• ethnicity;

• political opinions;

• religious or philosophical beliefs;

• trade union membership;

• sex life or sexual orientation.

​​

If a client provides documents or information containing special category data, QuestElle will process that data only where necessary for the agreed purpose and will apply additional care.

​

Where special category data is not required, QuestElle may ask for it to be removed, redacted or replaced with non-sensitive information.

​

10. Cookies and Analytics

​

questelle.com uses essential cookies to support website functionality and security.

​

We may also use analytics cookies or similar technologies to understand website usage and improve website performance.

​

Analytics cookies are used only where consent has been given through our cookie banner or cookie settings tool.

​

Further information is available in our Cookie Policy.

​

11. Marketing Communications

​

QuestElle may use business contact details to send relevant updates about services, events, resources or business activity where permitted by law.

​

Where consent is required, QuestElle will ask for consent before sending marketing communications.

​

Where legitimate interests may apply, QuestElle will ensure that communications are relevant, proportionate and include a clear way to opt out.

​

You can opt out of marketing communications at any time by contacting privacy@questelle.com or using any unsubscribe option provided.

​

12. Sharing Personal Data

​

QuestElle may share personal data with trusted third parties where necessary for the purposes described in this policy.

​

These may include:

• website hosting providers;

• form and booking platforms;

• email, calendar and cloud storage providers;

• analytics providers;

• professional platforms such as LinkedIn;

• AI-assisted service tools;

• data validation or enrichment tools;

• accountants, legal advisers or professional advisers;

• payment, invoicing or finance platforms;

• regulators, courts, law enforcement or public authorities where required by law.

​

Where service providers process personal data on our behalf, they are expected to apply appropriate data protection and security safeguards.

​

Where QuestElle acts as a processor for a client, third-party tools or platforms used in delivery may act as sub-processors. QuestElle will use reasonable care when selecting such providers and will use them only as necessary for the agreed service.

​

QuestElle does not sell personal data.

​

13. International Transfers

​

Some of our service providers may process personal data outside the United Kingdom.

​

Where this occurs, QuestElle relies on appropriate safeguards, which may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to EU Standard Contractual Clauses;

• contractual commitments from service providers;

• equivalent lawful transfer mechanisms.

​

Where QuestElle works with non-UK clients or receives personal data from outside the United Kingdom, additional transfer terms or client-specific contractual terms may be required depending on the location of the client, the individuals whose data is involved, the systems used and the nature of the service.

​

14. Data Security

​

QuestElle uses appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

​

These measures may include:

• password-protected systems;

• access controls;

• secure cloud storage;

• careful handling of client documents;

• limited access to client data;

• deletion or redaction where data is no longer needed;

• review of tools used for service delivery.

​

No system can be guaranteed to be completely secure, but QuestElle takes reasonable and proportionate steps to protect personal data.

​

15. Data Retention

​

QuestElle keeps personal data only for as long as reasonably necessary for the purpose for which it was collected.

​

Indicative retention periods are:

​

General enquiry data
Retention period: Up to 12 months after last contact.

​

Intake form data where no engagement follows
Retention period: Up to 12 months.

​

Client project records
Retention period: Up to 6 years after the end of the client relationship.

​

Accounting and invoice records
Retention period: 6 years.

​

Session recordings
Retention period: Up to 12 months unless needed for active service delivery, dispute protection or legal obligations.

​

Website analytics data
Retention period: According to analytics platform settings, usually no longer than 26 months where configurable.

​

Marketing preference records
Retention period: Until consent is withdrawn or the record is no longer required.

​

Legal or dispute-related records
Retention period: As long as necessary to protect legal rights or comply with legal obligations.

​

Client project data processed as a processor
Retention period: As agreed with the client, or deleted/returned after completion where appropriate.

​

Where personal data is no longer required, QuestElle will securely delete, anonymise or archive it as appropriate.
 

16. Your Rights

​

Under UK GDPR, individuals have rights in relation to their personal data.

​

These may include the right to:

• request access to personal data held about you;

• request correction of inaccurate or incomplete data;

• request deletion of personal data where applicable;

• request restriction of processing;

• object to certain types of processing;

• withdraw consent where processing is based on consent;

• request data portability where applicable;

• challenge certain automated decisions where applicable.

​

To exercise your rights, contact privacy@questelle.com

​

QuestElle may need to verify your identity before responding to a request.

​

Where QuestElle acts as a processor on behalf of a client, data rights requests relating to client-controlled data may need to be referred to the relevant client as data controller.

​

17. Complaints

​

If you have concerns about how QuestElle handles personal data, please contact us first so we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office.

​

ICO website: https://ico.org.uk
ICO helpline: 0303 123 1113

​

18. Changes to This Policy

​

QuestElle may update this Privacy Policy from time to time to reflect changes in services, legal requirements, operational practices or company structure.

​

Where material updates occur, the revised version will be published on questelle.com with an updated “Last updated” date.

Users are encouraged to review this policy periodically.

​

19. Contact

​

For questions about this Privacy Policy or to exercise your data rights, contact:

​

privacy@questelle.com

​

QuestElle Ltd
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom