Last updated: 22 April 2026
Applies to: https://qmsgurus.co.uk and any page that links to this notice
1) Who we are (Data Controller)
QMS Gurus is a website owned and managed by Net Zero Gurus Limited (“Net Zero Gurus”, “we”, “us”, “our”).
Net Zero Gurus Limited is the data controller for personal data collected via this website and through our marketing, sales, consultancy, and client‑support activities.
Registered company:
Net Zero Gurus Limited
Postal address:
Cavendish House, 3 Brighton Road
Liverpool L22 5NG
United Kingdom
General contact:
hello@netzerogurus.co.uk
Data Protection Officer (DPO):
Andrew Foote: hello@netzerogurus.co.uk
In certain client engagements, we may act as a data processor on behalf of another organisation (for example, a council, housing association, or commercial client). In those circumstances, we process personal data only on their instructions and their privacy notice will also apply.
2) Scope of this notice
This notice explains how we collect, use, disclose, and protect personal data when you:
- Visit https://qmsgurus.co.uk (“Website”)
- Contact us, submit an enquiry, or download resources
- Engage with our quality management, ISO, compliance, audit, or consultancy services
- Attend meetings, training, or events delivered or promoted via the Website
3) Personal data we collect
Data you provide to us
- Identity & contact details: name, job title, organisation, email address, telephone number, postal address
- Communications: enquiries, emails, meeting notes, feedback, correspondence
- Preferences: marketing preferences and subscription choices
- Transaction data: invoices, purchase history, payment references (we do not store full card details)
- Project & business data: information required to scope and deliver quality management, compliance, audit, and consultancy services
Special category data (only if necessary)
We do not routinely collect special category data via this Website. In limited circumstances, you may choose to provide information that could reveal health‑related or other sensitive data (for example, accessibility or reasonable‑adjustment requirements). Such data is processed only where:
- You give explicit consent, or
- Processing is necessary to protect vital interests.
We do not intentionally collect criminal conviction or offence data.
Data collected automatically
- Technical & usage data: IP address, browser type/version, device identifiers, operating system, pages viewed, timestamps, referrer URLs, and approximate location
- Cookies & similar technologies: see Section 11 (Cookies)
4) Where we get your data from
We collect personal data from:
- You directly (web forms, email, phone calls, meetings, events)
- Your employer or organisation (where you act in a business capacity)
- Our service providers (e.g. hosting, analytics, CRM platforms), limited to what is necessary
- Publicly available sources (e.g. company websites or professional directories), where lawful
5) Purposes and lawful bases for processing
We only process personal data where a lawful basis under UK GDPR applies.
| Purpose | Examples | Lawful Basis |
|---|---|---|
| Enquiries & service delivery | Quotes, scoping, consultancy, audits, ongoing support | Contract or Legitimate Interests |
| Administration & billing | Invoices, payments, record‑keeping | Contract; Legal obligation |
| Service improvement & security | Website analytics, troubleshooting, fraud prevention | Legitimate Interests |
| Marketing & communications | Updates, insights, event invitations | Consent (PECR); Soft opt‑in; Legitimate Interests (B2B) |
| Compliance & legal matters | Audits, legal claims, regulatory requests | Legal obligation; Legitimate Interests |
| Special category data (if applicable) | Accessibility or vulnerability considerations | Explicit consent; Vital interests |
Marketing rules (UK PECR):
Electronic marketing is sent only where permitted by law. All messages include a clear opt‑out.
6) Cookies and similar technologies
We use cookies and similar technologies to:
- Enable core website functionality
- Remember user preferences
- Measure and improve website performance
Where required, consent is obtained via a cookie banner. You may update your preferences or withdraw consent at any time.
See our Cookie Policy for full details.
7) Who we share data with
We may share personal data, where necessary and with appropriate safeguards, with:
- Website hosting, IT, and security providers
- Email, communications, and productivity platforms
- Analytics and performance‑monitoring providers
- Payment processors and banking providers
- Professional advisers (legal, accounting, insurance)
- Clients or partner organisations where required to deliver services
- Regulators or authorities where legally required
We do not sell personal data.
8) International data transfers
We do not transfer personal data outside of the UK. If we did in the future, we shall ensure appropriate safeguards are in place, including:
- UK International Data Transfer Agreements (IDTA), or
- EU Standard Contractual Clauses with the UK Addendum
Further details are available on request.
9) Data retention
We retain personal data only as long as necessary:
- Enquiries (no contract): up to 24 months
- Marketing data: until opt‑out or 24 months of inactivity
- Contract, billing & tax records: 6 years from financial year end
- Website logs & security data: typically up to 12 months
- Project and compliance records: duration of the engagement plus at least 6 years, or longer where required by law or scheme rules
Data is securely deleted or anonymised when no longer required.
10) Your rights
You have the right to:
- Be informed
- Access your data
- Rectify inaccuracies
- Request erasure (where applicable)
- Restrict processing
- Data portability
- Object to processing, including direct marketing
- Not be subject to solely automated decision‑making (we do not carry this out)
To exercise your rights, contact:
hello@netzerogurus.co.uk
We normally respond within one month.
You may complain to the Information Commissioner’s Office (ICO):
https://ico.org.uk/make-a-complaint/
11) Children
Our services are not directed at children under 18. We do not knowingly collect personal data from minors.
12) Security
We apply appropriate technical and organisational measures including access controls, encryption in transit, secure configuration, monitoring, and staff training. Where a reportable data breach occurs, we will notify the ICO and affected individuals in accordance with UK GDPR.
13) Our role as a processor
Where Net Zero Gurus Limited acts as a data processor, we process personal data only in accordance with documented instructions and a UK GDPR‑compliant data processing agreement.
14) Third‑party links
The Website may contain links to third‑party websites. We are not responsible for their privacy practices and encourage you to review their privacy notices.
15) Do Not Track
We do not currently respond to Do‑Not‑Track browser signals.
16) Changes to this notice
This Privacy Policy may be updated from time to time. The “Last updated” date indicates the most recent revision.
17) Contact us
Net Zero Gurus Limited
Cavendish House, 3 Brighton Road
Liverpool L22 5NG
United Kingdom
General & privacy enquiries:
hello@netzerogurus.co.uk
Data Protection Officer:
Andrew Foote: hello@netzerogurus.co.uk