Last updated: 11 September 2026
Your privacy matters. This policy explains how we collect, use, and protect your personal data in compliance with the UK GDPR and Data Protection Act 2018. We are a small, one-person consultancy, so when this policy says "we" or "us" it means AJ Consulting and, behind the brand, the company named below.
The data controller responsible for your personal data is AJ Tech Consulting Services Ltd, a company registered in England and Wales (Companies House No. 17193930), with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. AJ Consulting is a trading name of AJ Tech Consulting Services Ltd.
We are registered with the UK Information Commissioner's Office (ICO) under reference ZC138626.
Privacy enquiries: [email protected]
This privacy policy applies to all AJ Consulting services, including:
Depending on how you deal with us, you may fall into one or more of these groups:
We collect different types of personal data depending on which service you use:
| Data Type | Purpose | Lawful Basis (UK GDPR Art. 6) |
|---|---|---|
| Name | Identification and communication | Legitimate interests / Contract |
| Email Address | Communication and account access | Contract performance |
| Phone Number | Support and business communication (optional) | Legitimate interests |
| Service | Additional Data Collected | Purpose |
|---|---|---|
| Job Search (jobs.cv-board.com) | CV content, employment history, job preferences, payment info | CV tailoring and job matching |
| Support (support.aj-consulting.uk) | Issue descriptions, device information | Technical support provision |
| CV Hosting (cv.aj-consulting.uk) | CV content, access codes | CV hosting and access control |
| E-Signature (sign.aj-consulting.uk) | Signatory name, email address, the signature you provide, and a completion audit trail (IP address, timestamps, and actions taken) | Preparing, sending, executing and evidencing electronically signed documents |
| Booking and calls | Name, email, chosen time, any notes you add, and (for phone calls) a recording and transcript | Arranging and delivering calls and meetings, and keeping an accurate record of instructions |
Under UK GDPR Article 6, we rely on the following lawful bases:
Your data is used to:
We will never use your data for unsolicited marketing without your explicit consent.
We record some business calls. If you speak to us on a recorded line, we tell you at the start of the call.
Where we record a business call, we do so to keep an accurate record of instructions, quotes and what was agreed, to help us deliver work correctly, and for training and quality. Our lawful basis is our legitimate interests in accurate record-keeping and good service, balanced against your rights.
Recordings may be transcribed into text using speech-to-text software that runs on our own hardware in the United Kingdom. Recordings and transcripts are not sold, and they are not shared with third parties except where the law requires it, or where a processor named in this policy is genuinely needed to deliver the service (for example our own hosted systems).
We keep call recordings and transcripts for 5 years, after which they are deleted, unless we need to keep a specific recording longer to deal with a dispute or to meet a legal obligation.
You can object to being recorded. If you would prefer not to be recorded, tell us at the start of the call or email [email protected] and we will arrange an alternative. You can also ask for a copy of a recording of your own call, or ask us to erase it, using the rights set out below.
Transparency note: we use AI to help run the business and deliver some services. This section explains where, and what happens to your data.
Some processing uses AI models that run locally on our own infrastructure in the United Kingdom, with no data sent to an outside provider. This includes the CV tailoring and job matching on our job search platform, and the speech-to-text transcription described above. You review and approve AI-generated content on these platforms before it is used.
To help draft documents, analyse information and deliver client work, we also use the Claude AI assistant provided by Anthropic, PBC, a company based in the United States, through its commercial API. Where your personal data is included in the material we send to that service, Anthropic acts as our sub-processor. Based on Anthropic's own published terms (checked on 11 September 2026, and re-checked periodically):
We only send what is needed for the task, and we apply human oversight and judgement to anything AI helps produce. We do not use your data to train any AI model of our own.
We do not sell your personal data. We share data only where it is needed to run the service, and only with the following categories of recipient, each acting under a data processing agreement or equivalent terms:
Several of the systems we use are self-hosted on our own infrastructure in the United Kingdom rather than run by an outside company. These include our booking calendar (self-hosted Cal.com), our e-signature software (DocuSeal), our analytics (Umami) and our local AI models. Data handled by those systems stays on our own servers.
Your data is stored and processed on our own servers located in the United Kingdom (in Wales). We implement:
We store and process your personal data in the United Kingdom. Some of our processors process limited data outside the UK. In particular, Anthropic, PBC is based in the United States, and payment, email and network providers such as Stripe, Resend, SMTP2GO and Cloudflare may process limited data outside the UK. Where that happens, the transfer is protected by appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses together with the UK Addendum, or an adequacy decision.
| Data Type | Retention Period |
|---|---|
| Contact enquiries | 2 years from last contact |
| Account data | Duration of account + 30 days |
| Support tickets | 3 years from resolution |
| Call recordings and transcripts | 5 years, then deleted (longer only for a specific dispute or legal obligation) |
| Payment records | 7 years (legal requirement) |
| Signed documents & e-signature audit trail | Duration of the agreement, then up to 7 years (to meet legal and limitation-period requirements) |
| Data sent to Anthropic's API | Deleted by Anthropic within 30 days (limited safety and legal exceptions aside) |
| Server logs | 90 days |
Under UK GDPR, you have the right to:
To exercise these rights, contact: [email protected]. We will respond within one month.
We use essential cookies for:
We do not use tracking or advertising cookies, and we do not use Google Analytics or similar services.
We use Umami, a privacy-friendly, cookieless analytics tool self-hosted on our own infrastructure at analytics.aj-hosted.uk. Umami does not set cookies, does not track users across sites, and no data is shared with third parties.
Our services are not intended for users under 18 years of age. We do not knowingly collect data from children.
We may update this policy. We will notify you of significant changes via email or through our services. The "Last updated" date indicates when changes were last made.
If you have concerns about our data practices, please contact us first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113
For privacy-related questions or to exercise your rights:
Email: [email protected]
Postal: AJ Tech Consulting Services Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ