Privacy Policy
Brass Neck Communications Ltd, trading as brass neck
Last updated: 14 September 2026
1. Who we are
Brass Neck Communications Ltd (trading as “brass neck”) is a company registered in Scotland under company number SC809255, with our registered office at 55 Ocean Drive, Edinburgh, Scotland, EH6 6JH.
We are the “data controller” for the personal data described in this policy - which means we decide how and why it's used.
If you have any questions about this policy or how we handle your data, please contact:
Kirsten Paul, Co-Founder and Director of Communications
We are registered with the Information Commissioner's Office (ICO), registration reference ZC247550.
2. What this policy covers
This policy explains how we collect, use, store and protect personal data when you interact with Brass Neck - whether you're a client, prospective client, event contact, supplier, partner, stakeholder, media contact/journalist, or simply a visitor to our website. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018, and follows guidance published by the Information Commissioner's Office (ICO)
.
Our website also has a separate Cookie Policy, which explains the cookies and similar technologies we use in more detail.
3. The personal data we collect
We only collect personal data relating to people in a professional capacity. We do not knowingly collect special category data (such as health, religious belief or ethnicity), and brass neck operates business-to-business, so we do not knowingly collect data from anyone under 18.
4. Why we use your data, and our lawful basis
Data protection law requires us to have a valid “lawful basis” for everything we do with personal data. Here's how that applies to brass neck:
Where we rely on “legitimate interests”, we've considered that our use of your data is proportionate, within your reasonable expectations, and doesn't unfairly override your own rights. You can object to processing carried out on this basis (see Section 8).
5. Who we share your data with
We share personal data with a small number of trusted service providers who help us run brass neck day to day. They only receive the data needed to provide their service, and we don't sell or rent personal data to anyone.
When we work with an external consultant on a project, we may give them access to the specific Google Drive folders needed for that work. We may also grant clients access to particular documents so they can review our output. Access is limited to what's necessary and removed once it's no longer needed.
We may also share data with our professional advisers (such as our accountant), or with regulators and authorities where we're legally required to do so.
We do not use automated decision-making or profiling.
6. International data transfers
Some of the providers listed above — including Google, Microsoft and Calendly — may store or process data outside the UK, including in the United States. Where this happens, we rely on the safeguards those providers have in place, such as Standard Contractual Clauses or the UK's International Data Transfer Addendum, so your data continues to receive an equivalent standard of protection wherever it's processed.
7. How long we keep your data
We will hold your personal information:
-
For as long as is necessary for the relevant activity
-
For as long as we are required to for the purposes of providing our services to you
-
For as long as we are required to do so by law
-
In order to establish, exercise or defend our legal rights
If you'd like us to delete your details sooner, contact us at hello@brassneckhq.com and we'll action this unless we're required by law to keep it.
8. Your rights
Under the UK GDPR, you have the right to:
-
Access the personal data we hold about you
-
Have inaccurate data corrected
-
Have your data deleted, in certain circumstances
-
Restrict or object to how we use your data
-
Request your data in a portable format
-
Withdraw consent at any time, where we rely on consent
To exercise any of these rights, contact us at hello@brassneckhq.com. We'll respond within one month.
If you're unhappy with how we've handled your data, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113.
9. Keeping your data secure
We take appropriate technical and organisational measures to protect personal data against loss, misuse or unauthorised access — including restricting access to trusted platforms (Google Workspace and Microsoft 365) and only working with third parties who take data protection seriously.
10. Changes to this policy
We may update this policy from time to time — for example, if the tools or services we use change. The latest version will always be available on our website, with the date it was last updated shown at the top.
11. Contact us
Brass Neck Communications Ltd
55 Ocean Drive, Edinburgh, Scotland, EH6 6JH
Clients
What we collect: Name, job title, company, email address, phone number, and records of our communications and the work we do together.
How we do it: Directly from you, when you engage us or communicate with us.
Media contacts
What we collect: Name, publication/outlet, role, email address, phone number.
How we do it: Directly from you, or compiled from publicly available professional sources (e.g. media databases or publication contact pages).
Prospective clients & event contacts
What we collect: Name, job title, company, email address, phone number, and notes from meetings or conversations.
How we do it: Directly from you, when you book a meeting with us (e.g. via Calendly), or when we meet at industry events.
Website visitors
What we collect: General usage data — pages visited, time on site, approximate location and device type — via Google Analytics.
How we do it: Automatically, via cookies. See our Cookie Policy for details.
Partners, stakeholders & suppliers
What we collect: Name, company, role, email address, phone number, and invoicing/financial details.
How we do it: Directly from you, or via our invoicing and accounting records.
Delivering services & managing client relationships
Lawful basis: Performance of a contract, and steps taken at your request before entering into one.
Managing suppliers, partners & invoicing
Lawful basis: Performance of a contract, and legal obligation (e.g. accounting and tax record-keeping).
Responding to enquiries & managing new business
Lawful basis: Legitimate interests — running and growing our business.
Understanding how people use our website
Lawful basis: Legitimate interests and/or consent, depending on the cookie — see our Cookie Policy.
Maintaining media contact database for clients
Lawful basis: Legitimate interests — media relations is a standard and reasonably expected part of our industry.
Sending marketing communications
Lawful basis: Consent, obtained separately and directly from you at the point of sign-up.