Skip to main content
    Back to Home

    Privacy Policy

    Last updated: 13 October 2026

    1. Introduction

    AY Strategy Ltd ("AY Strategy", "we", "us", or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR) 2016/679, the Israeli Privacy Protection Law 5741-1981, the California Consumer Privacy Act (CCPA), and all other applicable data protection legislation worldwide.

    This policy applies to all individuals who interact with us, including clients, prospective clients, website visitors, business contacts, and any other data subjects whose personal data we may process.

    2. Data Controller

    The data controller responsible for your personal data is:

    AY Strategy Ltd
    275 New N Rd PMB 3032, London, N1-7AA, United Kingdom
    Email: privacy@ay-strategy.com

    For any data protection inquiries, you may contact our Data Protection Officer at the address above.

    3. Personal Data We Collect

    We may collect and process the following categories of personal data:

    3.1 Information You Provide

    • Full name, title, and professional designation
    • Contact details (email address, telephone number, postal address)
    • Professional and employment information
    • Information contained in correspondence and communications with us
    • Any information you voluntarily provide in connection with our services

    3.2 Information Collected Automatically

    • IP address and approximate geolocation
    • Browser type, version, and language preferences
    • Operating system and device information
    • Pages visited, access times, and referring URLs
    • Cookies and similar tracking technologies (see our Cookie Policy)

    3.3 Information from Third Parties

    • Publicly available information from lawful sources
    • Information provided by our clients in connection with engagement instructions
    • Business referral information from professional networks

    4. Legal Basis for Processing

    We process personal data only where we have a lawful basis under applicable data protection law, including:

    • Contractual Necessity: Processing necessary for the performance of a contract to which you are a party or to take pre-contractual steps at your request.
    • Legitimate Interests: Processing necessary for our legitimate business interests, including the provision of intelligence and strategic advisory services, provided these interests are not overridden by your fundamental rights and freedoms.
    • Legal Obligation: Processing necessary for compliance with a legal obligation to which we are subject.
    • Consent: Where you have given explicit consent to the processing of your personal data for one or more specific purposes. You have the right to withdraw consent at any time.
    • Vital Interests: Processing necessary to protect the vital interests of the data subject or another natural person.

    5. Purposes of Processing

    We use your personal data for the following purposes:

    • Providing and managing our intelligence, investigative, and strategic advisory services
    • Communicating with you regarding our services and your inquiries
    • Complying with legal, regulatory, and professional obligations
    • Protecting our rights, property, and the safety of our personnel and clients
    • Maintaining and improving our website and IT systems
    • Recruitment and employment processing
    • Preventing fraud, money laundering, and other criminal activities
    • Administering our business operations and internal record-keeping

    6. Data Sharing and Disclosure

    We may share your personal data with:

    • Authorised Personnel: Our employees and contractors who need access to perform their duties, subject to strict confidentiality obligations.
    • Professional Advisors: Legal counsel, auditors, and other professional advisors engaged by us.
    • Regulatory and Law Enforcement Authorities: Where required by law, regulation, court order, or governmental request.
    • Service Providers: Third-party service providers who process data on our behalf (e.g., IT hosting, cloud storage), subject to appropriate data processing agreements.

    We never sell, rent, or trade your personal data to third parties for marketing purposes.

    7. International Data Transfers

    Given our global operations (United Kingdom, United States, and Israel), your personal data may be transferred to and processed in countries outside your country of residence. Where such transfers occur, we ensure appropriate safeguards are in place, including:

    • Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO
    • Adequacy decisions by the relevant data protection authority
    • Binding Corporate Rules or other approved transfer mechanisms
    • Your explicit consent where appropriate

    8. Data Retention

    We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, regulatory, accounting, or reporting requirements. Retention periods are determined based on:

    • The nature and sensitivity of the personal data
    • The purposes for which it is processed
    • Applicable legal and regulatory requirements
    • Applicable limitation periods for potential legal claims

    When personal data is no longer required, it will be securely destroyed or anonymised.

    9. Your Rights

    Under applicable data protection laws, you may have the following rights:

    • Right of Access: The right to request a copy of the personal data we hold about you.
    • Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
    • Right to Erasure: The right to request deletion of your personal data in certain circumstances.
    • Right to Restrict Processing: The right to request that we restrict the processing of your personal data.
    • Right to Data Portability: The right to receive your personal data in a structured, commonly used, machine-readable format.
    • Right to Object: The right to object to processing based on legitimate interests or direct marketing.
    • Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.
    • Right to Lodge a Complaint: The right to lodge a complaint with a supervisory authority (e.g., the UK Information Commissioner's Office).

    To exercise any of these rights, please contact us at privacy@ay-strategy.com. We will respond within 30 days or as required by applicable law.

    10. Data Security

    We implement industry-leading technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

    • End-to-end encryption for data in transit and at rest
    • Multi-factor authentication and strict access controls
    • Regular security assessments and penetration testing
    • Employee training on data protection and information security
    • Incident response and breach notification procedures
    • Physical security measures at all office locations

    11. Children's Privacy

    Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take immediate steps to delete such data.

    12. California Residents (CCPA/CPRA)

    If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including:

    • The right to know what personal information is collected, used, and disclosed
    • The right to request deletion of personal information
    • The right to opt out of the sale or sharing of personal information
    • The right to non-discrimination for exercising your rights
    • The right to correct inaccurate personal information
    • The right to limit the use of sensitive personal information

    We do not sell your personal information.

    13. Changes to This Policy

    We reserve the right to update this Privacy Policy at any time. Material changes will be notified via our website or by direct communication where appropriate. We encourage you to review this policy periodically. Your continued use of our website or services following any changes constitutes acceptance of the revised policy.

    14. Contact Us

    For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact:

    AY Strategy Ltd — Data Protection
    275 New N Rd PMB 3032, London, N1-7AA, United Kingdom
    Email: privacy@ay-strategy.com