Last updated: 9 January 2026
Who we are
CSR Host Consulting Ltd (“CSR Host”, “we”, “us”, “our”) is a management consultancy registered in England and Wales. We are the data controller for the personal data described in this policy, except where we act as a processor on a client’s behalf – explained under Research and evaluation participants below.
Registered office: 148 The Rose Bowl, Portland Crescent, Leeds LS1 3HB
Email: hello@csrhost.co.uk
Telephone: 0113 871 5001
Company number: 10594033
ICO registration number: –
We have not appointed a Data Protection Officer, as we are not required to under Article 37 of the UK GDPR. Questions about this policy or about how we handle personal data should be sent to hello@csrhost.co.uk.
In short
We collect very little from people who simply read this website. We collect more from people who contact us, subscribe to our newsletter, or become clients. On some engagements we collect data from members of the public – survey respondents and interviewees — and that work is governed by the section below and by our contract with the commissioning organisation.
We do not sell personal data. We do not share it for advertising. We do not use it to build profiles of individuals.
The personal data we collect, and why
Website visitors
When you visit csrhost.co.uk our web server records technical information sent by your browser: your IP address, browser type and version, the pages you viewed, the time and date, referring page, and similar diagnostic data. This is standard server logging and is used to keep the site running, investigate faults and protect against abuse.
Lawful basis: legitimate interests (Article 6(1)(f)) — operating and securing our website. We consider this proportionate because the data is minimal, retained briefly, and not used to identify individuals.
Fonts and images used in the site’s design are served from our own hosting rather than from a third party, so simply reading a page does not disclose your visit to anyone else. Two exceptions are worth naming:
- Our Insights page displays recent posts from our Bluesky account. The text is fetched by our server, not your browser, but any images attached to those posts are loaded directly from Bluesky’s content delivery network — which means your IP address is visible to Bluesky when the page loads.
- Links to other websites take you to organisations whose privacy practices are their own, not ours.
People who contact us
If you complete our enquiry form, email us or call us, we collect your name, email address, telephone number, organisation and whatever you choose to tell us about your project or enquiry. We use this to respond, to assess whether we can help, and to prepare a proposal if appropriate.
Lawful basis: steps taken at your request prior to entering a contract (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)) in responding to business enquiries.
Our enquiry form is protected by Akismet Anti-spam to prevent automated submissions. This checks whether the submission appears to come from a person rather than a bot.
Newsletter subscribers
If you subscribe to our newsletter we collect your email address, and your name if you give it. We use it only to send the newsletter. Every edition carries an unsubscribe link, and unsubscribing takes effect immediately.
Lawful basis: consent (Article 6(1)(a)), and Regulation 22 of the Privacy and Electronic Communications Regulations 2003. You can withdraw consent at any time without affecting anything we sent before.
Our newsletter is delivered using Jetpack, who process subscriber data on our behalf.
Clients and prospective clients
During an engagement we hold business contact details for the people we work with, correspondence, meeting notes, documents you share with us, and the records needed to invoice and account for the work.
Lawful basis: performance of a contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) for accounting and tax records; and legitimate interests (Article 6(1)(f)) in managing the relationship and keeping a record of our work.
Research and evaluation participants
Some of our work — impact evaluation, socio-economic assessment, feasibility research — involves collecting information from members of the public through surveys, interviews and workshops. This section explains how we treat that data.
Who controls it. Where we are commissioned by a client to carry out research on their behalf, that client is normally the data controller and we act as their processor under a written contract that meets Article 28 of the UK GDPR. Where we carry out research on our own initiative, we are the controller. We will always tell you which applies before you take part, in a participant information sheet or at the start of the interview.
What we collect. Only what the research question requires. Typically: your responses, your role or relationship to the project being evaluated, and basic demographic information where the evaluation requires it.
Special category data. Some evaluations ask about matters that are special category data under Article 9 — health, ethnicity, religion, disability. We collect this only where the evaluation genuinely needs it, we say so clearly before you answer, and you can decline any individual question and still take part. Where we are the controller, our condition for processing is your explicit consent (Article 9(2)(a)) or archiving and research purposes (Article 9(2)(j)) as set out in the participant information you receive.
Lawful basis: consent (Article 6(1)(a)) for most direct research participation; occasionally public task (Article 6(1)(e)) or legitimate interests (Article 6(1)(f)) where a public body has commissioned the work and that basis has been agreed with them.
What we report. Findings are reported in aggregate or anonymised form. We do not attribute quotations to named individuals without separate, explicit permission. Taking part is voluntary, and you may withdraw at any point up to the date given in your participant information — after that point your responses will usually have been merged into the analysis and cannot be separated out.
Suppliers, associates and applicants
We hold contact and payment details for associates and suppliers, and the information people send us when applying to work with us.
Lawful basis: contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).
Cookies
Cookies are small files placed on your device by a website. We use:
- Strictly necessary cookies — set by WordPress to keep the site working and to protect form submissions. These do not require consent.
- Analytics cookies, which tell us how many people visit and which pages they read. These are set only if you agree.
Non-essential cookies are not set unless you consent, and you can change or withdraw that choice at any time through the cookie banner. You can also block or delete cookies in your browser settings, though some parts of the site may then not work as intended.
Who we share personal data with
We share personal data only with organisations that provide services to us, and only so far as they need it:
- our website hosting provider, Krystal
- our newsletter platform, Jetpack
- our email and document provider, Jetpack
- our accountants and, where required, our professional advisers
- our bank and payment providers
Each is bound by contract to process personal data only on our instructions and to keep it secure.
We will also disclose personal data where we are legally required to do so, or to establish, exercise or defend legal claims.
We do not sell personal data, and we do not share it with advertisers or data brokers.
Transfers outside the UK
Some of our service providers are based outside the United Kingdom, or store data outside it. Where personal data is transferred out of the UK we rely on either UK adequacy regulations, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where one is required.
You can ask us which providers are involved and what safeguards apply by emailing hello@csrhost.co.uk.
How long we keep personal data
| What | How long |
|---|---|
| Website server logs | Typically 30 to 90 days |
| Enquiries that do not become work | 12 months from the last contact |
| Client records and project files | 6 years after the engagement ends |
| Accounting and tax records | 6 years from the end of the financial year |
| Newsletter subscriptions | Until you unsubscribe |
| Research and evaluation data | As set out in the contract with the commissioning client — usually returned or deleted at the end of the engagement. Anonymised data, which is no longer personal data, may be retained |
| Unsuccessful applications | 6 months |
Where we no longer need personal data we delete it or anonymise it.
Security
We take appropriate technical and organisational measures to protect personal data: encrypted connections to this website, access controls on our systems, multi-factor authentication, and restricting access to those who need it. No transmission over the internet and no method of electronic storage is completely secure, and we cannot guarantee absolute security — but we do take the obligation seriously, and we will notify you and the ICO of a personal data breach where the law requires it.
Your rights
Under the UK GDPR you have the right to:
- be informed about how we use your personal data — this policy
- access the personal data we hold about you
- rectification of inaccurate or incomplete data
- erasure of your data in certain circumstances
- restrict processing in certain circumstances
- data portability — to receive data you gave us in a machine-readable form
- object to processing based on legitimate interests, and to direct marketing at any time
- not be subject to solely automated decision-making with legal or similarly significant effects. We do not make decisions about people in this way.
To exercise any of these, email hello@csrhost.co.uk. We will respond within one month. There is no charge, and we may ask you to confirm your identity first.
If we are acting as a processor for a client — most commonly on evaluation work — we will pass your request to that client, who is the controller, and tell you we have done so.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at hello@csrhost.co.uk so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office at any time:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 ico.org.uk/make-a-complaint
Children
This website and our services are intended for professional and business audiences, and are not directed at children. We do not knowingly collect personal data from children through this website.
Where an evaluation involves people under 18 — which happens occasionally in community and cultural projects — we do so only under a protocol agreed with the commissioning organisation, with appropriate consent from a parent or guardian where required, and in line with our safeguarding obligations.
Other websites
This website links to other organisations’ websites. We are not responsible for their content or their privacy practices, and we would encourage you to read the privacy policy of any site you visit.
Changes to this policy
We review this policy periodically and will update it when our practices change or the law requires. The date at the top shows when it was last revised. Material changes will be flagged on this page; if the change significantly affects how we use personal data you have already given us, we will contact you directly.
Contact us
CSR Host Consulting Ltd 148 The Rose Bowl, Portland Crescent, Leeds LS1 3HB hello@csrhost.co.uk 0113 871 5001