Last updated: 17 August 2026
This policy explains what personal data One Stop Future Consultants Limited collects, why we hold it, who it is shared with and what rights you have over it.
Who We Are
One Stop Future Consultants Limited is the data controller for the personal data described below.
- Registered in: Ireland, Companies Registration Office, number 725318
- Registered office: Nawab Ali Building, Main Street, Ballaghaderreen, County Roscommon, Ireland
- Data protection contact: [email protected]
We are an Irish company offering services to people and businesses in the United Kingdom. That means the UK GDPR and the Data Protection Act 2018 apply to our processing of UK personal data, and the EU GDPR applies to our processing generally. In practice we apply the higher standard of the two throughout rather than sorting records by which regime they fall under.
Two Different Roles
This distinction decides which rules apply, so it comes first.
For our own business contacts, enquiries and website visitors we are the controller. We decide what is collected and why, and this policy governs it.
For personal data inside a client’s own systems that we work on during a project, we are a processor acting on that client’s written instructions. That processing is governed by the data processing agreement signed with the client, and the client remains the controller. If your data sits in a system one of our clients asked us to build, your rights are exercised against them, and we will assist them in answering you.
What We Collect
If you contact us. Your name, email address, employer, and whatever you choose to tell us about your project. If a call follows, our notes from it.
If you become a client. The contact details of the people we deal with, commercial terms, billing details, and the correspondence that builds up over an engagement.
If you visit this site. The pages viewed and basic technical information such as approximate location, device and browser. We keep this deliberately minimal. There is no advertising on this site and no social media tracking embedded in it.
Access credentials. Projects often require access to a client’s systems. Where accounts are issued to us, we hold those credentials for the life of the engagement and return or destroy them at the end.
We do not collect special category data, and we ask that you do not send it to us in an enquiry.
Why We Process It, and the Lawful Basis
| Purpose | Lawful basis |
|---|---|
| Replying to an enquiry and scoping possible work | Legitimate interests, and steps taken at your request before a contract |
| Delivering a project and supporting it afterwards | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation |
| Keeping records of what was agreed and delivered | Legitimate interests, and legal obligation |
| Understanding how the site is used | Legitimate interests |
Where we rely on legitimate interests, that interest is in operating and improving a consultancy business, and we have weighed it against your rights. You may object at any time using the address above.
Who We Share It With
- Service providers who host our systems, deliver our email and process our accounts, each under a written contract restricting what they may do with the data.
- Professional advisers, such as accountants or solicitors, where genuinely necessary.
- Statutory bodies, where the law requires it.
We do not sell personal data. We do not share it for advertising. We do not name clients publicly without written permission, which is why this site carries no logos and no case studies.
Transfers Outside the UK and the EEA
Set out plainly, because it matters.
Our engineering work is delivered from Ireland and Pakistan. Ireland is covered by a UK adequacy decision. Pakistan is not covered by a UK or EU adequacy decision, so UK personal data accessible to our team there is transferred under the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment. EU personal data is transferred under the Standard Contractual Clauses themselves.
You may request a copy of the relevant safeguards at the address above.
Where a client requires that no personal data leaves the UK or the EEA, we can staff and architect the work accordingly. Raise it at the first conversation, because it changes the design rather than the paperwork.
How Long We Keep It
- Enquiries that do not become work: 12 months from the last contact, unless you ask sooner.
- Client records and correspondence: 6 years after the engagement ends, reflecting the period in which a claim could be brought.
- Accounting records: 6 years.
- Access credentials issued to us: returned or destroyed at the end of the engagement.
- Website analytics: no longer than 14 months.
Your Rights
You have the right to be told what we hold, to receive a copy of it, to have inaccurate data corrected, to have data erased where there is no continuing reason to hold it, to restrict or object to processing, and to receive certain data in a portable format. Where we rely on consent you may withdraw it at any time.
To exercise any of these, email [email protected]. We respond within one month and there is no charge.
Cookies
We use only what is needed to make the site work. There are no advertising cookies and no social media trackers.
Complaints
Tell us first, so we have a chance to put it right.
You may also complain to a supervisory authority. In the United Kingdom that is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. As we are established in Ireland, you may instead complain to the Data Protection Commission.
Changes
We update this policy when our processing changes. The date at the top shows the current version. Where a change materially affects you, we will tell you directly rather than rely on you noticing.