Privacy Policy

2. Lawful Basis for Processing

Under Article 6 of the UK GDPR, we only process personal information where a valid, lawful basis exists:

• Contractual Necessity (Article 6(1)(b)): Processing necessary to execute, scope, or perform Master Services Agreements (MSAs), Statements of Work (SOWs), or preliminary staff augmentation placements.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate commercial interests in evaluating business requests for proposals (RFPs), defending our legal rights, and safeguarding cloud infrastructure security.
• Explicit Consent (Article 6(1)(a)): Clear, affirmative consent provided when opting into technical newsletters, whitepapers, or non-essential telemetry.
• Legal Obligation (Article 6(1)(c)): Processing required to satisfy statutory UK corporate, tax, and HMRC record-keeping requirements.

3. Information We Collect

Because we operate strictly as a B2B enterprise engineering consultancy, we collect only minimal, non-sensitive business data:

Note: We strictly do NOT collect Special Category data (health, biometric, religious, or political data) or engage in consumer credit profiling.

4. International Data Transfers

Where dedicated engineering squads or multi-cloud infrastructures operate across UK and European borders, all transfers are protected using:

• UK International Data Transfer Agreements (IDTA) or UK Addendum to the EU Standard Contractual Clauses (SCCs).
• Transfers to jurisdictions recognised as providing adequate data protection standards under UK adequacy regulations.
• Mandatory end-to-end TLSv1.3 cryptographic transport and AES-256 storage encryption at rest.

5. Data Retention & Security Standards

We retain prospect discovery records for a maximum of 24 months from last contact, unless converted into active commercial MSAs which are retained for 7 years pursuant to UK statutory limitation periods.

Technical safeguards include multi-factor authentication (MFA), zero-trust VPC network isolation, automated dependency vulnerability audits, and strict least-privilege employee access controls.

6. Data Subject Rights Under UK GDPR

Under Chapter III of the UK GDPR, you maintain comprehensive statutory rights regarding your personal data:

To exercise any statutory rights, email our compliance desk at info@neurostacktech.com. We respond within 30 calendar days as mandated by UK law.

7. Regulatory Authority & Complaints

You have the statutory right to lodge a complaint with the UK supervisory authority:

8. Contact Our Data Protection Officer

For questions regarding this policy or our data governance architecture, contact our London compliance desk: