Last updated: 12 September 2026
This policy explains what personal data H121Group Limited collects through h121group.com, why we collect it, and what rights you have. We've written it in plain language on purpose — a privacy policy nobody can read isn't transparency.
Who we are
H121Group Limited ("we", "us") operates this website and is the data controller for personal data collected through it.
Contact for any privacy matter: [email protected]
Postal address: 66 Paul Street, London, EC2A 4NA, United Kingdom
Legal entity: H121Group Limited trading as H121Group.Com
What we collect, and why
If you subscribe to updates: your email address, and your name if you choose to give it. We also record the date you subscribed and the exact wording of the consent you agreed to, so that we can tell you later what you actually said yes to — not merely that you said it.
Subscribing is a separate, optional action. It is never bundled with contacting us, with booking a call, or with using our tools, and nothing else you do on this site adds you to the list on your behalf. After you submit the form we send you a confirmation email: you are not subscribed until you click the link in it.
We use your address to send you the updates you asked for, and nothing else. Nothing from any other conversation is attached to your subscription — if you have used STRIDE, your readiness score, industry, company size and revenue band are not linked to it, and the subscribe form knows nothing about that conversation. We do not add people to this list from any other source: business contacts we have written to are not subscribers, and the two lists are kept apart.
Our lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in any email or by emailing us.
If you contact us: your email address and whatever you put in your message. We use it to reply and to keep a record of the correspondence. Our lawful basis is legitimate interests — responding to someone who has contacted us about our services.
If we contact you first about our services: where we write to a business contact whose details we found published on their employer's website, we hold your name, work email address, job title and employer. Our lawful basis is legitimate interests in offering a professional service we believe is relevant to your role. You can object at any time and we will stop permanently — one request, no follow-up, and we keep a record of the objection so that you are not contacted again.
Automatically, when you visit: limited technical and analytics data — pages viewed, approximate location derived from IP address, referring site, device and browser type. This is collected by our website platform and, where non-essential, only with your consent via the cookie banner. Our lawful basis for essential data is legitimate interests in operating a secure, working website.
What we never collect here: we do not ask for or want payment card details, identity documents, or special-category data through this website. Please do not send sensitive personal information by email.
Essential cookies keep the site working and secure — these cannot be switched off. Analytics cookies help us understand which pages are useful; these are optional and only set if you consent. You can change your choice at any time through the cookie banner link in our footer, or by clearing cookies in your browser.
Who else processes your data
beehiiv, Inc. — our website and email platform, acting as our processor. Your subscription data is stored on their infrastructure, which is based in the United States. Transfers outside the UK/EEA are covered by the safeguards in their data processing terms.
Calendly — our meeting-booking platform, acting as our processor. When you book a conversation with us, the name, email address and any details you enter on the booking form are held on their infrastructure, which is based in the United States. Transfers outside the UK/EEA are covered by the safeguards in their data processing terms. You can ask us to delete a booking record at any time using the contact above.
Google Cloud — hosting and infrastructure, acting as our processor. Processing is governed by Google's Cloud Data Processing Addendum, which forms part of our contract with them and sets out their obligations, sub-processors and transfer safeguards.
We do not sell your personal data. We do not share it with advertisers. We do not pass your details to any partner without your explicit request or consent.
A note on referral links. Where we publish a referral link, it is disclosed as one at the point it appears. If you follow it, the destination platform collects your data under their privacy policy, not ours, and we receive no personal data about you from them. We may receive a commission. Please read their policy before signing up with them.
How long we keep it
Subscriber data: until you unsubscribe or ask us to delete it. If you unsubscribe we deliberately keep a suppression record — your email address, marked "do not contact" — so that you are not added back and contacted again by mistake. That record is kept, and used, only for that purpose. If you would rather we erased it entirely, say so and we will.
Correspondence: up to 24 months after our last exchange, unless it forms part of a client engagement record with its own retention terms.
Business contacts who asked not to be contacted again: we keep the minimum needed to honour that request permanently, which is the reason we cannot delete it entirely.
Analytics: as retained by our platform, in aggregate.
Your rights
Under UK and EU data protection law you have the right to access your data, correct it, delete it, restrict or object to our processing, withdraw consent, and receive a copy in a portable format. We don't charge for this and we'll respond within one month.
To exercise any of these: email [email protected]
Withdrawing consent is not the same as erasure. Every email carries an unsubscribe link and you can withdraw at any time, as easily as you gave it. Unless you ask us to erase it, we keep a suppression record of your address marked "do not contact" — precisely so that you are not signed back up by mistake; see "How long we keep it". If you would rather we erased it entirely, say so and we will, and we will tell you plainly that we can then no longer guarantee you will not be re-added if your address reaches us again from another source.
If you're a California resident: as a matter of practice we extend the same rights to you — to know what we collect, to request deletion, and to opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law, and we will not discriminate against you for exercising any right.
If you're unhappy with how we've handled your data: please tell us first, and we'll try to fix it. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority.
Children
This website is aimed at businesses and professionals. We don't knowingly collect data from anyone under 16. If you believe a child has given us their data, email us and we'll delete it.
AI and how we work
We use AI tools in our work and we say so openly. We do not put your personal data, or our clients' data, into AI tools. Where content on this site was AI-assisted, our editorial standard is that a person verifies it before it publishes — and we disclose AI involvement wherever not saying so would mislead you.
Changes to this policy
If we change this policy we'll update the date at the top, and for anything material we'll tell subscribers by email rather than quietly editing the page.