Privacy Notice

1. Who we are

Capital Narrative Ltd ("Capital Narrative", "we", "us" or "our") is the controller of the personal information described in this notice.

Company number: 17363625
Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Privacy contact: privacy@capital-narrative.co
ICO registration number: ZC215738

This notice applies to our main website, our Institutional Readiness Check and enquiries or communications connected with our services.

2. Information we collect

Depending on how you interact with us, we may collect:

• your name, work email address, company, role and company website;
• information you provide in an enquiry, meeting booking or other communication, including the building/context and message fields in our contact form;
• your answers to the Institutional Readiness Check, including your primary client type and stated adoption challenges;
• assessment outputs, including your overall result, result band, four-pillar scores, strongest and weakest pillars and lead priority;
• technical information such as your IP address, browser, device, user-agent information, approximate location, pages visited and cookie preferences; and
• records of our correspondence and any services we provide to you or your organisation.

Please do not submit confidential, sensitive or special-category personal information through the website or Readiness Check.

3. How and why we use your information

We use personal information to:

• operate, secure and improve our websites;
• administer the Institutional Readiness Check, calculate and provide results and respond to questions about those results;
• respond to enquiries, arrange meetings and discuss or provide our advisory services;
• maintain appropriate business and financial records;
• understand website performance and how visitors use our sites, where analytics consent has been given;
• measure and improve our LinkedIn activity, where advertising-cookie consent has been given; and
• send occasional marketing communications where permitted by law. You can object or unsubscribe at any time.

Our lawful bases are:

• legitimate interests—to operate and protect our business, respond to business enquiries, administer requested assessments and develop relevant B2B services, provided those interests are not overridden by your rights;
• steps before entering into, or performance of, a contract—where you or your organisation asks us to discuss or provide services;
• consent—for non-essential analytics or advertising technologies and where consent is required for marketing; and
• legal obligation—where we must retain or disclose information to comply with law.

4. Institutional Readiness Check

The Readiness Check uses the answers you provide to generate an indicative score, readiness band and related observations. This is automated scoring, but it does not make decisions that produce legal or similarly significant effects about you. The output is general business information, not investment, financial, legal or other regulated professional advice.

We may review a submission and contact you about your requested results or a relevant follow-up discussion. Receiving separate marketing communications is optional and is not required to complete the Check.

5. Who we share information with

We use trusted service providers that process information for us, including:

• Supabase, for database and application infrastructure;
• Resend, for assessment and service-related emails;
• Formspree, for website contact-form submissions;
• Lovable and Cloudflare, for website development, hosting, delivery and security;
• Google, where Google Analytics, appointment scheduling or Google Meet is used;
• LinkedIn, where you consent to the LinkedIn Insight Tag; and
• professional advisers, IT providers and authorities where reasonably necessary or legally required.

We do not sell your personal information.

Some providers may process information outside the United Kingdom. Where this occurs, we rely on an applicable adequacy decision or approved contractual safeguards, together with additional protections where appropriate.

6. How long we keep information

We normally retain Readiness Check submissions, enquiries and related business-contact information for up to 24 months after the latest meaningful interaction. We may retain information for longer where necessary to provide an ongoing service, establish or defend legal claims, or meet legal, tax and accounting obligations. When information is no longer required, we delete or anonymise it securely.

7. Cookies and similar technologies

Cookies and similar technologies are small files or identifiers used by websites and browsers. Our sites use strictly necessary cookies to operate, and may use analytics and advertising/measurement cookies where you have given consent.

For the categories, providers, purposes, indicative cookie names and durations, and instructions on managing or withdrawing your choices, please see our Cookie Policy.

8. Marketing

Where required, we ask for a separate, optional marketing choice. We may also send relevant B2B communications where the law permits and our legitimate interests apply. Every marketing email will provide a straightforward way to unsubscribe. We keep a limited suppression record where necessary to respect an opt-out.

9. Your rights

Depending on the circumstances, you may have the right to:

• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete or restrict our use of information;
• object to processing based on legitimate interests, including an absolute right to object to direct marketing;
• receive certain information in a portable format; and
• withdraw consent at any time where we rely on consent.

To exercise a right, email privacy@capital-narrative.co. We may need to verify your identity before acting on a request.

You may also complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the opportunity to address your concern first.

10. Security and changes

We use reasonable technical and organisational measures intended to protect personal information. However, no online service can guarantee absolute security.

We may update this notice when our websites, services or legal obligations change. The version date at the top shows when it was last revised.