Privacy Policy

1. Scope of this policy

This policy explains how Perfect Aurora Limited collects and uses personal data when you visit www.perfectaurora.com ("site"), contact us, make an enquiry, ask to receive our updates or otherwise deal with us before any separate engagement begins. The site is not intended for children, and we do not knowingly collect personal data relating to children through it. If your enquiry concerns a child, please provide only the information reasonably necessary for us to understand the nature of the enquiry. This policy does not govern personal data processed by Excello Law Limited in connection with legal services. If your enquiry is referred to or accepted by Excello Law Limited, Excello Law Limited will process personal data under its own privacy information and regulatory framework. The applicable controller and engagement terms will be confirmed before work begins.

2. Who we are / Controller

Controller

Perfect Aurora Limited is the controller responsible for personal data processed for the purposes described in this policy (referred to as Perfect Aurora, we, us or our). Perfect Aurora Limited is a company registered in England and Wales under company number 16036587. Its registered office is at 40 Churchill Road East, Wells, England, BA5 3HU. Perfect Aurora Limited is not itself authorised or regulated by the Solicitors Regulation Authority. Where legal services are provided through Excello Law Limited, Excello Law Limited is a separate controller and is authorised and regulated by the Solicitors Regulation Authority (SRA number 652733).

3. Contact details

If you have questions about this policy, wish to exercise a data protection right or wish to make a data protection complaint, please contact:

  • Post: Perfect Aurora Limited, 40 Churchill Road East, Wells, England, BA5 3HU

We have not appointed a data protection officer because we are not currently required to do so.

4. Personal data we collect

Personal data means information relating to an identified or identifiable individual. Depending on how you use the site or communicate with us, we may collect the following categories:

  • Identity Data: your name, title, employer, role and professional or business identifiers.
  • Contact Data: your business or postal address, email address, telephone number and communication details.
  • Enquiry and Matter Data: the content of your enquiry, the nature of the assistance sought, relevant background, documents you choose to provide, the identities of relevant people or organisations, and records of our communications.
  • Professional and Business Data: information about your organisation, sector, role, professional interests, referral source and business relationship with us.
  • Technical Data: internet protocol address, browser type and version, device and operating-system information, time-zone and approximate location, and other technology used to access the site.
  • Usage Data: information about how you use the site and interact with pages, links and communications.
  • Marketing and Communications Data: your preferences for receiving updates or marketing, your communication preferences, and records of messages sent to you and your interactions with them.
  • Compliance Data: information reasonably required for conflict, identity, fraud-prevention, sanctions, anti-money laundering or other regulatory checks, where applicable.

We may create aggregated or anonymous information for statistical and service-improvement purposes. Information that does not identify an individual is not personal data.

Special category and criminal offence data

Please do not send sensitive personal data unless it is genuinely relevant and reasonably necessary for your enquiry. An enquiry may nonetheless reveal special category data (for example, health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, or biometric or genetic data) or information about criminal allegations or convictions. Where we process such information, we will do so only where an additional condition under data protection law applies, for example where you have given explicit consent, processing is necessary for the establishment, exercise or defence of legal claims, or another condition in the Data Protection Act 2018 applies. We will apply additional safeguards where required.

5. How we collect personal data

We collect personal data through:

  • Direct interactions: when you complete a form, email or telephone us, arrange a meeting, provide a business card, request information, subscribe to updates, respond to a communication or otherwise correspond with us.
  • Automated technologies: when you use the site, cookies, server logs and similar technologies may collect Technical and Usage Data. See section 7 and the Cookie Policy.
  • Referrals and professional contacts: from people or organisations who introduce or refer you, professional advisers, networking contacts and other people involved in a potential matter or business relationship.
  • Public sources: from public registers, company websites, professional directories, Companies House, regulatory registers and other publicly available sources.
  • Service providers and counterparties: from website, IT, communications, scheduling, analytics or business-administration providers, and from Excello Law Limited where sharing is lawful and relevant to an enquiry or engagement.

If you provide personal data about another person, you should make sure you are entitled to do so and, where appropriate, bring this policy to their attention.

If you do not provide personal data

You are not generally required by law to provide personal data merely to browse the site. However, if you ask us to assess an enquiry or take steps towards an engagement, we may need certain information to understand the request, carry out relevant checks and communicate with you. If you do not provide information that is reasonably necessary, we may be unable to consider the enquiry, arrange an introduction or proceed towards an engagement.

6. How and why we use personal data

Data protection law requires us to have a lawful basis for each use of personal data. We generally rely on one or more of the following:

  • Steps before entering into a contract, or performance of a contract: where processing is necessary to respond to your request, take steps at your request before a contract, or perform a contract with you.
  • Legitimate interests: where processing is necessary for our legitimate business interests or those of another person, and those interests are not overridden by your rights and interests. We balance the relevant interests before relying on this basis.
  • Legal obligation: where processing is necessary to comply with a legal or regulatory obligation.
  • Consent: where you have given a freely given, specific, informed and unambiguous indication of your wishes. You may withdraw consent at any time.

Purposes and lawful bases

Change of purpose

We will normally use personal data only for the purpose for which it was collected. If we reasonably need to use it for a compatible purpose, we may do so. If we need to use it for an unrelated purpose, we will explain the relevant legal basis and provide any further privacy information required by law.

Automated decision-making

We do not currently make decisions that produce legal or similarly significant effects about you solely by automated means through the site.

7. Retention

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, regulatory, tax, accounting, insurance and reporting requirements. We may retain data longer where a complaint, dispute, investigation or potential legal claim makes this necessary.

Subject to confirmation against our operational retention schedule, our intended starting points are:

  • General enquiries that do not proceed: normally up to two years after the last substantive contact.
  • Marketing records and suppression lists: while you remain subscribed or there is an active business relationship, with minimal suppression information retained as necessary to respect an opt-out.
  • Website security and server logs: for the period reasonably necessary for security, troubleshooting and audit purposes, according to the relevant provider's configuration.
  • Contracts, financial records and substantive business correspondence: normally six years after the end of the relevant relationship or transaction.
  • Complaint, dispute and legal-claim records: for as long as reasonably necessary having regard to applicable limitation periods and regulatory requirements.

Where an enquiry becomes a matter for Excello Law Limited, the retention of prospective-client, conflict-check and client records will be governed by Excello Law Limited's applicable policies and professional obligations. We may anonymise personal data so that it can no longer be associated with you. We may use anonymous information indefinitely for statistical or research purposes.

8. Marketing and cookies

Direct marketing

We may send you relevant professional updates, invitations or information about our services where you have asked to receive them, where applicable electronic marketing rules permit us to do so, or where we have another lawful basis. We will obtain consent where it is required. You may opt out at any time by using the unsubscribe link in a marketing email or contacting us. Opting out of marketing will not stop service, administrative or regulatory communications that we need to send for another lawful purpose. We will obtain your express consent before sharing personal data with an independent third party for that third party's own direct marketing.

Cookies and similar technologies

The site may use cookies, server logs and similar technologies. Strictly necessary technologies may operate without consent where permitted by law. We will ask for consent before placing or using non-essential cookies or similar technologies where consent is required. For details of the technologies used, their purposes, durations, providers and how to change your choices, please see our Cookie Policy.

9. Sharing personal data

We may share personal data where reasonably necessary with:

  • Excello Law Limited and relevant personnel where an enquiry may be handled through Excello Law Limited, including for conflict, onboarding, regulatory and engagement purposes;
  • website hosting, cloud, email, IT support, cybersecurity, analytics, customer-relationship management, scheduling, document-management and communications providers;
  • professional advisers, consultants, insurers, auditors, accountants and bankers;
  • courts, tribunals, regulators, law-enforcement bodies, tax authorities and other public authorities where required or permitted by law;
  • other professional advisers or service providers whom you ask or authorise us to involve; and
  • a prospective buyer, seller, investor or successor in connection with a restructuring, financing, sale, transfer or merger of all or part of our business or assets.

Where a recipient acts as our processor, we require it to protect personal data, use it only for agreed purposes and act in accordance with our instructions. Some recipients, including Excello Law Limited, professional advisers, regulators and public authorities, may act as separate controllers under their own legal and professional responsibilities.

10. International transfers

Some technology and communications providers may store personal data, provide support from, or make personal data accessible in countries outside the UK. Where a transfer is subject to the UK international-transfer rules, we will use an approved mechanism as required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission's standard contractual clauses, or another lawful safeguard or exception. We will carry out any required transfer assessment and apply supplementary measures where appropriate. You may contact us for further information about the safeguards relevant to your personal data, subject to legitimate confidentiality and security restrictions.

11. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or use. Access is limited to people and providers who have a genuine need to know and who are subject to appropriate confidentiality obligations. No internet transmission or storage system is completely secure. Please do not use a website form or ordinary email to send highly sensitive information, original documents or time-critical instructions unless we have agreed an appropriate method with you. We maintain procedures for responding to suspected personal data breaches and will notify affected individuals and the relevant regulator where legally required.

12. Your rights

Depending on the circumstances, data protection law may give you the right to:

  • ask for access to your personal data and information about how we use it;
  • ask us to correct inaccurate or incomplete personal data;
  • ask us to erase personal data where there is no lawful reason for us to continue using it;
  • ask us to restrict how we use personal data in certain circumstances;
  • object to processing based on legitimate interests and object at any time to direct marketing;
  • receive personal data you provided to us in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller, where the right to data portability applies;
  • withdraw consent at any time where we rely on consent, without affecting processing carried out before withdrawal; and
  • ask for safeguards in relation to certain solely automated decisions, where applicable.

These rights are subject to legal conditions and exemptions. For example, we may need to retain or withhold information to protect legal privilege, confidentiality, another person's rights, or to comply with legal or regulatory obligations.

Your right to object

You have an absolute right to object at any time to the use of your personal data for direct marketing. You may also object to other processing based on legitimate interests. In that case, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for the establishment, exercise or defence of legal claims.

How to exercise a right

Contact us. You will not normally have to pay a fee. We may charge a reasonable fee or refuse a request where permitted by law, for example if it is manifestly unfounded or excessive. We may request information reasonably necessary to confirm your identity and understand the scope of your request. We aim to respond within one month, although the law allows additional time for particularly complex or numerous requests. If an extension applies, we will tell you.

13. Data protection complaints

If you are concerned about how we have used your personal data, please make a data protection complaint to annalisa@perfectaurora.com or write to the postal address in section 2. Please describe the issue and the outcome you are seeking, and provide any relevant dates or correspondence. We will acknowledge receipt of a data protection complaint within 30 days. Without undue delay, we will take appropriate steps to investigate and respond, keep you informed where appropriate, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. Details are available at https://ico.org.uk/make-a-complaint/ or by telephoning 0303 123 1113. You may approach the ICO at any time, although raising the matter with us first may allow it to be resolved more quickly.

14. Changes to this policy

We keep this policy under review and may update it to reflect changes in our services, technology, legal obligations or processing. The current version will be published on the site and will state the date of its latest update. This draft is dated 9 August 2026. Please keep us informed if personal data you have provided changes during your relationship with us.

15. Third-party links

The site may contain links to third-party websites, plug-ins or applications. Those third parties may collect or share personal data under their own policies. We do not control them and are not responsible for their privacy practices. We encourage you to read the privacy information provided by each third party you use.