Data Protection Policy

Last Updated: November 6, 2025

This Data Protection Policy sets out how CFLH LTD (trading as MarginMultiplier.io) complies with data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller Details

Data Controller: CFLH LTD
Trading As: MarginMultiplier.io
Company Number: 16286232
Registered Office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Data Protection Contact: data@marginmultiplier.io

2. Purpose of This Policy

This policy outlines our commitment to data protection and explains:

• How we collect, process, and protect personal data
• The rights of data subjects under UK GDPR
• Our responsibilities as a data controller
• Security measures we implement

3. Data Protection Principles

We adhere to the following data protection principles. Personal data shall be:

• Processed lawfully, fairly, and transparently
• Collected for specified, explicit, and legitimate purposes
• Adequate, relevant, and limited to what is necessary
• Accurate and kept up to date
• Kept for no longer than necessary
• Processed securely with appropriate technical and organizational measures

4. Types of Data We Process

Data Category	Examples	Purpose	Legal Basis
Contact Information	Email address	Newsletter delivery, PDF report delivery	Consent
Business Information	Company name, industry, team size	Personalized AI recommendations	Consent
Technical Data	IP address, browser type, device info	Website analytics, security	Legitimate interests
Usage Data	Pages visited, time on site	Service improvement	Legitimate interests

5. How We Collect Data

• Direct Collection: When you subscribe to our newsletter or complete our audit form
• Automated Collection: Through cookies and website analytics
• Third Parties: We do not purchase or receive data from third parties

6. Data Sharing and Third-Party Processors

We share personal data only with trusted third-party processors who assist in delivering our services:

Beehiiv (Newsletter Platform)

• Purpose: Newsletter subscription management and email delivery
• Data Shared: Email address, subscription preferences, tags
• Location: United States (GDPR-compliant safeguards in place)

Email Service Providers

• Purpose: Delivery of personalized PDF reports
• Data Shared: Email address
• Security: Encrypted transmission via TLS

All third-party processors are required to maintain GDPR-compliant data protection standards.

7. Data Subject Rights

Under UK GDPR, you have the following rights regarding your personal data:

7.1 Right of Access

You can request a copy of the personal data we hold about you. We will provide this within one month of your request.

7.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data. We will comply unless we have a legal obligation to retain it.

7.4 Right to Restrict Processing

You can request that we limit how we use your personal data in certain circumstances.

7.5 Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format.

7.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

7.7 Right to Withdraw Consent

You can unsubscribe from our newsletter at any time via the unsubscribe link in emails or by contacting us.

To exercise any of these rights, contact: data@marginmultiplier.io

8. Data Retention

We retain personal data only as long as necessary:

• Newsletter Subscribers: Until you unsubscribe or request deletion
• Audit Responses: 12 months after completion, unless you request earlier deletion
• Analytics Data: Anonymized after 26 months
• Legal Compliance: As required by applicable laws (typically up to 6 years for tax/accounting purposes)

9. Security Measures

We implement appropriate technical and organizational security measures:

Technical Measures

• Encryption of data in transit (TLS/SSL)
• Secure server infrastructure
• Regular security updates and patches
• Access controls and authentication

Organizational Measures

• Data protection training for personnel
• Regular review of data processing activities
• Incident response procedures
• Data minimization practices

10. Data Breach Notification

In the event of a personal data breach that poses a risk to individuals' rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours
• Notify affected individuals without undue delay if the breach poses a high risk
• Document all breaches, including facts, effects, and remedial action taken

11. International Data Transfers

When transferring personal data outside the UK/EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by the UK Government or European Commission
• Binding Corporate Rules where applicable

12. Cookies and Tracking

We use cookies to:

• Remember your cookie consent preferences (essential)
• Analyze website performance and user behavior (analytics)

You can manage cookie preferences through our cookie consent banner or your browser settings.

13. Children's Data

Our services are not directed at children under 18. We do not knowingly collect data from minors. If we become aware that we have collected data from a child, we will delete it promptly.

14. Changes to This Policy

We may update this Data Protection Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via:

• Update notice on this page
• Email notification to subscribers (for significant changes)

15. Complaints and Supervisory Authority

If you have concerns about how we handle your personal data, please contact us first:

Email: data@marginmultiplier.io

You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Website: https://ico.org.uk
Helpline: 0303 123 1113

16. Contact Information

For any data protection queries, requests to exercise your rights, or concerns:

Data Protection Contact: data@marginmultiplier.io
Company: CFLH LTD (trading as MarginMultiplier.io)
Address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

This Data Protection Policy was last reviewed and updated on November 6, 2025.