Privacy Policy
Last updated: 26 September 2026
This Privacy Policy explains how JFDI Consulting Ltd (“JFDI”, “we”, “us” or “our”) handles personal data when you use jfdi.info, contact us, subscribe to our newsletter, or buy or manage a product through the website.
It covers the public website and its website services. Separate terms or privacy information may apply to products installed in a customer’s own environment.
Who We Are
JFDI Consulting Ltd is the controller of the personal data described in this policy.
JFDI Consulting Ltd
167–169 Great Portland Street
5th Floor
London
England
W1W 5PF
Company number: 04198617
Email: [email protected]
Telephone: +44 (0)1273 358282
Website: https://jfdi.info
Information We Collect
Information You Give Us
When you use our contact form, we collect:
When you subscribe to the JFDI Brief, we collect your email address and your request to receive the newsletter. Mailchimp uses a confirmation process before marking a new subscription as subscribed.
When you buy or manage software through the website, we may collect or process:
Stripe collects payment-card and billing information through its hosted checkout. Our website sends Stripe your email address, product and fulfilment information and, where relevant, the Microsoft 365 tenant identifier. The website code does not receive your full payment-card number.
If you contact us by email or telephone, we process the information you provide in that correspondence.
Information Collected When You Use the Website
Cloudflare, which hosts and delivers the website, receives technical request information needed to serve and protect it. This can include your IP address, request headers, browser and device information, requested pages, timestamps and security signals.
The website also processes:
The country and Global Privacy Control status are stored in the functional jfdi-region cookie. The cookie contains a two-letter country code and, where applicable, a GPC marker; it does not contain your IP address.
Cloudflare Turnstile receives the verification token needed to check a form submission. Our server does not add your IP address to the Turnstile verification request, although Cloudflare necessarily handles network information when serving the website and Turnstile service.
Rate limiting uses your raw IP address as part of a Cloudflare KV key. These counter keys expire after approximately one hour. The raw IP used in these keys is not deliberately written to application logs.
Analytics Information
Subject to the Analytics setting described below, we use:
Google Analytics to measure visits and interactions. Its information can include a browser identifier, pages viewed, events, approximate location derived from network information, referrer, device and browser information.
Microsoft Clarity to understand how visitors use the site through aggregated interaction data and session replay. Microsoft Clarity masks sensitive input by default, but visitors should not include sensitive information in free-text fields unless it is needed for their enquiry.
Google Analytics storage is controlled through the website’s consent settings. Microsoft Clarity runs only when Analytics is permitted.
Google Analytics and Microsoft Clarity keep their data for the retention period configured in each tool.
Advertising Measurement and Campaign Information
Subject to the Marketing setting described below, we use:
Microsoft Advertising (its Universal Event Tracking, or UET, tag) and Google Ads conversion measurement to learn whether our adverts bring visitors to the website and whether those visitors go on to our products on Microsoft Marketplace or download our free software. When these tags run, Microsoft and Google receive information such as the address of the page, a browser identifier, the time of the visit, device and browser information and network information, including your IP address, and set the cookies listed in our Cookie Policy.
Conversions. When you click a link to one of our products on Microsoft Marketplace, the website reports that click to Microsoft Advertising and Google Ads as a conversion named marketplace_click. The report to Microsoft Advertising identifies the product and which link on the page was used. When you click a link to download our free software, such as the Copilot Readiness Assessment Tool, the website reports that click to Microsoft Advertising and Google Ads as a conversion named download. The reports to Microsoft Advertising and Google Ads do not identify the file or the link.
Click identifiers. If you arrive from an advert, the page address may contain the advertising platform’s own click identifier: msclkid for Microsoft Advertising or gclid for Google Ads. The Microsoft Advertising and Google Ads tags read it from the page address once Marketing is permitted, so that a later conversion can be credited to the advert. We never store click identifiers ourselves or add them to links.
Campaign parameters. If the address you arrive on carries campaign parameters (ocid, utm_source, utm_medium, utm_campaign or utm_term), the website adds them to links to our products on Microsoft Marketplace, together with a label identifying the link (utm_content), so that Microsoft Partner Center can attribute visits to our campaigns. If you did not arrive from a campaign, those links carry a fixed label identifying this website instead. With Marketing permitted, the campaign parameters are kept in this website’s session storage for the rest of the browser session and added to links to our Planner websites, so those websites can attribute your visit in the same way. Without Marketing, they are used only on the page you arrived on and are not stored or forwarded.
Microsoft Advertising and Google Ads keep conversion data for the periods set by each service.
How and Why We Use Personal Data
We use personal data to:
Lawful Bases
Depending on the activity, we rely on:
Contract or steps requested before entering a contract — when handling a product purchase, delivering a licence or download, administering the purchase, or responding to a request connected with a proposed service.
Consent — for the newsletter and for non-essential Analytics or Marketing technologies, including advertising measurement and campaign attribution, where consent is required. You may withdraw consent at any time. Withdrawal does not affect processing already carried out.
Legitimate interests — to respond to business enquiries, operate and secure the website, prevent fraud and abuse, keep appropriate business records, understand website performance where permitted, and protect our legal rights. We consider the impact on the people concerned before relying on these interests.
Legal obligation — where we must retain or disclose information to meet tax, accounting, regulatory or other legal requirements.
Who Receives Personal Data
We use service providers to operate the website and related services. The providers shown by the current implementation include:
Contact-form submissions are emailed through Microsoft Graph to the address configured for the website, currently [email protected], or to another JFDI recipient configured for the deployed site. Authorised JFDI personnel with access to that mailbox may read and respond to the enquiry.
For manual-fulfilment purchases, purchase information may also be sent to the configured JFDI sales recipient.
We may disclose information to professional advisers, regulators, public authorities, courts or other parties where necessary to meet an obligation, protect legal rights or deal with a dispute. We may also disclose relevant information as part of a sale, restructuring or transfer of the business, subject to appropriate confidentiality arrangements.
Microsoft Advertising and Google Ads receive information through their tags only when Marketing is permitted. When you follow a link to Microsoft Marketplace, Microsoft receives the campaign parameters on that link; Microsoft Marketplace is governed by Microsoft’s own privacy information. If another advertising or ad-measurement provider is enabled later, it will be identified in the website’s cookie information and controlled by the Marketing setting.
International Transfers
Cloudflare, Microsoft, Google, Mailchimp, Stripe and Sentry operate internationally and may process information in the United States or other countries outside the United Kingdom.
Where personal data is transferred internationally, we rely on each provider’s standard data-processing terms, which incorporate the UK International Data Transfer Addendum or the EU Standard Contractual Clauses where needed.
Retention
We retain information only for as long as it is needed for the purpose for which it was collected, including applicable operational, contractual, accounting and legal requirements.
Our retention periods are:
Known technical retention periods include:
Stripe retains payment and transaction information under its own retention practices and as required for payment, tax, accounting, fraud-prevention and legal purposes.
Cookies, Browser Storage and Privacy Choices
We use cookies, local storage and similar technologies for essential operation, preferences and, according to your choices, analytics or marketing purposes.
Functional technologies are always active because they operate the website, apply privacy settings, provide security or support a service you request.
Analytics helps us understand use of the website. It is on by default for US visitors and off by default for visitors elsewhere or when the region is unknown. You can change it through Cookie preferences.
Marketing controls advertising measurement, campaign attribution and conversion tools. On jfdi.info these are Microsoft Advertising and Google Ads conversion measurement and the storing and forwarding of campaign parameters, described above. For visitors in the United Kingdom, the European Economic Area, Switzerland and everywhere else outside the United States, and when the region is unknown, Marketing is off until you turn it on. For visitors in the United States it is on by default unless the browser sends Global Privacy Control, and you can turn it off at any time, as described under Your Privacy Choices (United States) below.
You can accept or reject optional categories and can change your choice at any time through Cookie preferences in the website footer. Your choice is stored for this website in the browser profile you are using. Choices do not automatically carry across browsers, browser profiles, devices or our other websites.
Switching Analytics or Marketing off stops the tools in that category from running on later page use. It does not delete cookies they have already stored: those remain until they expire or you delete them through your browser controls.
See our Cookie Policy for the current manifest, purposes, owners and stated cookie lifetimes.
Global Privacy Control
When this website detects a Global Privacy Control (GPC) signal, Marketing is kept off. GPC takes precedence over a Marketing choice saved before the signal was detected.
If, while GPC is active, you deliberately turn Marketing on and save that choice through Cookie preferences, we honour that opt-in for the current browser profile on this website. You can turn Marketing off again at any time.
GPC does not change the regional default or your saved choice for Analytics. It also does not disable essential functionality. Some analytics tools also respond to Global Privacy Control themselves; for example, Microsoft Clarity does not record sessions when your browser sends it.
Keeping Marketing off prevents configured marketing tools, persistent marketing attribution and marketing conversion events from being activated. It does not remove cookies that were already stored: they remain until they expire or you remove them through your browser controls.
GPC is detected separately for each browser or browser profile and each website. When GPC is detected and is the reason Marketing is off, the preferences panel displays a note explaining that status.
Your Privacy Choices (United States)
Under some US state privacy laws, letting Microsoft Advertising and Google Ads receive information about your visit to measure our advertising, and forwarding campaign parameters between our websites, may constitute “sharing” personal information for cross-context behavioural advertising, or processing it for “targeted advertising”.
You can opt out at any time in any of these ways:
Your choice applies to this website in the browser profile you are using. Each of our websites keeps its own choice. Opting out stops these tools from running on later page use and removes the stored campaign parameters. It does not delete cookies the tools have already stored: those remain until they expire or you delete them.
Security
We use technical and organisational measures intended to protect personal data. Measures visible in the website implementation include encrypted HTTPS connections, restricted service credentials, signed and time-limited access tokens, server-side validation, anti-spam checks, rate limiting and limited recipient addresses for form email.
No internet service can guarantee complete security. Please do not send sensitive personal data through a general enquiry form unless it is necessary.
Your Rights
Depending on the circumstances, you may have rights to:
These rights are subject to applicable conditions and exceptions. We may need to verify your identity before acting on a request.
To make a request, email [email protected] or use our contact page.
You may also complain to the UK Information Commissioner’s Office. We would appreciate the opportunity to address your concern first, but contacting us is not a condition of making a complaint.
Other Websites and Product Policies
Links to third-party websites are governed by those websites’ own privacy information.
The JFDI Planner applications have separate Planner Suite privacy information. That information describes processing within installed applications and is distinct from the public website processing described here.
Changes to This Policy
We may update this policy when our services, providers or processing change. The date at the top shows when this version was last updated.
Contact Us
Questions, requests and complaints about this policy or our handling of personal data can be sent to:
JFDI Consulting Ltd
167–169 Great Portland Street
5th Floor
London
England
W1W 5PF
Email: [email protected]
Telephone: +44 (0)1273 358282
Contact form: jfdi.info/contact