Introduction
This privacy notice provides you with details of how we collect and process your personal data through your use of our site www.tonicandco.co.
By providing us with your data, you warrant to us that you are over 18 years of age.
Tonic Advisory Limited (trading as Tonic & Co.) is the data controller and we are responsible for your personal data (referred to as “we”, “us” or “our” in this privacy notice).
Contact details
Our full details are:
Full name of legal entity: Tonic Advisory Limited (trading as Tonic & Co.), a company registered in England and Wales under company number 17016450.
Email address: nikki@tonicandco.co
Postal address: 4 Dittons Road, Eastbourne, BN21 1DN
It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at nikki@tonicandco.co.
What data we collect about you, for what purpose, and on what ground we process it
Personal data means any information capable of identifying an individual. It does not include anonymised data.We may process the following categories of personal data about you.
Communication Data
This includes any communication that you send to us, whether through the contact form on our website (your name, email address, telephone number and the details of the challenge you describe to us), by email, by telephone, through social media messaging or by any other means. We process this data for the purposes of communicating with you, responding to your enquiry, for record keeping and for the establishment, pursuance or defence of legal claims. Our lawful ground for this processing is our legitimate interests, which in this case are to reply to communications sent to us, to keep records, and to establish, pursue or defend legal claims.
Client Data
This includes data relating to the consultancy services we provide, such as your name, job title, employer, billing address, email address, telephone number, contact details, engagement details and payment details. We process this data to scope and deliver the services you have engaged us to provide, to invoice for those services, and to keep records of our engagements. Our lawful ground for this processing is the performance of a contract between you and us and/or taking steps at your request to enter into such a contract. Where you are engaging us on behalf of a company, our lawful ground is our legitimate interests, which in this case are to deliver our services to our client and to manage our client relationships.
Prospect Data
This includes data about individuals at organisations we have identified as potentially interested in our services and who have not previously contacted us, including names, job titles, employers, business contact details and publicly available professional information. We process this data to identify potential clients, to contact them about our services, and to maintain a record of our business development activity. Our lawful ground for this processing is our legitimate interests, which in this case are to promote our services and grow our business.
Testimonial Data
This includes data about clients and individuals at client organisations who provide feedback on our work, including names, job titles, employers, photographs and the content of their testimonial. We process this data to publish testimonials, case studies and client references on our website, in proposals and in our marketing materials. Our lawful ground for this processing is your consent, which you may withdraw at any time by contacting us using the details above.
Supplier Data
This includes data about the freelancers, associates, subcontractors and suppliers we work with, including names, contact details, professional backgrounds and payment details. We process this data to engage and manage our suppliers and associates, to deliver our services to clients, and to make payment. Our lawful ground for this processing is that the processing is necessary for the performance of a contract with the individual or to take steps at their request prior to entering into such a contract, and, where the individual is engaged through a company, our legitimate interests, which in this case are to manage our supplier and associate relationships.
User Data
This includes data about how you use our website, together with any data that you post for publication on our website. We process this data to operate our website and ensure relevant content is provided to you, to ensure the security of our website, to maintain back-ups of our website, and to enable administration of our website and our business. Our lawful ground for this processing is our legitimate interests, which in this case are to enable us to properly administer our website and our business.
Technical Data
This includes data about your use of our website such as your IP address, details about your browser, length of visit to pages on our website, page views and navigation paths, the number of times you use our website, time zone settings, and other technology on the devices you use to access our website. The source of this data is our analytics tracking system. We process this data to analyse your use of our website, to administer and protect our business and website, to deliver relevant website content to you, and to understand the effectiveness of our marketing. Our lawful ground for this processing is our legitimate interests, which in this case are to enable us to properly administer our website and our business, to grow our business, and to decide our marketing strategy.
Marketing Data
This includes data about your preferences in receiving marketing from us and your communication preferences, including any request you make to stop receiving marketing from us. We process this data to deliver relevant marketing communications to you and to keep a record of your preferences so that we can respect them. Our lawful ground for this processing is either your consent or our legitimate interests, which in this case are to promote our services, to grow our business, and to ensure we honour opt-out requests.
We may also use Communication Data, Client Data, Prospect Data, User Data, Technical Data and Marketing Data for the establishment, pursuance or defence of legal claims. Our lawful ground for this processing is our legitimate interests, which in this case are to establish, pursue or defend legal claims.
Required processing
Where we are required to collect personal data by law, or under the terms of a contract between us, and you do not provide us with that data when requested, we may not be able to perform the contract (for example, to deliver the services you have engaged us to provide). If you do not provide us with the requested data, we may have to cancel a service you have ordered, but if we do, we will notify you at the time.
We may process your personal data without your knowledge or consent where this is required or permitted by law.
Purposes of processing
We will only use your personal data for the purpose it was collected for, or for a reasonably compatible purpose where necessary. For more information on this, please email us at nikki@tonicandco.co. If we need to use your details for an unrelated new purpose, we will let you know and explain the legal grounds for processing.
Sensitive data and criminal conviction data
We do not collect any sensitive data about you. Sensitive data refers to data that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data.
We do not collect any information about criminal convictions and offences.
Automated decision-making
We do not make decisions about you by automated means that produce legal effects concerning you or that similarly significantly affect you. We use website analytics to understand how visitors use our site, but this does not involve decisions of that kind.
3. How we collect your personal data
We collect data about you in the following ways:
You provide the data to us directly — for example by completing the contact form on our website, emailing us, speaking with us, or booking a meeting with us.
We collect certain data automatically as you use our website, using cookies and similar technologies. Please see our cookie policy for more details.
We receive data from third-party service providers, including analytics providers such as Google, which are based outside the UK and the European Economic Area (EEA).
We collect data from publicly available and professional sources, including LinkedIn, company websites, Companies House and industry publications, where we are identifying organisations and individuals who may be interested in our services.
4. Marketing communications
Our lawful ground for processing your personal data to send you marketing communications is either your consent or our legitimate interests, namely to promote our services and grow our business.
Under the Privacy and Electronic Communications Regulations (PECR), we may send you marketing communications if (i) you made a purchase or asked us for information about our services, or (ii) you agreed to receive marketing communications, and in each case you have not opted out of receiving such communications since. Under these regulations, where you are a corporate subscriber (such as a limited company or a limited liability partnership), we may send you marketing emails without your consent. You can still opt out of receiving marketing emails from us at any time.
We will never share your personal details with any third party for their own marketing purposes.
You can ask us to stop sending you marketing messages at any time by following the opt-out link in any marketing message we send you, or by emailing us at nikki@tonicandco.co.
If you opt out of receiving marketing communications, this opt-out does not apply to personal data provided to us in the course of engaging or receiving our services.
5. Disclosures of your personal data
We may share your personal data with the following parties:
Service providers who provide us with IT, website hosting, email, file storage, customer relationship management, scheduling and system administration services.
Professional advisers including our accountants, lawyers, bankers, auditors and insurers.
Freelancers, associates and subcontractors who work with us on client engagements, where this is necessary to deliver the services.
Government bodies and regulators where we are required to report our processing activities.
Third parties to whom we may sell, transfer or merge parts of our business or our assets.
We require all third parties to whom we transfer your data to respect the security of your personal data and to treat it in accordance with the law. We only allow such third parties to process your personal data for specified purposes and in accordance with our instructions.
6. International transfers
Some of the service providers we use are based outside the United Kingdom, which means that our processing of your personal data will involve transferring your data outside the UK.
Where you are within the United Kingdom
We are subject to the provisions of the UK General Data Protection Regulation (UK GDPR) that protect your personal data. Where we transfer your data to third parties outside of the UK, we will ensure that appropriate safeguards are in place to provide a similar degree of security for your personal data. As such:
We may transfer your personal data to countries that the UK regulatory authorities have approved as providing an adequate level of protection for personal data; or
Where we use US-based providers that are part of the UK-US Data Bridge (the UK Extension to the EU-US Data Privacy Framework), we may transfer data to them, as they have equivalent safeguards in place; or
Where we use service providers established outside of the UK, we may use specific contracts approved by the Information Commissioner's Office (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses), or codes of conduct or certification mechanisms approved by the UK government, which give personal data the same protection it has in the UK.
If none of the above safeguards are available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.
Where you are within the EEA
We are subject to the provisions of the EU General Data Protection Regulation (EU GDPR) that protect your personal data. Where we transfer your data to third parties outside of the EEA, we will ensure that appropriate safeguards are in place to provide a similar degree of security for your personal data. As such:
We may transfer your personal data to countries that the European Commission has approved as providing an adequate level of protection for personal data; or
Where we use US-based providers that are part of the EU-US Data Privacy Framework, we may transfer data to them, as they have equivalent safeguards in place; or
Where we use service providers established outside of the EEA, we may use the EU Standard Contractual Clauses adopted by the European Commission, or codes of conduct or certification mechanisms approved by the European Commission, which give personal data the same protection it has in the EEA.
If none of the above safeguards are available, we may request your explicit consent to the specific transfer. You will have the right to withdraw this consent at any time.
7. Data security
We have put in place security measures to prevent your personal data from being accidentally lost, used, altered, disclosed or accessed without authorisation. We also allow access to your personal data only to those associates, suppliers and partners who have a business need to know it. They will only process your personal data on our instructions and they must keep it confidential.
We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
8. Data retention
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
When deciding the correct period to keep data for, we consider its amount, nature and sensitivity, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether those purposes can be achieved by other means, and legal requirements.
In practice, we apply the following retention periods:
Communication Data: three years from our last meaningful contact with you, unless your enquiry becomes a client engagement, in which case we retain it as Client Data.
Client Data: six years from the end of our engagement with you, in line with our tax and accounting obligations.
Prospect Data: two years from our last meaningful contact with you, or sooner if you ask us to remove you.
Testimonial Data: for as long as the testimonial or case study remains in use, and for one year afterwards.
Supplier Data: six years from the end of our engagement with the supplier.
Marketing Data: we keep a record of opt-out requests for as long as we are in business, so that we can continue to honour them.
User Data and Technical Data: for 14 months. .
In some circumstances we may anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
9. Your legal rights
Under data protection laws you have rights in relation to your personal data. These include the right to request access to your data, correction of it, erasure of it, restriction of our processing of it, transfer of it, the right to object to our processing of it, the right to data portability, and (where our lawful ground of processing is consent) the right to withdraw your consent.
If you are within the UK, you can read more about these rights at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/.
If you wish to exercise any of the rights set out above, please email us at nikki@tonicandco.co.
You will not have to pay a fee to access your personal data, or to exercise any of your other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive, or we may refuse to comply with your request in those circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data, or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request, to speed up our response.
When responding to a request to access your personal data, we are only required to carry out searches that are reasonable and proportionate in the circumstances, as expressly recognised in the Data (Use and Access) Act 2025. This means we will take into account factors such as the nature of the information sought, the context in which it is held, any difficulty involved in locating it, and the potential benefit to you of receiving it.
We try to respond to all legitimate requests within one month of receiving the request, or, where applicable, of receiving the identity verification information or clarification we have asked for — the response period is paused while we wait for that information, in line with the Data (Use and Access) Act 2025.
Occasionally it may take us longer than one month if your request is particularly complex or you have made a number of requests, in which case we may extend the response period by up to a further two months. We will notify you within one month of receiving your request if an extension is needed, and explain why.
10. How to complain
If you have a complaint about how we handle your personal data, we ask that you contact us first so that we can try to resolve it for you.
You can submit a data protection complaint to us by:
emailing us at nikki@tonicandco.co; or
writing to us at 4 Dittons Road, Eastbourne, BN21 1DN.
We will acknowledge your complaint within 30 days of receiving it. We will investigate your complaint without undue delay, keep you informed of our progress, and communicate the outcome to you clearly and with sufficient detail for you to understand how we reached our conclusion.
If you are within the UK and are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
If you are within the EU and are not satisfied with our response, you have the right to complain to the data protection authority of the country in which you are based.
11. Third-party links
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.
12. Cookies
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or may not function properly. For more information about the cookies we use, please see our cookie policy.
![](data:image/svg+xml,<svg display="block" id="763453300" role="presentation" viewBox="0 0 182 43" xmlns="http://www.w3.org/2000/svg"><path d="M 37 12.094 C 37 4.218 33.336 0 22.562 0 L 10.127 0 L 10.127 10.124 L 0 10.124 L 0 15.906 C 0 23.782 3.664 28 14.438 28 L 26.873 28 L 26.873 17.876 L 37 17.876 Z M 49.628 17.553 L 49.628 14.322 L 47.087 14.322 L 47.087 8.455 L 49.628 8.455 L 49.628 5.467 L 60.452 3.45 L 60.452 8.456 L 65.199 8.456 L 65.199 14.323 L 60.452 14.323 L 60.452 17.014 C 60.452 17.445 60.605 17.647 61.01 17.647 L 65.2 17.647 L 65.2 24.309 L 57.994 24.309 C 51.751 24.309 49.629 21.954 49.629 17.554 Z M 66.592 16.812 L 66.592 15.951 C 66.592 10.097 71.34 7.97 78.923 7.97 C 86.506 7.97 91.254 10.097 91.254 15.951 L 91.254 16.812 C 91.254 22.666 86.504 24.793 78.923 24.793 C 71.342 24.793 66.592 22.666 66.592 16.812 Z M 78.924 19.436 C 79.761 19.436 80.319 19.005 80.319 18.091 L 80.319 14.672 C 80.319 13.757 79.761 13.326 78.924 13.326 C 78.086 13.326 77.527 13.757 77.527 14.672 L 77.527 18.091 C 77.527 19.005 78.085 19.436 78.924 19.436 Z M 105.354 14.606 C 104.654 14.603 104.072 14.978 104.066 15.817 C 104.063 16.113 104.066 24.309 104.066 24.309 L 93.243 24.309 L 93.243 8.455 L 103.829 8.455 L 103.829 11.927 C 104.791 9.222 107.417 7.971 110.783 7.971 C 115.279 7.971 117.541 10.191 117.541 14.659 L 117.541 24.308 L 106.719 24.308 L 106.719 15.816 C 106.719 15.022 106.289 14.61 105.354 14.606 Z M 119.88 8.455 L 130.703 8.455 L 130.703 24.308 L 119.88 24.308 Z M 132.675 16.826 L 132.675 15.964 C 132.675 10.123 137.437 7.983 145.02 7.983 C 153.007 7.983 157.113 10.353 157.351 15.507 L 157.365 15.816 L 146.402 15.816 L 146.402 14.685 C 146.402 13.771 145.843 13.34 145.006 13.34 C 144.169 13.34 143.609 13.771 143.609 14.685 L 143.609 18.104 C 143.609 19.02 144.168 19.45 145.006 19.45 C 145.844 19.45 146.402 19.02 146.402 18.104 L 146.402 16.974 L 157.365 16.974 L 157.351 17.283 C 157.113 22.68 152.56 24.793 145.02 24.793 C 137.479 24.793 132.675 22.667 132.675 16.826 Z M 161.966 18.738 L 161.966 19.714 L 160.965 19.714 L 160.965 20.733 L 159.927 20.733 L 159.927 19.714 L 158.907 19.714 L 158.907 18.738 L 159.927 18.738 L 159.927 17.74 L 160.965 17.74 L 160.965 18.738 Z M 162.396 21.751 L 162.396 21.436 C 162.396 19.302 164.136 18.521 166.906 18.521 C 169.825 18.521 171.325 19.386 171.411 21.27 L 171.416 21.382 L 167.411 21.382 L 167.411 20.969 C 167.411 20.635 167.207 20.478 166.901 20.478 C 166.595 20.478 166.39 20.635 166.39 20.969 L 166.39 22.218 C 166.39 22.553 166.594 22.71 166.901 22.71 C 167.207 22.71 167.411 22.553 167.411 22.218 L 167.411 21.805 L 171.416 21.805 L 171.411 21.918 C 171.324 23.889 169.661 24.662 166.906 24.662 C 164.152 24.662 162.396 23.884 162.396 21.751 Z M 171.99 21.746 L 171.99 21.431 C 171.99 19.292 173.725 18.516 176.495 18.516 C 179.265 18.516 181 19.293 181 21.431 L 181 21.746 C 181 23.885 179.265 24.662 176.495 24.662 C 173.726 24.662 171.99 23.885 171.99 21.746 Z M 176.496 22.705 C 176.802 22.705 177.006 22.548 177.006 22.214 L 177.006 20.965 C 177.006 20.631 176.802 20.473 176.496 20.473 C 176.19 20.473 175.985 20.631 175.985 20.965 L 175.985 22.214 C 175.985 22.548 176.189 22.705 176.496 22.705 Z" fill="rgb(39, 41, 50)" height="28px" id="CUXQNDHBW" transform="translate(1 7)" width="181.00001265983303px"/></svg>)