MS Advisory
Privacy

Privacy policy

Last updated 21 October 2026.

Who we are

MS Advisory is the trading name of Provenance GRC Ltd, registered in England and Wales, company no. 17534301. Registered office: 97 Brandwood Avenue, Manchester, M21 7PL, United Kingdom. Provenance GRC Ltd is the controller of personal information collected through this website.

Contact for anything about your information: maria@ms-advisory.co.uk.

What is collected

Only what you choose to send:

  • through the contact form: your name, email address, organisation (optional) and message, plus whether you are in a business, in the public sector or a founder
  • through the resource library questionnaire: your organisation's sector and size, your role and whether you want the newsletter. Your email address is collected only if you choose to subscribe
  • through the specialist network form: your name, email address, field, LinkedIn profile (optional) and message (optional)
  • by email or phone: whatever you include when you get in touch

Visitor statistics

This site uses Umami, a cookieless analytics tool, to count visits: which pages are viewed, which site or search brought you here, your country and the type of device. It sets no cookies, stores nothing on your device and does not identify you. It also counts presses of the guide Download buttons, and guide downloads with the sector, size and role you chose, never your email. On the AI stack builder it also counts clicks on its buttons, such as Copy as text or Download as Word, and the option you choose for two questions: ‘Which describes you best?’ (for example a founder or small business) and ‘How do you use AI?’. It never records anything else you enter. The lawful basis is legitimate interests in understanding how the site is used. There is no advertising and no tracking across other sites.

I also keep my own activity log, stored with Supabase on servers in London. For each page you view it records the page, the site that sent you there, your country, the type of device, browser and system, how long the page was in use, how far down you scrolled and where on the page you clicked: the position only, never anything you type. It also records presses of the guide Download buttons, whether the guide questions were closed without answering, guide downloads with the sector, size and role you chose, clicks on the AI stack builder's buttons with the option chosen for those same two questions, and when a page you asked for does not exist. Pages you view on the same day are grouped by an anonymous code made from your connection and browser with a key that is deleted every day, so the code cannot be traced back to you or linked across days. Your IP address is not stored and nothing is stored on your device. The lawful basis is legitimate interests in understanding how the site is used and improving it. If your browser sends a Global Privacy Control or Do Not Track signal, nothing is recorded, and you can object at any time by emailing the address above.

If you answer the guide questions in the resource library, your browser remembers that you have, so you are not asked again. This stores no personal information and is not a cookie.

If you use the AI stack builder, your browser stores your map on your own device for 24 hours after your last change, so you can come back to it. It is never sent to me. You can delete it at any time with 'Clear the map' or by clearing your browser data. 'Download as Word' creates the file on your device; nothing is uploaded. Word export uses the open-source docx library (MIT licence).

Why it is used

To reply to your enquiry and, if you want to go ahead, to discuss working together. The lawful basis is legitimate interests in responding to enquiries, or steps you ask for before entering a contract.

Questionnaire answers are used to understand who the guides help and to improve them. The newsletter is sent only if you ask for it, on the basis of your consent. You can unsubscribe at any time by emailing the address above, or with the link in each newsletter once it starts. No newsletter service is in use yet: subscriber email addresses are held in Netlify until one is chosen, and this policy will name it before the first newsletter is sent.

Who else handles it

  • Netlify, Inc. hosts this website and receives contact form and questionnaire submissions. Netlify is based in the United States and processes data there. Transfers are protected by the safeguards in Netlify's data processing agreement, including the Standard Contractual Clauses.
  • Microsoft 365 provides email. Email data is stored in Microsoft's UK datacentres.
  • Umami counts visits without cookies and without identifying you. Umami Cloud stores its data on servers in the US and the EU.
  • Supabase stores the activity log on servers in London, United Kingdom.

Your information is never sold or shared for marketing.

How long it is kept

  • Enquiries that do not lead to work: deleted 12 months after the last contact.
  • Questionnaire answers from the resource library: deleted after 24 months.
  • Activity log records: deleted automatically after 12 months.
  • Newsletter email addresses: kept until you unsubscribe.
  • Specialist network contacts: deleted 24 months after the last contact, or sooner on request.
  • If we work together: records of the engagement are kept for six years after it ends, which covers tax record rules and the period in which a contract claim could be made.

Your rights

You can ask to see, correct or delete the information held about you, object to its use or ask for it to be restricted. Email the address above. If you are unhappy with the response, you can complain to the Information Commissioner's Office at ico.org.uk.