Privacy policy.

The Fig entity providing your service or handling your enquiry is responsible for the personal data it controls. Check your contract, order confirmation or service-specific notice for that entity. Our group companies include:

• The Fig Group Limited
• Fig Technology Ltd
• Fig Compliance Ltd
• Fig Risk Solutions Ltd

You can contact us centrally for any Fig entity. Our privacy contact is Jay Hopkins, Managing Director, who is responsible for overseeing questions in relation to this policy. You can reach our privacy contact at enquiries@figgroup.co.uk.

• To provide and administer our services and accounts - performance of a contract.
• To take payment and keep financial records - contract and legal obligation.
• To provide support and respond to enquiries - contract and legitimate interests.
• To send relevant marketing - consent or legitimate interests, with an opt-out in every message.
• To secure our services and comply with law - legitimate interests and legal obligation.
• To measure whether advertising leads to a verified purchase - our legitimate interests in measuring advertising effectiveness and controlling advertising expenditure. Without advertising consent, this is limited to a redacted cookieless signal with an opaque transaction reference, purchase value and currency. You can object through Cookie settings.
• To understand consented website journeys, improve conversion, and prepare internal buyer-insight drafts - consent for non-essential analytics collection and our legitimate interests in improving our services and sales operations. AI output is advisory, requires human review, and cannot contact you, change your CRM record, set a price, or make an insurance decision.

From time to time, we may share personal data between The Fig Group Limited and its subsidiaries listed in section 1 where needed to provide or coordinate services, respond to enquiries, administer accounts and payments, provide support, maintain security, or meet legal and regulatory obligations. This may include relevant contact, account, order, certification, billing and support information.

Internal sharing is limited to the information and authorised people needed for the purpose, with appropriate access controls and data-protection arrangements. The lawful basis depends on the purpose, as set out in section 3: contract for service delivery, legal obligation for required records, or legitimate interests in coordinating services, administration and security where these do not override your rights. Where consent is required, we obtain it and respect your choices. Group membership does not give every subsidiary unrestricted access or permit unrelated marketing. Personal data processed on a customer's behalf remains subject to the customer's instructions and Data Processing Agreement.

We also share User Personal Data with service providers who help us run our business under appropriate data-protection terms, and with professional advisers or authorities where necessary or required by law. Our principal business-operations vendors are listed on our Sub-processors page (Microsoft 365, Xero, DocuSign, HubSpot, Anthropic and our payment processor). We do not sell personal data.

Card payments for our own invoices are processed by Stripe, which acts as an independent controller for the payment transaction and processes card data under its own terms and security standards. Fig does not store full card numbers.

Where personal data is transferred outside the UK or EEA, we rely on an appropriate safeguard - the UK International Data Transfer Agreement or Addendum and the EU Standard Contractual Clauses, or the EU-US / UK-US Data Privacy Framework where the recipient is certified. Details of processing locations for the Fig Platform are on the Sub-processors page.

We keep User Personal Data only for as long as needed for the purposes above and to meet legal, accounting, and reporting requirements, after which it is securely deleted or anonymised. Retention of data held within the Fig Platform on a customer's behalf is governed by the customer's agreement and our Data Retention Schedule.

Governed website-behaviour events and internal buyer-insight drafts are retained for up to 395 days, unless an earlier erasure or legal hold applies. The Anthropic API may retain model inputs and outputs for up to 30 days under its standard commercial API terms. We send only privacy-minimised cited evidence, do not use prompt caching, files, tools, or web search for this workload, and do not permit provider output to take an external action.

We may use Claude through Anthropic's commercial API to prepare a cited internal draft about an organisation's consented website journey. The system must abstain when evidence is incomplete, unsafe, or below the approved confidence threshold. Jay Hopkins reviews every draft before use, and you may ask us to inspect, correct, or delete the underlying record. We do not use this process to make a solely automated decision that produces legal or similarly significant effects.

Under UK and EU data-protection law you have rights to access, rectify, erase, restrict, and object to the processing of your personal data, to data portability, and to withdraw consent where we rely on it. To exercise any right, contact our privacy contact at enquiries@figgroup.co.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would welcome the chance to address your concern first.

This cookie policy is shared by The Fig Group Limited and its subsidiaries, including Fig Technology Ltd, Fig Compliance Ltd and Fig Risk Solutions Ltd. It covers our group websites and services that link to this policy. The tools described below apply to this website; service-specific notices explain any different tools. Cookie choices apply to the website or service where you make them and do not automatically grant permission on every other Fig website or service.

Our website uses essential storage for security, checkout and form state, and to remember your privacy choices. We also collect first-party information for statistical purposes solely to improve the website. This channel counts aggregate page views, approved navigation actions and funnel stages. It does not send a visitor ID, session ID, customer ID, IP address, full referrer, query string or form content, and it stores aggregate counters rather than an individual browsing history. Aggregate statistics are retained for up to 400 days and are not used for advertising or joined to customer identities.

You can object to aggregate statistics immediately by selecting Use essential cookies only, or at any time through Cookie settings in the website footer. Your objection stops subsequent statistical events. Aggregate counts already created cannot identify you and therefore cannot be separated back out by visitor.

Our first-party session and journey analytics only runs after you give analytics consent. It is hosted in Microsoft Azure and helps us understand website journeys, content performance and where people encounter difficulty. It records a random, pseudonymous session identifier and controlled events covering page and route views, navigation, content engagement, form stages, chat stages, product interest and checkout stages. Raw journey event rows are retained for up to 90 days before deletion; longer-term reporting uses aggregated results.

Journey analytics does not collect form field values, chat messages, names, email addresses, phone numbers, postcodes, authentication content, card or payment content, or full URL query strings. Pre-identification activity may be linked to the resulting lead or order if you later identify yourself through a form or purchase, but only where valid analytics consent covered that activity. Any restricted identity bridge is created server-side and not sent to Google Analytics or Microsoft Clarity.

When a visitor arrives through our approved Google Ads Cyber Essentials campaign, our first-party service records only allowlisted campaign, ad-group, creative, device, network, match-type and landing-route categories. It does not retain the visitor's IP address, search terms, full URL, Google click identifier or contact details for this purpose. A signed opaque reference can follow the current checkout in memory and be linked to a completed order for up to 90 days so we can understand whether campaign-labelled visits lead to sales. If you select advertising, that opaque reference may also be retained in browser storage for the same period; it is removed from browser storage when advertising consent is withdrawn.

Microsoft Clarity and the Google Ads tag load in cookieless consent mode before your choice with analytics and advertising storage denied. In that mode they do not set optional analytics or advertising cookies. The Google tag can send consent-state pings without advertising identifiers. After the server verifies a completed payment, the Google tag may also send one limited purchase signal containing an opaque transaction reference, purchase value and currency so Google Ads can provide aggregate conversion reporting and modelling. The limited signal does not contain your name, contact details, advertising click identifier, Stripe reference, enhanced-conversion data or website journey. Clarity cookies, full session features and Google Analytics storage remain disabled unless you select analytics. Advertising storage, advertising personalisation and enhanced conversion user data remain disabled unless you select advertising. You can change or withdraw these choices at any time through Cookie settings. You can object separately to limited advertising measurement there without enabling or disabling any optional cookie category. Withdrawal stops future consented journey events and behavioural linkage, clears optional analytics cookies, and returns Clarity to cookieless denied-storage mode. The rights described above, including access, erasure, objection and withdrawal of consent, apply to personal data used for this analytics processing; legal retention duties may still apply to completed orders and financial records.

If you select advertising and later complete a purchase, we may send Google the retained click identifier or session-attribution value and a one-way SHA-256 hash of the purchaser email address as enhanced-conversion data. This is sent only after Stripe-confirmed payment, with consent recorded as granted, and is used with the same opaque transaction reference to avoid double-counting the browser and server purchase signals. We do not include these fields in the limited cookieless path, and we do not write them to operational logs.

We may update this policy from time to time. The update date above shows when it was last revised; material changes will be highlighted on this page. The 10 September 2026 update makes the group-wide scope explicit and explains when personal data may be shared between group entities.

Shared policy for The Fig Group Limited and its subsidiaries. Group correspondence: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom. Privacy contact: Jay Hopkins, Managing Director, enquiries@figgroup.co.uk.