Scenari — Privacy Notice

Last updated: 28 May 2026

1. About this notice

This notice explains what personal information we collect when you use scenari.co.uk or interact with us, why we collect it, how we use it, and the rights you have over it. It's written in plain English. If anything's unclear, please email us — our contact details are at the bottom.

This notice is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who we are

Scenari is a product of OneSource HR Limited, a company registered in England and Wales.

• Registered company name: OneSource HR Limited
• Trading name: Scenari
• Registered office: C/O Smith Butler, Sapper Jordan Rossi Park, Otley Road, Baildon, West Yorkshire, United Kingdom, BD17 7AX
• Contact for privacy matters: privacy@scenari.co.uk

OneSource HR Limited is the "data controller" for the information described in this notice. That means we decide what personal information is collected and how it's used.

We are not legally required to appoint a Data Protection Officer, but the contact email above is monitored and any privacy enquiry will be handled directly by a senior member of our team.

3. The personal information we collect

We collect personal information in the following situations:

When you fill in a form on our website (for example, requesting a quote, asking a question, or signing up to receive content from us):

• Your name
• Your email address
• Your organisation name and role (where you choose to provide it)
• What you're interested in (the topic of your enquiry)
• Anything else you choose to type into the form

When you book a demo with us:

• Your name and email address
• Your organisation name
• The time you've booked
• Anything you add in the booking notes

(Demo bookings are handled through Calendly — see the sub-processors section.)

When you download a resource from our website (such as our example report):

• Your name and email address
• Your organisation name
• The fact that you downloaded the resource

When you subscribe to our mailing list:

• Your name and email address
• Your organisation and role (where you choose to provide it)
• Which list or topic you signed up for

When you visit the website:

• Your IP address
• Your browser type and version
• The pages you visited and when
• The website (if any) that referred you to us

This information is collected automatically by our hosting provider (Vercel) and used for security and performance reasons. We don't use it to identify you personally.

When you email us:

• Your email address and anything in the email

4. How we use your information, and our lawful basis

We only use your information for the purposes set out below. Under UK GDPR, we must have a "lawful basis" for each use — we've set out the relevant basis next to each.

Where we rely on legitimate interest, we've carried out a balancing assessment to make sure your rights and interests aren't overridden by ours. You can ask us to explain that assessment by emailing privacy@scenari.co.uk.

We do not sell your personal information to anyone.

We do not make automated decisions about you that have a significant effect on you.

5. Who we share your information with

We use a small number of trusted third-party services (called "sub-processors") to run the website and our business. Where we share your information with them, we do so only to the extent needed.

We may also share your information:

• With our professional advisers (accountants, lawyers, insurers) where necessary
• If we're legally required to (for example, in response to a valid court order or ICO request)
• If we sell or restructure the business (in which case your information would form part of the assets transferred, and we'd let you know in advance)

All sub-processors are bound by data processing agreements that require them to protect your information and only use it for the purposes we've authorised.

6. International data transfers

Some of our sub-processors (Kit, Calendly, Vercel) are based in the United States. Where your personal information is transferred outside the UK, we make sure appropriate safeguards are in place — typically the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as required by UK GDPR.

You can ask us for a copy of these safeguards by emailing privacy@scenari.co.uk.

7. How long we keep your information

We don't keep your information longer than we need to. Specifically:

• Enquiry and quote requests: kept for up to 24 months from your last contact with us, then deleted.
• Demo booking information: kept for up to 24 months from the demo, then deleted.
• Mailing list contacts: kept for as long as you're subscribed. If you unsubscribe, we keep a minimal record (just your email address, on a suppression list) so we don't accidentally email you again.
• Customer information: kept for the duration of our relationship plus 7 years afterwards, to meet accounting and legal record-keeping requirements.
• Website server logs: kept by Vercel for up to 30 days for security and troubleshooting.

We review our retention periods regularly. If you'd like us to delete your information sooner, see Section 8 below.

8. Your rights

Under UK GDPR you have the following rights over your personal information. You can use any of them by emailing privacy@scenari.co.uk. We'll respond within one month.

• Right of access — ask for a copy of the personal information we hold about you.
• Right to rectification — ask us to correct anything that's inaccurate or incomplete.
• Right to erasure — ask us to delete your information (also called the "right to be forgotten"). This isn't absolute — for example, we may need to keep certain records for legal or accounting reasons.
• Right to restriction — ask us to pause using your information while a query is sorted out.
• Right to data portability — ask us to send your information to you, or to another organisation, in a structured format.
• Right to object — object to us using your information for direct marketing (which we'll always honour immediately), or for any purpose based on legitimate interest (which we'll consider on its merits).
• Right to withdraw consent — where we rely on your consent (mainly marketing emails), you can withdraw it at any time. Every marketing email we send includes an unsubscribe link.
• Right not to be subject to automated decision-making — we don't make significant automated decisions about you, but this right is yours if we ever did.

You also have the right to complain to the Information Commissioner's Office (the UK's data protection regulator):

• ICO website: ico.org.uk
• Helpline: 0303 123 1113

We'd prefer the chance to put things right ourselves first — please email us at privacy@scenari.co.uk before going to the ICO.

9. Cookies and similar technologies

The Scenari website uses a small number of cookies. We only use cookies that are necessary for the website to function properly, and cookies set by services we've embedded (for example, the Calendly demo booking widget).

We do not use any analytics or tracking tools, and we do not use third-party advertising cookies.

You can control cookies through your browser settings. Blocking essential cookies may stop parts of the website from working.

10. Security

We take reasonable steps to keep your information safe. This includes:

• Hosting the website on Vercel, which provides secure infrastructure and HTTPS encryption by default.
• Using reputable sub-processors who have their own security certifications.
• Limiting access to personal information to the small number of people who need it to do their jobs.
• Training those people in data protection.

No website or service can guarantee 100% security, but we take this seriously and will tell you (and the ICO where required) if a breach affects you.

11. Children

Scenari is a business-to-business product designed for use by adults in workplace settings. We don't knowingly collect personal information from anyone under the age of 18 in the course of our business. If you think we have, please email privacy@scenari.co.uk and we'll delete it.

12. Changes to this notice

We may update this notice from time to time. When we do, we'll change the "Last updated" date at the top. If the change is significant, we'll also let you know directly (for example, by email if you're on our mailing list).

13. Contact us

If you have any questions about this notice, want to exercise any of your rights, or just want to talk to a human about what we do with your information:

Email: privacy@scenari.co.uk Post: OneSource HR Limited, C/O Smith Butler, Sapper Jordan Rossi Park, Otley Road, Baildon, West Yorkshire, BD17 7AX

We aim to respond to all privacy enquiries within five working days, and to formal data subject requests within the one month required by law.