Privacy notice
Last updated: 30 October 2026. This notice explains how we use your personal information, in plain English.
1. Who we are
Lion Events Solutions UK Ltd, company number 16174874, 128 City Road, London EC1V 2NX, trading as healthandsafetyadvisor.co.uk (“Lesu”, “we”, “us”), is the controller of the information described here. We are a small UK health and safety consultancy and we give advice only. We are registered with the Information Commission under reference ZC251940.
Contact: John Turner, our data protection lead (we do not have a Data Protection Officer). Email info@lesu.uk, phone or WhatsApp +44 7446 822 970, or write to us at the address above. This notice covers lesu.uk, healthandsafetyadvisor.co.uk, our scorecards, our WhatsApp number, and the information we receive when we deal with clients and enquirers. People who work with us, including our associates, have a separate notice.
2. What we use, why, and our legal basis
| What | Why | Legal basis |
|---|---|---|
| Website forms and enquiries. Name, company, job title, email, phone, your message. | To reply, arrange a consultation or prepare a quote, and keep a record. | Legitimate interests (answering enquiries); steps before a contract. |
| “Notify me”, downloads, online checks and scorecards (including ScoreApp, where used). Email, name, company, phone, your answers and score. | To send what you asked for, give you your score and follow up your enquiry. We send updates only if you opt in. | Legitimate interests; your consent for “Notify me” and any marketing opt-in (you can withdraw it at any time). |
| Account and Google sign-in. Name, email, Google account ID. | To create and secure your account. We never see your Google password. | Contract; legitimate interests (security). |
| WhatsApp messages. Your number, profile name, messages and any files you send. | To answer you, pass your message to the right person and keep a record (see section 4). | Legitimate interests; contract for clients. |
| Clients and people connected to their work. Contact details, contracts, correspondence, advice records, and details about workers or incidents that a client gives us. | To deliver our advice, invoice, keep our advice record and defend claims. | Contract; legal obligation (tax and accounting); legitimate interests. |
| Business contacts we market to (section 3). | To tell businesses about our health and safety services. | Legitimate interests. |
| Anyone who contacts us. Complaints, rights requests, legal claims. | To deal with them and keep records. | Legal obligation; legitimate interests; legal claims. |
Please do not send health or injury details through our website forms or WhatsApp. Where a client gives us health information about its workers so that we can advise, we use it only where needed, relying on legal claims (UK GDPR Article 9(2)(f)) or health and safety and employment law (Article 9(2)(b) with Data Protection Act 2018 Schedule 1 paragraph 1).
3. Marketing to businesses
- Where we get your details. Public business directories, Companies House and company websites (and, if we use one, a business contact-information service, which we will name if you ask). We use your name, job title, work email or phone number and company.
- Why. Our legitimate interest in telling businesses that may need health and safety advice about our services. We use work contact details only, and only about our services. We have weighed this against your interests and rights.
- Email rules. We email corporate subscribers (companies and LLPs) at business addresses. For sole traders and some partnerships we email only with your consent, or if you have already dealt with us and the email is about similar services.
- First message. It will say where we found your details and link to this notice.
- Your right to object, at any time. To stop our marketing, reply “stop” to any message or email info@lesu.uk. We will stop straight away and keep only your name and email on a do-not-contact list so that we do not contact you again.
- How long. We reconfirm or delete marketing contacts after 2 years without engagement.
4. WhatsApp, Daniel and AI tools
- WhatsApp. Our office number, +44 7446 822 970, is on WhatsApp for general enquiries only. Please do not send health or injury details. If you need to, ask for a person (reply or email info@lesu.uk) and we will arrange a secure way. WhatsApp (Meta) runs the service under its own privacy policy.
- Who answers. WhatsApp messages to our number are handled by AI. “Daniel”, an AI assistant provided by Hey Jodie (Jodie AI Limited), greets you and sorts messages, and keeps helping retained clients who give an access code (general information, not advice). Hey Jodie acts as our processor, on our instructions. Other chats go to Lesu’s own AI assistants, which prepare replies. A person at Lesu checks replies prepared by our own AI assistants before they are sent, including anything involving a price or a commitment, and any new message we start.
- AI tools. We also use business versions of AI tools (Anthropic’s Claude and OpenAI’s ChatGPT) to help draft replies, notes and documents, under our AI policy. We keep the personal information we put into them to a minimum. Any advice we give is issued by a named adviser at Lesu; AI does not give advice.
- No automated decisions with legal or similar effects. We do not make decisions about you that have a legal or similarly significant effect by solely automated means. A person decides, for example, whether we work with you. Your scorecard result is calculated automatically but is only a guide. You can ask for a person to look again at anything an AI has told you or decided.
5. Who we share it with
We share information only when needed, and we do not sell it. Service providers acting on our instructions: Microsoft (email and documents), HubSpot (contacts and marketing), ScoreApp (scorecards), Google (sign-in, tag management, and advertising measurement only if you agree), Base44 (website and app hosting), Hey Jodie, Anthropic, OpenAI, our AI assistant platform, and our IT, accounting and payment providers. WhatsApp (Meta) runs its own service under its own terms. We also share with clients where you are connected to the work we do for them; insurers and professional advisers where needed for claims or advice; and regulators or authorities (such as the HSE, the police or the Information Commission) where the law requires or allows.
6. Transfers outside the UK
Some providers handle information outside the UK: the United States (Microsoft, Google, Base44 by default, Anthropic, OpenAI, WhatsApp, and our AI assistant platform); and, through Hey Jodie, Ireland, Germany and the United States, and some telephony in Australia. Where this happens we rely on UK adequacy rules (including the UK–US data bridge for certified US providers) or the UK’s approved transfer terms, with a transfer risk assessment where needed. Hey Jodie’s contract includes the UK Addendum. We keep the personal information we put into our AI assistant platform to a minimum and never put health details into it. Ask us for a copy of the safeguards.
7. How long we keep it
- Website enquiries, “Notify me” requests, downloads, scorecard results and WhatsApp chats that do not lead to work: 2 years from the last meaningful contact. Marketing contacts: see section 3. Consent records: the life of the consent plus 6 years.
- Copies held by our AI tools (Hey Jodie and our AI assistants’ chat history and logs): up to 12 months. Advice we give by WhatsApp is saved to your client file and kept with it.
- Health and safety advice files: 15 years from the last advice, with a review at 6 years to remove personal data we do not need. Other advice: 7 years. Claims: 15 years, and never less than 6 years after closure. Complaints and rights requests: 6 years from closure.
8. Your rights
You can ask us for a copy of your information, to correct or delete it, to restrict how we use it, to move it to another organisation, and for a person to review an automated decision. You can object at any time to our use of your information based on legitimate interests, and you have an absolute right to stop direct marketing. Where we rely on consent you can withdraw it at any time. For WhatsApp chats, tell us the number you used so we can find them. Email info@lesu.uk. We normally reply within one month, and there is usually no charge.
9. Complaints
Tell us first, if you can. If you are unhappy with how we have used your information, email info@lesu.uk, phone +44 7446 822 970, or write to John Turner, Lesu, 128 City Road, London EC1V 2NX. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.
You do not have to complain to us first. You can complain to the Information Commission, the UK’s data protection regulator (it took over from the Information Commissioner’s Office on 30 September 2026): ico.org.uk/make-a-complaint, 0303 123 1113.
10. Cookies, and changes
We use essential cookies. Others, including Google advertising cookies, are used only if you agree; use “Cookie settings” at the bottom of any page to change your choice. You do not have to use our forms, but without your contact details we cannot reply. We will update this notice when our practices change and show the date at the top.