Last updated: January 2026. This policy describes the personal data practices of Lorfan, operating from 67 Regent Street, London W1B 4DY, United Kingdom.
The data controller for personal information collected via this website is Lorfan, operating from 67 Regent Street, London W1B 4DY, United Kingdom. All enquiries regarding the processing of personal data may be directed to [email protected] or by post to the address above.
This website is operated in the United Kingdom. Personal data collected via this site is processed in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where applicable, EU GDPR provisions are also observed for visitors from European Economic Area countries.
Lorfan collects personal data only where it is provided voluntarily by the individual visiting the site. The categories of data collected are as follows:
Lorfan does not collect sensitive personal data — including data relating to health status, financial details, identity numbers, or biometric information — via this website. If you are a participant in a Lorfan programme, separate written consent and data agreements are provided at the point of engagement.
Processing of personal data submitted via this website is conducted on the following legal grounds:
Personal data submitted via the contact form is used solely for the purpose of responding to the submitted enquiry. Contact details are not used for unsolicited communications and are not added to mailing lists unless a separate, explicit request for such communications has been made by the individual.
Technical and analytics data is used in aggregate form to understand how this website is accessed and to improve its content and navigational structure. Individual visitor records are not profiled for marketing purposes.
No personal data collected via this website is sold, rented, or transferred to third parties for their own marketing or commercial use.
Contact form submissions are retained for a period of 24 months from the date of submission, after which they are securely deleted unless an ongoing correspondence or contractual engagement requires their continued retention.
Server log data is retained for 12 months in standard rotation before deletion. Analytics data, where collected with consent, is retained in aggregated form for up to 36 months.
Cookie consent records — indicating the consent choices made by a visitor — are retained for 12 months from the date of consent, in line with standard consent management practice.
As a data subject, you hold the following rights in respect of personal data held by Lorfan:
To exercise any of the above rights, contact Lorfan in writing at [email protected]. Requests will be acknowledged within five working days and fulfilled within 30 calendar days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
This website uses third-party resources loaded at page request. These include content distribution networks for stylesheet and script assets (jsDelivr, Cloudflare CDN, unpkg), Google Fonts for typography, and an embedded Google Maps frame on the contact page. Loading these resources may result in the third-party service recording the visitor's IP address and browser information in their own server logs.
Google Maps is embedded via a standard iframe. Interaction with the embedded map is governed by Google's privacy terms, available at policies.google.com/privacy.
Lorfan does not operate social media tracking pixels, advertising networks, or behavioural retargeting systems on this website. No personal data is shared with advertising platforms as a result of visiting this site.
All data protection enquiries should be directed to the Lorfan correspondence address or by email:
This policy was last reviewed in January 2026. Lorfan reserves the right to amend this policy in response to changes in applicable legislation or operational practice. Material changes will be noted with an updated revision date at the head of this page.