Privacy Policy

Last updated: 5 November 2026

This notice explains how we use personal information when you visit falconeinternational.com, contact us, submit a request for proposal, or use the Falcone International Risk Assessment (FIRA). Separate information and contractual arrangements may apply to an agreed client engagement.

Who is responsible

The website data controller is Colibri Holdings Ltd, trading as Colibri Studios, registered in England and Wales under company number 09741137, at 71 Queen Victoria Street, London EC4V 4BE, United Kingdom. For privacy questions or requests, email hello@colibriholdings.com.

Information we use

• Contact and callback requests: your name, email, telephone number where requested, message and the page from which you submit the form.
• Requests for proposals: your title, name, business contact details and address, organisation, industry, optional revenue band, comments and any supporting-document link you provide. The form accepts a link, not a file upload.
• FIRA: your 25 selected answers are scored in your browser. You can view the results without supplying an email. If you choose to share results for follow-up, we receive your email, answers, total score, percentage and risk band. This does not subscribe you to marketing or request an automatically emailed report.
• Technical information: hosting and form-delivery services process connection information such as IP address, browser details, request time and referring page to deliver and protect the services.
• Optional analytics: after you accept analytics, Google Analytics 4 records visits and interactions, including pages viewed, device/browser information, approximate location, contact-link clicks, form acceptance and FIRA progress/completion. A completion event includes the score percentage and whether an email was provided; our analytics events do not include the email address or individual assessment answers.

Required fields are marked on each form. Providing information is voluntary, but we need enough contact information to respond. Please use initial inquiries to describe your needs briefly. Do not send passwords, payment-card details, identity documents, sensitive personal information or confidential case files through these forms; ask us to arrange an appropriate channel first.

Why we use information

We use inquiries to respond, arrange a requested call, assess a proposal and discuss the services you have asked about. Where you ask us to take steps towards a contract with you, that is our lawful basis. For general business correspondence and requests made on behalf of an organisation, we rely on our legitimate interests in answering relevant inquiries and managing business relationships. Where a form asks for consent to store and respond to your submission, we use that consent for the stated purpose; you can withdraw it by contacting us.

Optional FIRA result sharing and optional analytics rely on your consent. You can use FIRA without sharing results and can browse with analytics declined. Necessary hosting, abuse prevention and security processing support our legitimate interests in operating a reliable website. We may also retain or disclose information where necessary to meet a legal obligation or establish, exercise or defend legal claims. We do not add form respondents to a newsletter or reuse their submissions for marketing without a separate opt-in.

Services involved

• Website delivery: Render hosts the static site, with content delivery and security infrastructure including Cloudflare. Fonts and the site's own scripts and images are generally served from this site.
• Form delivery: Formspree processes submissions and delivers them to our designated business mailbox, hosted by Google. It also processes information for delivery, spam prevention and security.
• Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore): only after you accept the notice that names Ahrefs, we use it to count visits to our public pages, to see which kinds of sites refer visitors and to count clicks intended to contact Falcone. Ahrefs receives the page address without its query string or fragment, the page title, the domain of the site that referred you (never the full link), your browser language and screen size. A contact click adds only a fixed event type: never the link clicked, form values, email addresses, dialled numbers or assessment answers, and it does not tell us whether an inquiry was completed. Contact, proposal and risk-assessment pages are not measured. Loading the script also sends your IP address and browser type to Ahrefs, which says it does not store IP addresses with analytics data. It sets no cookies and stores nothing on your device. Ahrefs discards IP addresses straight away and deletes the daily key it uses to count unique visitors after 24 hours, so visits cannot be linked across days; it keeps only aggregated visit counts, with no fixed deletion date, and may use anonymised aggregated data to improve its services. A previous acceptance of Google Analytics alone, or of our earlier service-page notice, does not start Ahrefs. You can decline, or withdraw at any time through Your Privacy Choices, described in the Cookie Policy. See Ahrefs’ privacy policy.
• Analytics: Google Analytics 4 is loaded only after acceptance. Our site configuration disables Google signals and advertising personalisation. Declining leaves analytics off. See the Cookie Policy for storage and controls.
• Embedded content: Google Maps appears on the contact and industry-relations pages. A SecurityScorecard badge appears in the footer; the home page also loads a Better Business Bureau seal. These resources connect your browser to their providers when loaded and expose technical connection data. They are separate from the analytics choice.
• External links: book-purchase and affiliate links, social-sharing links and other external destinations take you to another service when clicked. That service's notice applies there. Affiliate links can identify a referral; they do not give us the purchaser's payment details.

Information is accessible to authorised personnel and service providers as needed to handle inquiries, manage relevant business records and perform their functions. We do not operate a visitor account, live-chat system, newsletter signup or online appointment-booking widget on this website.

Processing outside the UK

The services above can process information outside the UK and European Economic Area, including in the United States. Formspree states that it hosts its service in the US and relies on Standard Contractual Clauses as a processor. Provider terms and safeguards differ by service; you can contact us for information about the arrangements applicable to your data. See Formspree's security information, Render's privacy notice and Google's privacy notice. We do not promise that information stays in the UK or Europe.

How long we keep information

Our retention policy targets removal of unconverted FIRA submissions from active records after 90 days from receipt, and other website inquiries after 12 months from receipt. We review records against those dates. This is a review-based process, not an automatic guarantee that every copy disappears on the same day.

We may retain information longer where it remains necessary for ongoing correspondence, a client matter, or a contractual, legal or dispute-related reason. We retain what is necessary and record the reason for an exception. We limit access and review continued need. Deleted email may remain in the mailbox's recoverable Trash for up to 30 days. Provider delivery/security logs, backups and other necessary business records are managed under applicable service, recovery and legal requirements, so removal from active records does not mean every backup copy is erased immediately.

Unshared FIRA answers remain in the current page's memory rather than a saved assessment account. Browser storage and cookies have the lifetimes described in our Cookie Policy. Analytics retention is separate from inquiry retention. Our Google Analytics property is set to retain user and event data for 14 months, with the user-data period reset on new activity. Most standard aggregated reports are not affected by those retention settings.

Your choices and rights

You can ask us for access to your personal information, correction, deletion, restriction or a portable copy where the relevant right applies. You can withdraw consent without affecting processing already carried out lawfully. You can object to processing based on legitimate interests, including explaining your particular circumstances. Contact hello@colibriholdings.com; we may need proportionate information to verify the request.

To change analytics consent, use Your Privacy Choices and select Decline. For a concern, contact us first if you wish. You can also complain to the UK Information Commissioner's Office or your relevant local supervisory authority.

FIRA applies a fixed scoring formula to the answers you select. Its output is an indicative self-assessment, not a decision about eligibility for employment, credit or another service, and not a professional audit or certification.

Information for California and other US residents

The information categories, sources, purposes, recipients and retention criteria are described above. Subject to applicable law, you may request access, correction, deletion and portability, and may use an authorised agent with appropriate verification. We do not sell inquiry details or use them for cross-context behavioural advertising. Our site does not run advertising-personalisation tags. The external content described above has its own provider practices. Contact us about an opt-out request or appeal at the privacy address above. We will not discriminate against you for exercising applicable privacy rights.

This notice covers the website and initial inquiries. If the way we process information changes, we will update this page and its date.