A digital consultancy that started in 2012 with one developer who wanted to work to his own standard, and grew into the firm that global brands ask to sit between them and their agencies. We are small, independent, registered where you can check us, and unusually willing to say no.
Green Arrow Consultancy is a UK AI agency and digital consultancy based in Cardiff, Wales, founded in 2012 by Darren Tyler. It builds and runs production AI systems, websites and web applications, and delivers privacy, analytics, accessibility and governance programmes for global consumer brands. Company number 12491770, ICO registration ZA822868, and a member of the IAPP.
Green Arrow Consultancy is a limited company registered in Wales that designs, builds and operates digital systems for organisations that cannot afford to get them wrong. That covers production AI applications, websites and web applications, consent and privacy programmes, ethical analytics, and accessibility work to WCAG 2.2 and EN 301 549. Most of our clients are consumer brands, professional firms and market research organisations with estates spread across several countries and several agencies.
It is worth being equally clear about what we are not. We are not a design studio, and we do not compete for brand identity work. We are not a marketing agency, and we do not sell media. We are not a body shop renting out developers by the day. We are not a reseller with a quota to hit for a consent platform vendor, which is why we will deploy Osano, OneTrust or Securiti.ai depending on which one fits the estate rather than which one pays us.
The founding story is small and specific. In 2012 Darren Tyler left a lead developer role and a one third shareholding in a web development firm. The reason was not money or a falling out. It was that he wanted to build to his own standard rather than to the standard the commercial pressure of that business allowed. Green Arrow Consultancy started as one person, one laptop and a decision that the quality of the work would be the only thing sold.
The second decision came a year later, and it is the one that shaped everything since. In 2013 it became obvious that the clients who needed help most were not the ones without an agency. They were the ones with several. A brand manager with a design agency, a development agency and a media agency has three sets of invoices, three sets of assurances and nobody independent who can read the code, question the estimate or say that the proposed approach will not survive a data protection review. That gap is where this firm has lived ever since, and it is now published as a service in its own right under web development and website management.
The consequence of that positioning is a habit that clients notice quickly. We are the supplier that tells you when a piece of work is not needed. It costs us revenue in the short term and it is the reason relationships here are measured in years rather than projects.
Fourteen years, told through the work rather than the milestones a marketing team would choose.
Darren Tyler leaves a lead developer role and a one third shareholding in a web development firm to work to his own standard. Green Arrow Consultancy begins as a one person practice in Cardiff.
It becomes clear that clients do not need another agency. They need an independent third party sitting between them and their design and development agencies, able to read the code and question the estimate. That role becomes the core of the business.
Green Arrow takes over more than thirty Energizer UK and European websites, moving from single site projects into managing an estate.
Campaigns delivered across France, Germany, Italy and the United Kingdom, with the localisation, legal and analytics coordination that four markets demand.
A single campaign runs across thirteen European countries, which forces the operational discipline that later made large privacy programmes possible.
Sixteen Asia Pacific websites are added, bringing the managed portfolio past fifty one sites. Privacy work begins in earnest as clients prepare for the General Data Protection Regulation.
A digital asset mapping project across more than one hundred websites for a Fortune 500 client. Knowing exactly what a large organisation owns online turns out to be the hardest question in the room.
The practice incorporates as a limited company in Wales, company number 12491770, with a registered office on Cathedral Road in Cardiff.
The managed portfolio passes two hundred websites, with roughly half of clients based in the United States. The firm is now running estates rather than projects.
A partnership with the UpGuard security platform adds third-party and attack surface risk monitoring to the privacy and accessibility work.
Seven production AI systems built for clients, including an AI battery finder and product comparison tools, an industrial facility power advisor, a document accessibility remediation tool, an enterprise search browser extension, a code of conduct assistant, a legal training assistant and an analytics reporting assistant. All seven are generalised into the live demonstrations on this site.
The pattern in that list is worth naming. Nothing here came from a new business pitch. Every expansion, from thirty websites to fifty one, from Europe to Asia Pacific, from web development into privacy and then into applied AI, happened because an existing client asked whether we could take on the next thing. That is a slower way to build a company and a more durable one.
There are three named people at Green Arrow Consultancy. You will meet all of them. Nobody here is presented in a pitch and then replaced by a delivery team you have never spoken to.
Darren founded the firm in 2012 and has spent twenty one years in the web industry as a developer, a trainer and a privacy professional. He started in front-end and back-end development, moved through large multi-country website estates, and then into data protection when the General Data Protection Regulation forced every brand he worked with to rebuild how it handled consent, tags and analytics. He is a member of the International Association of Privacy Professionals. He still writes code, still runs the accessibility audits, and is the person who leads the applied AI work. He is the technical reviewer for everything published on this site.
That combination is unusual and it is the reason clients keep him in the room. A developer who understands UK GDPR is rare. A privacy professional who can read the tag manager container and tell you which script is firing before consent is rarer. Both skills in the same person removes an entire layer of translation from a project.
Carol is a director of the company and a retired nurse. She runs human resources and administration, which in a firm this size means contracts, onboarding, supplier records, insurance, and the operational discipline that keeps a small consultancy from behaving like a hobby. A career in nursing produces a particular attitude to process and record keeping, and it shows in how this company is run.
Paul handles business development and is the first person most new clients speak to. He also leads the firm's charity giving programme, which directs a portion of what the business earns to causes the team chooses. It is not a marketing exercise and it is not something we normally put on a slide, but it is a real part of how the company operates and it belongs on a page that claims to describe the firm honestly.
Five habits that describe almost every engagement, whether it is a two week audit or an eight year relationship.
The first conversation is about what is going wrong and who it affects, not about which package you would like. A surprising number of enquiries end with a recommendation that costs nothing, such as removing a script or rewriting a policy page. We would rather be useful in week one than billable.
The person who scopes the work does the work or leads it. There is no account manager relaying questions to a technical team you never meet, which is the single most common complaint we hear about the agencies we are brought in to sit alongside.
Acceptance criteria, the lawful basis for any personal data, the accessibility standard being met, and the measure that will say the work succeeded. Disagreements are much cheaper at this stage than after a launch.
Most of our engagements involve at least one other agency. We are used to reviewing somebody else's code, questioning somebody else's estimate and doing it without turning the relationship into a fight. Our loyalty is to the client who is paying us.
Websites drift, consent platforms change their defaults, vendor models get deprecated and analytics quietly break. Most of our revenue is recurring management rather than one-off builds, which aligns our interests with the thing continuing to work.
Darren Tyler has been doing work for me on Energizer's website compliance. Not only has he met our teams expectations but exceeded them.
Brands we have built, managed, measured or made compliant.
Since 2014 the largest single relationship has been with Energizer Holdings, beginning with thirty or more UK and European websites and growing into a multi-region digital platform covering Europe, Asia Pacific, the Middle East and Africa. That work brought with it a portfolio of consumer brands across batteries, automotive care and air care.
The other long relationships tell you as much as the brand names do. Circana brought us in for privacy management platform implementation across Osano, Securiti.ai and OneTrust, three platforms in one programme, which is a problem shape almost nobody advertises for. Healey Fox has been a client for over eight years, covering website development, a rebrand, a property management system and a Salesforce CRM integration. Scottish Hampers ran a promotional and social campaign with us that reached 191,000 people with 84,100 engaged in the first three days.
Where we operate. Programmes run across the United Kingdom, the United States, the European Union, Asia Pacific, the Middle East, South America and South Africa. Since 2022 roughly half of our clients have been based in the USA. In practice that means we work across UK GDPR, the EU GDPR, US state privacy laws, and the accessibility regimes that sit on top of them, including the European Accessibility Act and EN 301 549. The office is in Cardiff. The estate is not.
Most engagements draw on three or four of these at once.
Three public registers, one professional body and two published profiles. None of it requires taking our word for anything.
| What | Identifier | Check it |
|---|---|---|
| Registered company | Green Arrow Consultancy Ltd, company number 12491770 | Companies House record |
| Data protection registration | ICO registration ZA822868 | ICO public register |
| VAT registration | GB 344486874 | Shown on every invoice we issue |
| Registered office | Sophia House, 28 Cathedral Road, Cardiff, CF11 9LJ, Wales, UK | Filed at Companies House |
| Professional membership | International Association of Privacy Professionals (IAPP) | iapp.org |
| Security partnership | UpGuard platform partner since 2024 | Third-party and attack surface risk |
| Company page | Green Arrow Consultancy on LinkedIn | uk.linkedin.com |
| Main website | greenarrowconsultancy.com | greenarrowconsultancy.com |
If a supplier asks you to trust them with personal data and cannot produce a company number and an ICO registration in the same email, that is information too.
Green Arrow Consultancy has developed and managed my websites for Healey Fox for over 8 years now. I have been delighted with his online media and website knowledge and skills, the great value they offer and the high level of customer service and care they have offered us.
More on ways of working, pricing and privacy is in the full FAQ.
Green Arrow Consultancy Ltd is a privately owned Welsh company. It was founded in 2012 by Darren Tyler, who is the founder and chief executive, and it was incorporated as a limited company in 2020 under company number 12491770. Carol Tyler is a director. There is no outside investor, no private equity owner and no parent group, which is why we are able to tell a client that a project should not go ahead.
The registered office is Sophia House, 28 Cathedral Road, Cardiff, CF11 9LJ, Wales, United Kingdom. The work is not confined to Wales. Client programmes run across the United Kingdom, the United States, the European Union, Asia Pacific, the Middle East, South America and South Africa, and roughly half of our clients have been based in the USA since 2022.
Yes, and we would rather you checked. The company is registered at Companies House under number 12491770. It holds an Information Commissioner's Office data protection registration, number ZA822868, and is VAT registered under 344486874. All three registers are public and free to search, and the links are on this page. Any consultancy that handles personal data on your behalf should be able to give you the same three numbers without hesitating.
Small and deliberately so. The named team is Darren Tyler as founder and chief executive, Carol Tyler as director running human resources and administration, and Paul Knowlson as business development manager. Specialist contributors are brought in for particular disciplines. We do not sell a large delivery team and then staff the work with the least experienced person available, because there is no large delivery team to sell.
Nine practice lines: privacy management, website development, website management, ethical analytics, website accessibility, digital strategy, agency assistance, privacy-first training and applied AI. In practice most engagements combine several of them, because a consent banner, an analytics implementation, an accessibility fix and a retrieval assistant are all the same website seen from four different angles.
Because the hard part of an AI system is not the model. It is access to content, permissions, data protection, evaluation and the interface people have to operate. Those are the things we had already been doing for a decade across more than two hundred managed websites. The move into applied AI was a shorter step for us than it was for firms arriving from the model side with no privacy or accessibility practice behind them.
Green Arrow Consultancy is a member of the International Association of Privacy Professionals, the IAPP, which is the main global body for the privacy profession. In 2024 we also partnered with the UpGuard security platform for third-party and attack surface risk work. We do not claim certifications we do not hold, and you should be sceptical of any supplier who lists a standard without a certificate number.
Usually alongside it. The firm exists because of a 2013 observation that clients needed a competent third party sitting between them and their design and development agencies, someone able to read a proposal, check the code, question the estimate and take the client's side. That role is still a large part of what we do, and it is described in more detail on our services pages.
Email info@greenarrowconsultancy.com or call 029 2117 5902. You will speak to someone who does the work rather than to an account manager, and the first conversation is a scoping call rather than a pitch. The contact page sets out what to include in a first message so the reply is useful to you.
Written and reviewed by the Green Arrow Consultancy team, led by Darren Tyler, founder and chief executive.
No account layer, no discovery deck you have to pay for before anyone looks at your systems. Tell us what is going wrong and we will tell you whether we are the right firm for it.