About Penby
Two people. Two decades.
One gap in the market.
Penby exists because most businesses have a compliance team that doesn't understand marketing and a marketing team that doesn't understand compliance. We spent our careers in both worlds. Now we work in the space between.
Penby Ltd. is a UK-based consultancy founded by Andy Williamson and Ola Degteva. We work at the intersection of data protection and marketing technology — helping businesses build marketing systems that perform and comply, without treating those as competing priorities.
We've worked together since 2012, originally through the expatriate and international financial services space. Over that time, the work evolved. Andy's compliance and data protection expertise drew consultancy engagements from financial services firms. Ola's marketing technology skills attracted enterprise clients through The Energy Cell, a UK integrated marketing agency where she has managed complex client portfolios for over seven years. The common thread was always the same: businesses struggling to make their marketing work within the constraints of privacy regulation.
In January 2026 we formalised what had already become true — that our consultancy practice needed its own identity. Penby is that identity. A small, focused consultancy that does serious work for clients who need both technical competence and regulatory understanding in the same room.
Andy Williamson
MBCS · IAPP · AIGP · IMCM Cert(IM)
Data Protection & Compliance Strategy
Andy's career reads like a sequence of environments where getting it wrong has consequences. Seven years in British Army logistics, mostly in Germany. Investment banking systems administration on trading floors running Sybase and Oracle risk management platforms. Six years as a freelance consultant building high-availability systems for Commerzbank, Dresdner Kleinwort Benson, and major telecoms operators across Germany.
In 2004 he co-founded an international financial advisory business, and in 2008 founded Expatra — a digital publication for British citizens considering life abroad. What started as a content project became a lead generation engine serving 150,000 monthly visitors at peak, delivering compliant enquiries to financial advisory clients across a space where FCA financial promotions rules, GDPR, and cross-border data transfers all intersect.
The thread through every stage is the same: building systems that work under pressure, stay compliant, and serve real people reliably. Andy now applies that to data protection strategy, privacy-compliant marketing architecture, and AI governance — backed by credentials that reflect genuine expertise rather than certification-collecting.
Credentials & memberships
AIGP
AI Governance Professional — IAPP
MBCS
Member — British Computer Society
IAPP Member
International Association of Privacy Professionals
IMCM Cert(IM)
Investment Migration Council, Geneva
BCS DPO Certificate
Data Protection — British Computer Society
ICO Registered
Information Commissioner's Office
What Andy brings
Compliance architecture — FCA financial promotions, GDPR, data protection built in from the start. Two decades of doing this in regulated financial services, not reading about it.
Content-led lead generation — Proven at scale. Built and operated a publication that became the primary lead generation engine for international financial advisory businesses.
Regulated content — Writes FCA-compliant financial content that advisors publish under their own name. Understands both the regulations and the audience.
AI governance — AIGP credential holder, positioned to address the emerging intersection of AI tools in marketing and the governance frameworks businesses will need.
Ola Degteva
Google Partner · DMA · GDPR Certified
Marketing Technology & Analytics
Ola is a marketing analyst with over a decade of delivering measurable ROI through data-driven digital marketing strategies. Her background is unusual in the marketing world — a philology degree from Russia, a Master's in English from Cyprus, and a career trajectory that moved from language and communication into the deeply technical territory of marketing analytics, tracking architecture, and privacy-compliant campaign management.
Since 2018, Ola has worked as Senior Marketing Analyst Contractor at The Energy Cell, a UK integrated marketing agency, where she manages a diverse enterprise client portfolio spanning e-commerce, B2B services, marketplace platforms, and accounts across UK and European markets. She led the agency's GDPR-compliant tracking migration, implemented Google Consent Mode V2 across the client base, and was instrumental in achieving Google Partner status through technical excellence — not spend thresholds.
Before the agency work, Ola spent five years at Expatra as Communications Officer and Marketing Analyst, building the publication's partner network, editorial strategy, and lead generation campaigns for expatriate financial services. She built a customer segmentation model using RFM analysis that delivered a 43% increase in response rates and developed multi-channel attribution frameworks that remained in use long after her role evolved.
Credentials & certifications
Google Partner
All 10 current Google Ads certifications
GDPR Qualified
DMA (Data & Marketing Association)
Data & Analytics
DMA Qualification
DMA Member
Data & Marketing Association
IDM Award in GDPR
Institute of Data & Marketing — studying
Consent Mode V2
Practitioner-level implementation expertise
What Ola brings
Marketing technology implementation — Not strategy decks. Hands-on implementation of tracking, analytics, consent management, and paid campaigns across complex multi-market environments.
GDPR-compliant marketing — The rare combination of understanding both the marketing technology and the regulatory requirements. Consent Mode V2, GTM, GA4 — configured properly.
Proven ROI delivery — 88% cost-per-lead reductions. 83% ROAS improvements. 21% tracking accuracy gains. Auditable results, not vanity metrics.
Agency-level technical depth — Seven years managing enterprise client portfolios across European markets, mentoring teams, and building the analytics infrastructure that agencies depend on.
"Ola transformed our marketing operations and brought a level of technical rigour and analytical expertise that significantly enhanced our client deliverables."
Abigale Dobbs, Marketing Director, The Energy Cell
Together
Complete coverage of a gap most businesses don't know they have.
Andy covers compliance strategy, data protection architecture, and the regulatory landscape. Ola covers marketing technology, campaign execution, and analytics implementation. Between them, there is no handoff to an external specialist, no gap between the strategy and the implementation, and no moment where compliance and marketing are in separate rooms having separate conversations.
This is not a large consultancy that assigns whoever is available. When you work with Penby, you work with Andy and Ola.
Strategy through execution
Data protection strategy and GDPR-compliant marketing implementation in the same engagement. No gap between the advice and the technical work.
Formal credentials in both disciplines
IAPP, BCS, AIGP, ICO registration on the compliance side. Google Partner, all current certifications, DMA qualifications on the marketing side.
Two decades in the same space
Not a recent pivot into privacy. A career-long track record of building and operating compliant marketing systems in regulated industries.
Privacy-first by conviction
Fathom Analytics, EU-only hosting, self-hosted fonts, no Google dependencies. The principles we advise on are the same ones we operate by.
How we work
Principles we don't negotiate on.
Substance over signals
We don't produce strategy decks that sit in a drawer. Every engagement results in something implemented, documented, and working — not a PDF of recommendations.
Honest assessment
If your problem isn't something we can fix, we'll say so. If your existing setup is fine and just needs a minor adjustment, we'll tell you that too. We don't manufacture scope.
Practice what we preach
This site runs on EU-hosted infrastructure with Fathom Analytics, self-hosted fonts, and no US data dependencies. We built the same kind of system we advise our clients to build.
Want to talk?
We're always happy to have a conversation about what you're dealing with — no pitch, no pressure, no twelve-slide capabilities deck. Just a straightforward discussion about whether we can help.
Get in touch