Information about our data protection practices under the General Data Protection Regulation
For the purposes of GDPR, we act as the data controller for personal information collected through our consultancy services. We determine how and why your personal data is processed.
We process personal data under the following legal bases:
Contract Performance: Processing necessary to fulfil our consultancy services agreement with you.
Legitimate Interests: Processing necessary for our legitimate business interests, such as improving services and maintaining client relationships, provided this does not override your rights and interests.
Consent: Where you have provided explicit consent for specific processing activities.
Right to Access: You can request copies of your personal data we hold.
Right to Rectification: You can request correction of inaccurate or incomplete data.
Right to Erasure: You can request deletion of your personal data in certain circumstances.
Right to Restrict Processing: You can request we limit how we use your data in certain situations.
Right to Data Portability: You can request transfer of your data to another service provider in a structured format.
Right to Object: You can object to processing based on legitimate interests or for direct marketing.
Rights Related to Automated Decision Making: You have rights regarding decisions made solely by automated processing that significantly affect you.
We retain personal data for as long as necessary to provide our services and fulfil legal obligations. Client consultation records are typically retained for six years following the conclusion of our engagement, unless you request earlier deletion or longer retention is required by law.
We process personal data within the United Kingdom. If circumstances require transferring data outside the UK or EEA, we ensure appropriate safeguards are in place to protect your information in accordance with GDPR requirements.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures are regularly reviewed and updated.
In the event of a data breach likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach.
To exercise any of your GDPR rights or raise concerns about our data processing practices, contact us at [email protected]
We will respond to requests within one month. In complex cases, this may be extended by two additional months with notification.
If you believe our processing of your personal data violates GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.