GDPR Compliance Statement

Last updated: July 6, 2026

Our Commitment to GDPR

We are committed to compliance with the General Data Protection Regulation and UK data protection legislation. This statement outlines how we process personal data in accordance with these requirements and explains your rights as a data subject.

Data Controller Information

We act as the data controller for personal information collected through our consultancy services. For enquiries regarding data protection, please contact us at [email protected].

Lawful Basis for Processing

We process personal data under the following lawful bases:

• Consent: When you voluntarily provide information through enquiry forms or consultations
• Contractual necessity: When processing is required to provide services you have requested
• Legitimate interests: When processing is necessary for our business operations, provided this does not override your rights and freedoms
• Legal obligation: When required to comply with applicable laws and regulations

Data Subject Rights

Under GDPR, you have the following rights regarding your personal data:

Right of Access

You may request confirmation of whether we process your personal data and receive a copy of that data. We will respond to access requests within one month of receipt.

Right to Rectification

You may request correction of inaccurate or incomplete personal data. We will update records promptly upon receiving valid correction requests.

Right to Erasure

You may request deletion of your personal data in certain circumstances, including when data is no longer necessary for the purposes for which it was collected or when you withdraw consent.

Right to Restriction of Processing

You may request that we limit how we use your personal data in specific situations, such as when you contest the accuracy of data or object to processing.

Right to Data Portability

You may request transfer of personal data you provided to us in a structured, commonly used format, either to yourself or to another service provider.

Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.

Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects. All consultancy decisions involve human review and judgement.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected] with sufficient detail to identify your account or service engagement. We may request additional information to verify your identity before processing requests.

Data Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures include:

• Encryption of data transmissions and storage
• Access controls limiting data access to authorised personnel
• Regular security assessments and updates
• Staff training on data protection requirements
• Secure disposal procedures for data no longer required

Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or to comply with legal obligations. Typical retention periods include:

• Active client records: Duration of service engagement plus six years
• Enquiry information: Two years from last contact if services are not engaged
• Financial records: Seven years as required by law

International Data Transfers

We process and store personal data within the United Kingdom. If international transfers become necessary, we will ensure appropriate safeguards are in place as required by GDPR.

Data Breach Notification

In the event of a data breach that poses risks to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours of becoming aware of the breach, as required by GDPR.

Complaints and Supervisory Authority

If you believe we have not handled your personal data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office, the UK's supervisory authority for data protection matters.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated through our website with an updated revision date.

Contact for Data Protection Enquiries

For questions about GDPR compliance or to exercise your data subject rights, please contact us at [email protected].