Privacy Notice

This Privacy Notice explains how The Privacy Desk collects and uses personal information about clients, prospective clients, suppliers, professional contacts and other individuals who contact or interact with the organisation.

Who is responsible for your information?

The Privacy Desk is the controller of the personal information described in this notice. This means that The Privacy Desk decides why and how that information is processed.

Personal information we collect

Depending on your relationship with us, we may collect:

• your name, job title and organisation;
• contact details, including the email address you provide through our contact form;
• information contained in enquiries, correspondence and meeting notes;
• information needed to prepare proposals, contracts and deliver professional services;
• billing, payment and accounting records;
• supplier and professional contact information; and
• limited technical information generated when you use this website, such as server and security logs.

Please do not include unnecessary sensitive or confidential information in the initial website enquiry form.

Why we use your information

We use personal information to:

• receive, assess and respond to enquiries;
• provide data protection, privacy, cyber security and related professional services;
• manage client and supplier relationships;
• prepare proposals, contracts, invoices and business records;
• meet legal, regulatory, tax and professional obligations;
• protect our systems, website, information and services; and
• establish, exercise or defend legal rights.

Our lawful bases

The lawful basis depends on why the information is being used. We may process information because:

• it is necessary to take steps at your request before entering into a contract or to perform a contract;
• it is necessary for our legitimate interests in operating, protecting and improving the organisation and providing professional services, where those interests are not overridden by your rights;
• it is necessary to comply with a legal obligation; or
• you have given consent where consent is specifically requested. You may withdraw that consent at any time.

How we use and share information

Access is limited to those who need the information for a legitimate business purpose. We do not sell personal information.

Where necessary, information may be shared with clients, professional advisers, regulators, public authorities or service providers. We use categories of processors that support:

• cloud-based productivity and document management;
• secure file storage and backup;
• email, video meetings and business communications;
• website hosting and contact-form handling;
• accounting and invoicing;
• electronic signatures and contract administration; and
• IT security and secure connectivity.

Processors may only handle personal information for agreed purposes and subject to appropriate contractual and security requirements.

International processing

Some service providers may process information outside the United Kingdom. Where this happens, we require an appropriate safeguard or other lawful transfer mechanism under UK data protection law.

How long we retain information

We retain personal information only for as long as it is needed for the purpose for which it was collected and to meet applicable legal, regulatory, contractual, tax and professional requirements. Retention is considered according to the nature of the record, the relationship involved and any relevant limitation period. Information that is no longer required is securely deleted or anonymised.

How we protect information

We use proportionate technical and organisational safeguards designed to protect personal information against unauthorised access, loss, alteration or disclosure. These include access controls, multi-factor authentication, encryption where supported, secure devices and services, supplier assurance, backup arrangements, security monitoring and documented incident-management processes.

Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to certain processing;
• receive information in a portable format; and
• withdraw consent where processing is based on consent.

These rights are not absolute and exemptions may apply. We may need to confirm your identity before responding.

Contact us or make a complaint

To ask a question, raise a concern, make a complaint or exercise a data protection right, use the secure contact form on this website. Select or state that your enquiry concerns data protection so it can be handled appropriately.

Use the contact form

If you are dissatisfied with how your personal information has been handled, you also have the right to complain to the Information Commissioner’s Office. We would welcome the opportunity to address your concern first.

Make a complaint to the ICO

Website cookies and tracking

We do not currently use advertising or analytics cookies on this website. The hosting service may process limited technical information needed to deliver and secure the website.

Changes to this notice

This Privacy Notice is reviewed at least annually and whenever there is a significant change to our processing activities, suppliers, systems, services or applicable legislation. The review date above will be updated when the notice changes.