Welcome to our Privacy Policy

IP addresses and website security

When you visit our website, we may automatically collect limited technical information including:
 

• IP address;

• browser type and device information;

• pages visited;

• dates and times of access; and

• website security and performance information.
   

We process this information to maintain website security, diagnose technical issues, prevent misuse, and improve website performance.

​

Lawful basis: Legitimate interests.
 

Contact forms and website enquiries

If you contact us through our website, email, telephone, LinkedIn or other professional channels, we may collect:
 

• your name;

• work contact details;

• organisation name;

• job title;

• details of your enquiry; and

• records of our communications.
   

We use this information to respond to enquiries, discuss services, arrange meetings and manage prospective business relationships.
 

Lawful basis: Legitimate interests.
 

Analytics

We use analytics tools, including Google Analytics, to help us understand how visitors use our website and improve website functionality.

​

Analytics information may include website interactions, device information, approximate location data and usage patterns.

We only use non-essential analytics technologies where you have provided consent through our cookie banner.

​

Lawful basis: Consent.

​

Cookies

We use cookies and similar technologies to operate our website, improve user experience and understand website performance.

For more information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

​

Enquiries, prospective clients and business contacts

We process personal information where you contact us about our services or engage with us in a professional capacity.

This may include:

​

• enquiries about consultancy, DPO or advisory services;

• discovery calls and consultations;

• procurement and tendering activities;

• networking and professional introductions;

• referrals;

• requests for proposals or quotations; and

• business relationship management.
   

The information we process may include:
 

• name;

• work email address;

• telephone number;

• organisation name;

• professional role/title;

• business requirements; and

• records of communications.
   

Lawful basis: Legitimate interests.
 

Retention period: Up to 12 months for general enquiries and up to 24 months for prospective client relationships, proposals and tenders unless a contract is entered into.
 

Client relationships and professional services

Where you engage us for consultancy, DPO, advisory or professional support services, we process information necessary to manage the contractual relationship and deliver our services.
 

This may include:

​

• contact information for client representatives;

• contractual information;

• billing and invoicing information;

• project and service delivery records;

• communications; and

• information necessary to deliver contracted services.
   

Depending on the nature of the services provided, we may process confidential or sensitive information on behalf of our clients.

In most cases, DPS acts as a service provider or processor on behalf of client organisations, who remain responsible for their own privacy information and legal obligations as controller.
 

Where we process personal information as a controller, this will generally be limited to:
 

• business contact information for client representatives;

• contract administration;

• invoicing and payment information;

• relationship management; and

• records necessary to operate our business.
   

Lawful basis: For information where we act as a controller, we generally rely on:

• Contract - to manage and deliver contracted services;

• Legal obligation - for financial, tax and regulatory requirements; and

• Legitimate interests - to manage business relationships, maintain records and ensure service quality.
   

Where we process information on behalf of a client organisation, the client organisation will determine the appropriate lawful basis for processing.
 

Retention period: Where we process personal information as a controller, we will generally retain records relating to client relationships for the duration of the contract and for up to 6 years afterwards, unless a longer retention period is required for legal, regulatory, insurance or dispute resolution purposes.
 

Where we process personal information on behalf of a client organisation, retention periods will be determined by the relevant data processing agreement, service agreement or the instructions of the client organisation as controller.
 

Suppliers, associates, subcontractors and business partners

We process information relating to suppliers, associates, contractors, freelancers and business partners for business administration and service delivery purposes.
 

This may include:
 

• business contact details;

• contract information;

• payment and invoicing information;

• due diligence records; and

• communications relating to services.
   

Lawful basis: We generally process this information because it is necessary for the performance of a contract or to take steps prior to entering into a contract.
 

In some circumstances, we may also process information to comply with legal obligations, including financial, tax and accounting requirements, or for our legitimate interests in managing business relationships and service delivery.

Retention period: Contract duration plus 6 years.

Marketing communications

We may contact you with information about services, updates, events or relevant professional content where permitted by law.
 

We may rely on: Consent
 

Where required, we will ask for your consent before sending marketing communications.
 

You may withdraw consent at any time.
 

Legitimate interests and B2B communications

Where appropriate, we may contact existing business contacts and organisations about services or professional matters that we believe may be relevant to their role or organisation.
 

Where permitted, we may rely on a B2B soft opt-in approach for existing professional relationships.
 

We currently engage with professional audiences through business networking and professional channels, including LinkedIn.
 

You can opt out of marketing communications at any time by:

• clicking the unsubscribe link in communications (where available); or

• contacting us at enquiries@dataprivacysimplified.co.uk.
   

Who we share information with

We may share information with trusted third parties where necessary, including:
 

• IT and website providers;

• analytics providers;

• accountants and financial service providers;

• insurers and professional advisers;

• legal advisers;

• regulators or law enforcement where legally required; and

• service providers supporting the delivery of our professional services.
   

We only share personal information where necessary, lawful and with appropriate safeguards in place. Our data processors are subject to strict data processing agreements and assurances to ensure an adequate level of protection of your data.
 

International transfers

Some of our service providers may process information outside the UK.

Where international transfers occur, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, such as adequacy regulations or approved contractual safeguards. Should you have any questions or concerns in relation to international transfers, please contact us at enquiries@dataprivacysimplified.co.uk.
 

Data retention

We only retain personal information for as long as necessary.

​

• General enquiries: Up to 12 months

• Prospective clients / tenders: Up to 24 months

• Client records: Contract duration + 6 years

• Supplier and contractor records: Contract duration + 6 years

• Financial records: 6 years

• Marketing preferences: Until opt-out or inactivity

• Website analytics: According to cookie settings and provider retention periods
   

In some cases, we may retain information for longer where required for legal, regulatory, insurance or dispute resolution purposes.
 

Your privacy rights

Under data protection law, you may have a number of rights in relation to your personal information. The rights available to you will depend on the circumstances and the legal basis we rely on for processing.
 

Where Data Privacy Simplified Ltd is the data controller, you may have the right to:
 

• Right of access - Request a copy of the personal information we hold about you and receive information about how we use it.

We will carry out reasonable and proportionate searches for information that relates to you and respond in accordance with applicable legal requirements.

 

Where we process information on behalf of a client organisation, we may need to refer your request to the relevant organisation as the data controller.
 

• Right to rectification - Ask us to correct inaccurate or incomplete personal information.

• Right to erasure - Request deletion of your personal information in certain circumstances, for example where the information is no longer required or where consent has been withdrawn.
   

Please note that we may need to retain some information where legal, regulatory, insurance or contractual obligations apply.
 

• Right to restrict processing - Ask us to limit how we use your personal information in certain circumstances.

• Right to object - Object to processing where we rely on legitimate interests as our lawful basis.
   

You also have the right to object to direct marketing at any time.
 

• Right to withdraw consent - Where we rely on consent, you may withdraw your consent at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.

• Right to data portability - Where applicable, request a copy of certain personal information in a structured, commonly used and machine-readable format.
   

Exercising your rights

To exercise your rights or make a privacy-related request, please contact us at:

​

Email: dpo@dataprivacysimplified.co.uk

​

Updates

We may update this Privacy Notice from time to time to reflect changes in our services, legal obligations or website functionality.

​

Last Update: September 2026

​