Privacy Policy

We may collect the following categories of personal data:

• →Identity Data: full name, job title, company name.
• →Contact Data: email address, telephone number, postal address.
• →Technical Data: IP address, browser type and version, time zone, operating system, device type.
• →Usage Data: pages visited, time spent on pages, navigation paths, referring URLs.
• →Communication Data: correspondence records when you contact us via email or forms.
• →Project Data: information you provide in briefs, audit requests or project estimators.

We process personal data for the following purposes:

• →To respond to your enquiries, audit requests and project briefs.
• →To deliver and manage our consulting services.
• →To send you relevant updates, insights and marketing communications (with your consent).
• →To improve our website, services and user experience.
• →To comply with legal and regulatory obligations.
• →To protect our legitimate business interests and enforce our terms.

Under UK GDPR and the Data Protection Act 2018, we rely on the following lawful bases:

• →Consent: where you have given clear consent for us to process your data for specific purposes (e.g. newsletter subscriptions).
• →Contractual necessity: where processing is necessary to perform a contract with you or take pre-contractual steps at your request.
• →Legitimate interests: where processing is necessary for our legitimate business interests, provided these do not override your rights.
• →Legal obligation: where processing is necessary to comply with applicable law.

We do not sell your personal data. We may share data with:

• →Service providers who assist in delivering our services (e.g. hosting, analytics, email).
• →Professional advisers (legal, accounting, insurance) as necessary.
• →Law enforcement or regulatory authorities when required by law.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the ICO.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Typical retention periods include:

• →Contact form submissions: 24 months from last interaction.
• →Client engagement records: 6 years (in line with UK statutory requirements).
• →Newsletter subscriptions: until you unsubscribe.
• →Website analytics data: 26 months (anonymised).

Under UK GDPR, you have the right to:

• →Access: request a copy of the personal data we hold about you.
• →Rectification: request correction of inaccurate or incomplete data.
• →Erasure: request deletion of your data where there is no compelling reason to continue processing.
• →Restriction: request that we restrict processing in certain circumstances.
• →Portability: request your data in a structured, machine-readable format.
• →Object: object to processing based on legitimate interests or direct marketing.
• →Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@dastute.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.