Privacy notice
This notice explains, in plain terms, what personal information we collect, why we use it, how long we keep it and what rights you have. It covers this website, email enquiries, and the people we work with as clients, contacts and associates.
Who we are
The controller responsible for your personal information is Kaas Consulting Limited, registered in England and Wales, company no. 10188669. Registered office: 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF.
For any question about this notice or your information, email klara@kaasconsultingltd.com. The law does not require us to appoint a data protection officer, so this address handles all privacy questions.
What we collect and why
| Who | What we hold | Why we use it | Lawful basis (UK GDPR) |
|---|---|---|---|
| People who contact us through the website or by email | Name, email address, organisation, job title and anything you choose to tell us | To reply to your enquiry and, if you ask, discuss working together | Legitimate interests (answering business enquiries); steps before a contract where you request them |
| Business contacts | Name, work contact details, organisation, role and our correspondence | To keep in touch about relevant work, insights or events you would reasonably expect from us | Legitimate interests (running and developing our business). You can object at any time and we will stop |
| Clients and people at client organisations | Work contact details, role, and business information shared during an engagement, which may include details of employees and suppliers | To deliver the agreed services, manage the engagement, invoice and keep proper records | Contract; legitimate interests in delivering the work; legal obligation for financial and tax records. Where we handle personal data on a client's behalf, we act as their processor under our agreement |
| Associates and specialist-network members, including people we approach or who apply | Name, contact details, CV, skills, experience, availability, rates, references and, where an engagement requires it, right-to-work or due-diligence checks | To assess fit for assignments, propose people to clients (only with your agreement), and manage contracts and payments | Legitimate interests (building a specialist network); steps before and performance of a contract; legal obligation where checks are required by law |
We do not ask for special category information (such as health or ethnicity). If an engagement ever needs it, we will tell you first and identify the extra condition we rely on.
Where we rely on legitimate interests, we have weighed our interests against yours and use your information only in ways you would reasonably expect. You can ask us for details of that assessment.
Where your information comes from
Mostly from you. We may also receive it from your employer or our client during an engagement, from people who recommend you, and from public professional sources such as company websites and professional networking profiles.
How long we keep it
| Information | Retention |
|---|---|
| Enquiries that do not lead to work | Up to 2 years from our last contact |
| Business contact details | While the relationship is active, reviewed at least every 2 years; removed promptly if you object |
| Client engagement records and contracts | 6 years after the engagement ends (legal, tax and insurance). Client working data is returned or deleted as the client agreement specifies |
| Associate and network records | While you are in our network, reviewed every 2 years. Unsuccessful approaches or applications: up to 12 months. Contract and payment records: 6 years |
| Accounting and tax records | 6 years after the end of the financial year they relate to |
Who we share it with
We do not sell personal information. We share it only where needed, with:
- Service providers acting as our processors: website hosting by Vercel Inc. (USA), and email and document storage through Microsoft 365, supplied via GoDaddy, which is also our domain registrar. They may use your information only on our instructions.
- Clients, when we propose an associate for an assignment, and only with that person's agreement.
- Professional advisers such as accountants, lawyers and insurers, and authorities such as HMRC where the law requires it.
International transfers
Some providers, including Vercel and Microsoft, may store or access information outside the UK. Where they do, the transfer is protected by UK adequacy regulations (for example for the European Economic Area, or US organisations certified under the UK Extension to the EU-US Data Privacy Framework, as Vercel is), or by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Ask us for more detail.
Keeping it secure
We use access controls, multi-factor authentication and encrypted business systems, and limit access to people who need it for their work.
Your rights
You have the right to:
- be told how we use your information (this notice);
- ask for a copy of your information;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to limit how we use it;
- object to our use of it, and absolutely to any direct marketing;
- ask us to transfer information you gave us to another organisation, where processing is based on contract or consent and is automated;
- withdraw consent at any time, where we rely on it.
We do not make decisions about you based solely on automated processing. To use any of these rights, email klara@kaasconsultingltd.com. There is normally no charge and we will reply within one month.
How to complain
If you are unhappy with how we have used your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.
Changes to this notice
We review this notice regularly; the date at the top shows when it last changed. Our use of cookies is explained in our cookies notice.