Privacy Notice
About this notice
This notice explains how Umlaut Consulting Ltd handles personal data. It covers visitors to our website, people who book a meeting with us or get in touch, our clients and the people we work alongside, and readers of our newsletter, The Data Coach.
Who we are
Umlaut Consulting Ltd is the controller for the personal data described in this notice, except where we say otherwise. We are a company registered in England and Wales.
| Company number | 08756010 |
| Registered office | Worthy House, 14 Winchester Road, Basingstoke, Hampshire, United Kingdom, RG21 8UQ |
| ICO registration number | ZC264250 |
| Contact for privacy matters | dataprivacy@umlautconsulting.co.uk |
We are a small firm and are not required to appoint a Data Protection Officer. Our director deals with all privacy questions and requests personally.
Overview
We collect very little personal data. Our website does not use cookies, and it measures visits with a privacy-focused analytics tool that does not identify visitors. If you book a meeting, Google's booking service passes us your name and email address. We do not run a mailing list from the website, we do not sell personal data, and we do not use it for advertising. When we work for a client, any data about the client's people stays under the client's control, and in most cases inside the client's own systems.
What we collect and why
When you visit our website
Our website does not set cookies or store anything on your device.
We count visits using a privacy-focused analytics service that works without cookies. It tells us which pages are read, which sites and searches send people to us, and the broad mix of countries, devices and browsers our visitors use. Your IP address is used briefly when the page loads, to record the visit, and is then discarded rather than stored. What we see are totals and trends. We cannot identify you from them, and we cannot follow you from one visit to the next or across other websites.
Our hosting provider delivers the website from a network of servers around the world so that pages load quickly wherever you are. Like most hosting services, it keeps short-term technical logs, including IP addresses, to deliver the site and protect it from misuse. These logs are deleted within seven days.
The pages where you book a meeting or read our newsletter are run by Google and Substack on their own websites, and they may set cookies there under their own policies. Our cookie policy gives more detail.
When you book a meeting
Our booking page is provided by Google Calendar and opens on a Google web page. When you book, you give your name and email address, and anything else you choose to add to the booking. Google passes these to us and adds the meeting to our calendar. We use them to hold the meeting and to follow up on it. If you are signed in to a Google account when you book, Google's own privacy policy also applies to your use of its services.
When you email us or work with us
If you email us, we keep your message and contact details so that we can reply. If you are a client, a prospective client, a consultancy we work with or a supplier, we hold the business contact details of the people we deal with, such as names, job titles, work email addresses and phone numbers, along with our correspondence and the records needed for contracts and invoices.
We keep the names and email addresses of client and prospective client contacts in our own business management application, alongside records of each project, such as its name, budget and duration. Only Umlaut can use the application, and its database is hosted in the European Union. We keep accounting records in cloud accounting software, which holds the names and contact details of the people in our clients' finance teams who handle our invoices and payments.
During client engagements
When we work for a client, the client decides how any personal data involved is used, and its own privacy notice applies. We handle that data only on the client's instructions and under our contract with them. Where a client shares documents with us directly, we use them only for the engagement and return or delete them when it ends. When we work as a subcontractor to another consultancy, the terms agreed with that consultancy and its client apply.
When you read The Data Coach
Our newsletter, The Data Coach, is published on Substack. Substack manages subscriptions and is responsible for subscriber data under its own privacy policy. As the publisher, we can see subscribers' email addresses, and we use them only to run the newsletter. You can unsubscribe at any time from any newsletter email.
Our lawful bases
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Website analytics and hosting logs | Legitimate interests: running a secure website and understanding which content is useful to readers, without identifying anyone |
| Replying to enquiries and holding booked meetings | Legitimate interests: responding to people who contact us and developing our business |
| Managing relationships with clients, consultancies and suppliers | Contract, where you are a party to it. Otherwise legitimate interests, where you are the contact at an organisation we work with |
| Engagement data we handle for a client | Determined by the client as controller |
| Occasional emails to business contacts about our work | Legitimate interests: telling business contacts about work that is relevant to them |
| Accounting and tax records | Legal obligation |
| Responding to data protection requests and complaints | Legal obligation |
| Establishing or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have considered whether our use of your data is what you would reasonably expect and whether it could affect you unfairly. You have the right to object, as explained below.
Marketing
We do not send marketing emails from our website, and we do not buy or rent contact lists. We may occasionally write to business contacts about work that we believe is relevant to them. Every such email tells you how to opt out, and we stop as soon as you ask.
Who we share personal data with
We use a small number of service providers, who process personal data on our behalf and under contract. They may use it only to provide their service to us. They fall into these categories:
| Type of provider | What they do for us |
|---|---|
| Business email, calendar and productivity software | Email, meeting bookings, calendars and file storage, including documents that clients share with us |
| Website and application hosting | Delivering our website and running our business management application |
| Cloud database provider | Storing the records in our business management application, including client and prospective client contact details, in the European Union |
| Accounting software | Invoicing and bookkeeping, including the contact details of the finance staff we deal with at client organisations |
| Website analytics | Counting visits to our website without cookies or identifying visitors |
Our newsletter platform, Substack, is responsible for subscriber data in its own right, as described above.
We may also share information with our professional advisers, such as our accountant, insurers or lawyers, where they need it to advise us, and with public authorities where the law requires us to.
We do not sell personal data, and we do not share it with anyone for their own marketing.
International transfers
Some of our service providers store or access personal data outside the UK, including in the European Union and the United States. Whenever personal data leaves the UK, we make sure it is protected by one of the safeguards that UK data protection law recognises. These are a UK adequacy decision for the destination country, such as those covering the European Union and, for certified US organisations, the UK–US data bridge, or contractual safeguards such as the UK International Data Transfer Agreement or standard contractual clauses with the UK Addendum. If you would like a copy of the safeguards that apply to a particular transfer, email dataprivacy@umlautconsulting.co.uk.
How long we keep personal data
| Data | How long we keep it |
|---|---|
| Contact details, booking details and correspondence for prospective clients, where no work follows | 2 years from our last contact |
| Client contact details in our business management application | While we work with the organisation, then 6 years after our last engagement with it. We remove contacts who have left the organisation when we learn of it |
| Contracts, proposals and statements of work | 6 years after the engagement ends |
| Invoices and financial records | 6 years from the end of the financial year they relate to |
| Our own working papers and deliverables | 6 years after the engagement ends |
| Documents and data shared with us by a client | Returned or deleted within 30 days of the engagement ending, unless our contract says otherwise. We confirm deletion on request |
| Website visit statistics | Kept only as anonymous totals |
| Hosting logs | No more than 7 days |
| Records of data protection requests and complaints | 3 years after the request or complaint is closed |
When a period ends, we delete the data or anonymise it so that it no longer identifies anyone.
How we protect personal data
Only Umlaut has access to our systems. We work inside our clients' systems wherever we can, which keeps their data under their own controls.
Your rights
You have the right to ask for a copy of the personal data we hold about you, and to ask us to correct it if it is wrong. You can ask us to delete it, to restrict how we use it, or to give it to you in a portable format. You can object to our use of it where we rely on legitimate interests, and you can withdraw consent at any time where we rely on consent. We do not make decisions about anyone by automated means.
To make a request, email dataprivacy@umlautconsulting.co.uk. We may ask you to confirm your identity before we act. We will reply within one month. If a request is complex, we may extend this by up to two further months and will tell you why. If we need more information to deal with your request, the time limit is paused until you provide it. We carry out reasonable and proportionate searches for the information you ask for. There is normally no charge.
If we hold your data only on a client's behalf, we will pass your request to the client and help them respond.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at dataprivacy@umlautconsulting.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the UK data protection regulator, the Information Commission (still known as the ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We review this notice at least once a year and whenever the way we handle personal data changes, for example when we bring associates into our work.