PRIVACY POLICY

David Brady, trading as David Brady Consultancy Services, is a self-employed individual and is the data controller where I determine how and why your personal information is used.

If you have any questions about this policy or how I use your personal information, please contact:

David Brady
Trading as David Brady Consultancy Services
Email: david@david-brady.co.uk
Website: www.david-brady.co.uk

The information I collect depends on how you interact with me and the work I am carrying out.

It may include:

• your name;
• job title and employer or organisation;
• business email address;
• telephone number;
• other professional contact details;
• information you provide through this website, by email, telephone, LinkedIn or another communication channel;
• information about an enquiry, potential project or business requirement;
• correspondence and records of communications;
• contractual and project information;
• invoicing, payment and financial administration information;
• information required to manage a client, supplier or partner relationship;
• technical information generated when you use this website, such as your IP address, browser, device information and information about how the website is used.

I may also receive professional contact information from publicly available business sources, company websites, professional networking platforms, business directories, referrals, events, industry contacts or mutual connections.

Some consultancy assignments may require me to work with personal information about employees, relocating individuals, family members, suppliers or other third parties.

Depending on the nature of the project, this could include information relating to employment, relocation, housing, immigration, travel, family circumstances or other information necessary to provide the agreed services.

The exact information required will vary from project to project, and I will only seek or use information that is reasonably necessary for the work being undertaken.

In some circumstances, the organisation engaging me will remain the data controller and I will process information on its behalf as a data processor.

Where appropriate, the respective responsibilities of the client and David Brady Consultancy Services will be dealt with through the relevant contract, data-processing terms or other project documentation.

I do not ask visitors to provide sensitive or special-category personal information through the general website contact form unless it is genuinely necessary for their enquiry.

I use personal information only where I have a lawful reason to do so.

Where I rely on legitimate interests, these may include:

• operating and developing my consultancy;
• communicating with clients, prospective clients and professional contacts;
• responding to business enquiries;
• managing professional relationships;
• maintaining appropriate business records;
• identifying relevant business opportunities;
• improving my services;
• protecting my business and systems;
• managing suppliers and professional partners;
• establishing or defending legal rights.

I consider whether the proposed use of information is necessary and proportionate and balance my interests against the rights and interests of the person concerned.

I may occasionally contact people in a professional capacity where I reasonably believe my services, experience or network may be relevant to them or their organisation.

This may include people identified through existing professional relationships, referrals, networking, business events, publicly available company information, professional directories or platforms such as LinkedIn.

I will comply with applicable UK GDPR and Privacy and Electronic Communications Regulations requirements when undertaking business development or direct marketing.

I will never sell your personal information or contact details to third parties for marketing purposes.

Your right to object to direct marketing

You may object to the use of your personal information for direct marketing at any time by emailing david@david-brady.co.uk.

I may retain a minimum amount of information on a suppression record so that your preference continues to be respected.

Most personal information I use is provided directly by you.

You may provide information when you:

• complete the contact form on this website;
• email or telephone me;
• enquire about my services;
• engage me to undertake work;
• work with me as a supplier or partner;
• communicate with me through a professional networking platform.

I may also obtain business contact information from:

• your employer's website;
• publicly available professional profiles;
• professional networking platforms;
• business directories;
• referrals;
• mutual contacts;
• clients;
• professional partners;
• other publicly available sources.

Where required by law, I will provide appropriate privacy information when personal information has been obtained indirectly.

I only share personal information where there is a genuine business, contractual or legal reason to do so.

Depending on the circumstances, this may include:

• website and technology providers, including Squarespace;
• accounting and financial systems, including Xero;
• email, cloud-storage, CRM and other business-system providers;
• accountants, lawyers, insurers and other professional advisers;
• specialist consultants and professional partners;
• relocation and destination-service providers;
• immigration advisers;
• tax advisers;
• HR and People specialists;
• property and housing specialists;
• education specialists;
• household-goods and logistics providers;
• temporary-accommodation providers;
• global-employment, EOR, payroll or reward specialists;
• legal advisers;
• technology providers;
• contractors or suppliers supporting my business;
• regulators, courts, law-enforcement bodies or public authorities where disclosure is required or permitted by law.

One of the principles behind David Brady Consultancy Services is bringing together the right expertise around the needs of each project.

Where another specialist needs to be involved, I will only share personal information that is reasonably necessary for them to perform their role.

My work is international.

I may work with clients, suppliers, professional contacts and specialist partners in countries around the world, and some of the technology services I use may process information outside the United Kingdom.

Where UK data-protection law treats a transfer as a restricted international transfer, I will take appropriate steps to ensure that an appropriate legal mechanism or safeguard applies.

This may include:

• UK adequacy regulations;
• recognised contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to appropriate contractual clauses;
• another transfer mechanism permitted under UK data-protection law.

This website is hosted using Squarespace.

Squarespace may process technical and usage information as part of providing, securing and maintaining the website and its functionality.

Information submitted through website forms may also be processed through Squarespace's systems in order to deliver that information to me.

Squarespace operates its own systems and privacy practices, governed by its applicable terms and privacy documentation.

This website may use cookies and similar storage or access technologies.

These may be used to:

• make the website function correctly;
• maintain security;
• remember website settings or preferences;
• understand how visitors use the website;
• identify technical problems;
• improve the performance and usability of the website.

Some technologies are strictly necessary for the website to function and do not require consent.

Where consent is legally required, relevant non-essential technologies will not be used until you have made your choice.

Where available, you can manage your preferences through the cookie controls provided on this website. You can also control or delete cookies through your browser settings.

I do not keep personal information indefinitely simply because I have collected it.

Enquiries that do not result in an engagement

Information will be reviewed periodically and deleted when it is no longer reasonably required.

Client and project information

Relevant information may ordinarily be retained for up to six years after the end of the engagement or relationship where this is reasonably required for contractual, insurance, accounting, tax or legal purposes.

Financial and accounting information

Records will be retained for the period required by applicable tax, accounting and other legal obligations.

Supplier and professional-partner information

Information will be retained while the relationship remains active and for a reasonable period afterwards where there is a legitimate business or legal reason to retain it.

Business-development information

Information will be periodically reviewed and removed where it is no longer relevant or appropriate to retain it.

Marketing suppression information

Where you have asked not to receive marketing, I may retain the minimum information necessary to ensure your preference continues to be respected.

Website information

Technical and analytical information will be retained according to its purpose and the settings and retention periods applying to the relevant technology provider.

I take reasonable and proportionate technical and organisational measures to protect personal information from:

• unauthorised access;
• loss;
• misuse;
• alteration;
• inappropriate disclosure;
• destruction.

Measures may include:

• password protection;
• account-access controls;
• multi-factor authentication where appropriate;
• reputable cloud and technology providers;
• secure business systems;
• device security;
• appropriate backup arrangements;
• limiting access to those who genuinely need it;
• confidentiality and contractual controls where appropriate.

No internet or electronic system can be guaranteed to be completely secure, but I take reasonable steps appropriate to the nature of the information I handle.

I do not currently use personal information to make decisions about people solely by automated means where those decisions have legal or similarly significant effects.

If this changes, I will update this Privacy Policy and provide any additional information required by law.

Depending on the circumstances, UK data-protection law may give you rights relating to your personal information.

These may include the right to:

• access personal information I hold about you;
• ask me to correct inaccurate or incomplete information;
• ask me to delete personal information in certain circumstances;
• ask me to restrict how information is used in certain circumstances;
• object to certain uses of your personal information;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent;
• object to certain automated decision-making;
• object at any time to direct marketing.

Not every right applies in every circumstance.

To exercise any of these rights, contact: david@david-brady.co.uk.

I may need to ask for reasonable information to confirm your identity before releasing or changing personal information.

If you are concerned about the way I have collected, used, stored, shared or protected your personal information, you can make a data-protection complaint directly to me.

David Brady
david@david-brady.co.uk

I will:

• provide a clear way for you to make a complaint;
• acknowledge receipt of a data-protection complaint within 30 days;
• take appropriate steps to investigate it;
• keep you appropriately informed;
• communicate the outcome without undue delay.

You also have the right to complain to the UK's independent data-protection regulator, the Information Commissioner's Office (ICO) .

I would welcome the opportunity to consider and resolve your concern directly first.

This website may contain links to websites operated by other organisations.

I am not responsible for the privacy or data-protection practices of third-party websites.

If you follow an external link, you should review the privacy information provided by the organisation operating that website.

My consultancy services are provided to businesses and professional clients and this website is not intended specifically for children.

I do not knowingly use this website to collect personal information from children for marketing purposes.

Some consultancy projects, particularly relocation assignments, may legitimately involve information relating to children or dependants of relocating employees.

Where this occurs, that information will only be handled where necessary for the relevant service and subject to appropriate contractual and data-protection arrangements.

I may update this Privacy Policy from time to time to reflect:

• changes to my business;
• changes to the services I provide;
• changes to the technology or suppliers I use;
• changes to how personal information is processed;
• changes to applicable law or regulatory guidance.

The latest version will be published at www.david-brady.co.uk, with the date of the most recent update shown at the top of this page.