1.1 Who we are
Day40 Solutions Ltd (“Day40”, “we”, “us” or “our”) is a UK consultancy providing legal consultancy, training, advisory and management services. For the purposes of UK data-protection law, Day40 is the controller of personal data described in this policy where it determines why and how that data is processed.
Registered office: 19 Lascelles Close, London, England, E11 4QE. Privacy enquiries may be sent to info@day40solutions.com or made by telephone on 020 8064 1402.
1.2 Scope
This policy explains how we collect, use, disclose, retain and protect personal data when you visit our website, contact us, make an enquiry, engage with our publications or training, or otherwise interact with Day40. Separate privacy information may be supplied where a particular engagement requires more specific processing.
1.3 Personal data we may collect
- Identity and contact information, including name, job title, organisation, email address, telephone number and correspondence details.
- Professional and business information relevant to an enquiry, booking, engagement or relationship with Day40.
- Enquiry and correspondence information, including information you choose to provide through forms, email, telephone or other communications.
- Transaction and engagement information relating to services, training, publications, invoices or business administration.
- Technical and usage information such as IP address, browser/device information, website interactions and cookie or analytics data, where collected.
- Marketing preferences and records of consent or objection.
- Information contained in recruitment, speaker, consultant, supplier or other professional relationship communications.
Please do not send special-category personal data, confidential case material or identifiable service-user information through a general website enquiry form unless Day40 has specifically requested it and an appropriate secure route has been agreed.
1.4 How we obtain personal data
We may obtain information directly from you; from your employer or organisation; from professional contacts or publicly available professional sources; through our website and associated technologies; or from service providers acting on our behalf.
1.5 Purposes and lawful bases
We process personal data only where we have a lawful basis. Depending on the circumstances, this may include performance of or steps connected with a contract; our legitimate interests in operating, developing and protecting a professional consultancy; compliance with a legal obligation; or consent where consent is the appropriate basis.
- Responding to enquiries and discussing prospective engagements.
- Delivering and administering consultancy, training, advisory, management, publications and related services.
- Managing client, supplier, consultant and professional relationships.
- Operating, securing, measuring and improving our website and services.
- Maintaining financial, corporate, compliance and business records.
- Sending relevant business communications or marketing where permitted by law, and respecting opt-outs.
- Establishing, exercising or defending legal rights and addressing complaints or disputes.
1.6 Special-category and case-related information
Day40 does not seek to collect sensitive case information through its public website. Where a professional engagement legitimately requires special-category or other sensitive personal data, the applicable lawful basis and additional condition will be considered in the context of that engagement, together with appropriate confidentiality and security arrangements.
1.7 Sharing personal data
We may share personal data with trusted service providers supporting hosting, email, IT, security, professional administration, payment, accounting, communications or website analytics; with professional advisers; with authorities where legally required; or with another party in connection with a legitimate corporate transaction. Providers are expected to process information only for authorised purposes and subject to appropriate safeguards.
1.8 International transfers
Some technology providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we will use an appropriate lawful transfer mechanism and supplementary measures where necessary.
1.9 Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including contractual, professional, tax, accounting, legal and dispute-management requirements. Retention periods vary according to the nature of the information and relationship. Information no longer required will be deleted, anonymised or securely disposed of where appropriate.
1.10 Security
We use proportionate organisational and technical measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure or access. No internet transmission or storage system can be guaranteed to be completely secure.
1.11 Your rights
Subject to applicable law and relevant exemptions, individuals may have rights to access personal data; request correction or erasure; restrict processing; object to processing; receive certain data in portable form; and withdraw consent where processing relies on consent. You may also object to direct marketing at any time.
Requests may be sent to info@day40solutions.com. We may need to verify identity before acting on a request.
1.12 Complaints
If you have concerns about our use of personal data, please contact us first so that we can consider them. You also have the right to complain to the UK Information Commissioner’s Office (ICO).
1.13 Third-party websites
Our website may link to websites operated by third parties. Day40 does not control their privacy practices and you should review their own privacy information.
1.14 Changes
We may update this policy to reflect legal, regulatory, operational or technological changes. The current version and effective date will be published on our website.