​Last updated: 29 September 2026

Hebborn Consultancy Ltd respects your privacy. This policy explains how we collect and use personal data, our reasons for doing so, who we share it with, how long we keep it and your rights.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended, including by the Data (Use and Access) Act 2025.

We do not sell personal data or share it with other organisations for their own marketing purposes.

1. Who we are

Hebborn Consultancy Ltd
Company number: 11479220
ICO registration number: ZA768371

Registered office: Tedder House, Tedder Close, Watton, Norfolk IP25 6HU
Telephone: 0333 772 1510
Email: enquiries@hebborn.co.uk
Data protection enquiries: dpo@hebborn.co.uk

Hebborn Consultancy Ltd is the controller for personal data we use to manage our business, enquiries, client relationships, training, website, marketing and complaints.

Where we process personal data solely on a client’s documented instructions, we act as their processor. The client remains the controller and is responsible for explaining that processing in its own privacy information. Our role depends on the particular work and how decisions about the processing are made.

You can use the contact details above to ask questions about this policy or exercise your data protection rights.

2. Personal data we collect

Depending on your dealings with us, we may collect and use:
 

• Your name, business or organisation, job title and contact details.

• Information you provide when making an enquiry, requesting a quotation or instructing us.

• Correspondence, meeting notes, call notes and records of advice.

• Information relevant to consultancy, audits, DPO services, complaints, incidents and information rights requests.

• Training bookings, attendance records, feedback and certificates.

• Billing details, invoices and payment records.

• Marketing preferences and records of consent or objections.

• Information about your use of our website, including technical information and information collected through cookies and similar technologies.

We obtain information directly from you and, where relevant, from your employer, our clients, people acting on your behalf, referral contacts and publicly available business sources. Clients may supply information about individuals where this is relevant to the work they ask us to undertake.

We ask clients and other correspondents to provide only the personal data necessary for the matter concerned.

Some information is necessary to respond to your enquiry, enter into a contract or provide our services. If you do not provide it, we may be unable to proceed. We will explain any specific statutory or contractual requirement to provide information when it applies.

 

Where we receive personal data about you from another person or organisation while acting as controller, we will provide you with the privacy information required by data protection law within the applicable time limit, unless an exemption applies. This may include where providing the information would be impossible or involve disproportionate effort, where you already have the information, or where we are required to keep the information confidential. Where we act solely as a processor for a client, the client is ordinarily responsible for providing privacy information, although we may assist where agreed or required.

 

3. Why we use personal data and our lawful bases

We identify an appropriate lawful basis for each processing activity.

Enquiries and contracts with individuals

Where you contract with us personally, or ask us to take steps before entering into a contract, we use the personal data necessary to respond, provide a quotation and deliver the agreed services.

Our lawful basis is contract — Article 6(1)(b) UK GDPR.

Business contacts and client relationships

We use business contact information to communicate with clients and prospective clients, arrange work, administer training and manage relationships with organisations.

Our lawful basis is legitimate interests — Article 6(1)(f) UK GDPR. Our interests are providing our services and maintaining effective business relationships.

Business administration, records and security

We use personal data where necessary to administer our business, maintain appropriate records of instructions and advice, manage payments, protect our systems, prevent misuse and establish, exercise or defend legal claims.

Our lawful basis is legitimate interests — Article 6(1)(f) UK GDPR, except where a specific legal obligation requires the processing.

We assess whether processing based on legitimate interests is necessary and whether those interests are overridden by your interests or fundamental rights and freedoms.

Legal and regulatory obligations

We process personal data where necessary to comply with legal obligations, including obligations under tax and accounting law, the UK GDPR and the Data Protection Act 2018. Depending on the circumstances, this may include maintaining accounting records, responding to information-rights requests and handling data-protection complaints.

Our lawful basis is legal obligation — Article 6(1)(c) UK GDPR.

Marketing

We may use contact details to provide information about relevant services, training and events.

Where consent is required, our lawful basis is consent — Article 6(1)(a) UK GDPR. Where the law permits marketing without consent, we may rely on legitimate interests — Article 6(1)(f) UK GDPR, following an assessment of the impact on you.

 

You can request further information about our legitimate-interests assessments where they apply to your personal data.

We also comply with the separate PECR requirements applicable to the type of communication and recipient.

You can object to direct marketing at any time. We will stop using your personal data for that purpose. Use any unsubscribe option provided or contact us using the details in section 1.

Cookies and similar technologies

Where consent is required, we obtain it before using the relevant technology. Where associated processing of personal data relies on consent, our lawful basis is Article 6(1)(a) UK GDPR.

Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

4. Special Category Data

Our work may involve special category data, such as health information or trade union membership, where it is relevant to an instruction, enquiry or complaint.

Where we act as controller, we require both an Article 6 lawful basis and an applicable Article 9 condition. For example, this may include your explicit consent or processing necessary to establish, exercise or defend legal claims. We meet any additional Data Protection Act 2018 requirements that apply.

​

The Article 9 condition we rely on will depend on the purpose and context of the processing.

We do not assume that sending us sensitive information amounts to explicit consent. Where another condition is needed, we identify it and provide further privacy information where required.

Information about criminal allegations, offences and convictions is subject to separate safeguards under Article 10 UK GDPR and the Data Protection Act 2018. We only process it where the applicable legal requirements are satisfied.

Where we act solely as a processor, we process information on the controller’s documented lawful instructions and assist the controller with its obligations.

5. Who we share personal data with

We share personal data only where necessary and lawful. Depending on the circumstances, recipients may include:

Providers of website hosting, IT, email, communications, cloud storage and other business systems.

Accountants, legal advisers, insurers and other professional advisers.

Clients and their authorised representatives where sharing is necessary for the work we undertake.

People or organisations involved in investigating or resolving a complaint, incident or legal claim.

Regulators, courts, law enforcement bodies and public authorities where disclosure is required or otherwise lawful.

Where a supplier processes personal data on our behalf, we put in place a contract that meets Article 28 UK GDPR.

Other recipients may act as independent controllers and are responsible for their own compliance with data protection law.

6. International transfers

We are based in the United Kingdom. The suppliers used to deliver our services may involve processing, storage or support access outside the UK.

Where this involves a restricted transfer of personal data, we ensure that an appropriate transfer mechanism applies. This may include UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.

Where required, we assess the protection available in the destination country and implement additional safeguards.

You can contact us for information about the arrangements relevant to your personal data and how to obtain a copy of applicable safeguards, subject to necessary redactions.

7. How long we keep personal data

 

We keep personal data only for as long as it is necessary for the purpose for which it was collected or received. When deciding how long to retain information, we take account of the nature of the information, the services provided, legal and regulatory requirements, contractual requirements, professional accountability, limitation periods, and any need to establish, exercise or defend legal claims.

Our retention periods are set out below. They are normally calculated from the end of the relevant relationship, service, matter, financial year or other stated trigger. We may retain information for longer where this is necessary and proportionate, for example because of an ongoing complaint, investigation, regulatory matter, legal claim, insurance notification or legal hold.

• Enquiries and quotations not resulting in an engagement: normally two years after our last substantive contact with you.

• Client contact details and relationship-management records: normally two years after the end of the client relationship or last substantive contact, whichever is later. We may retain limited contact and relationship information for longer where this is necessary to maintain an ongoing professional relationship, respect a marketing objection, or deal with a complaint, claim or regulatory matter.

• Consultancy, audit, advisory and training-service records: normally six years after completion of the relevant service, engagement or training event. This may include instructions, key correspondence, advice, reports, audit records, attendance records, certificates and material necessary to demonstrate the services provided.

• DPO and other ongoing support-service records: normally six years after the end of the relevant service arrangement. Where records need to be retained for a longer period to demonstrate compliance, address a regulatory issue or defend a legal claim, we will keep only the information necessary for that purpose.

• Financial, accounting and invoicing records: normally six years after the end of the financial year to which they relate, or for any longer period required by applicable law.

• Marketing records: until you withdraw consent, object to direct marketing, ask us to stop using your details for this purpose, or we decide that the information is no longer needed. We normally review marketing contact information at least every two years.

• Marketing suppression records: for as long as necessary to ensure that we continue to respect your objection, unsubscribe request or other marketing preference. These records are limited to the minimum information required for that purpose.

• Complaints, incidents and information-rights records: normally six years after the matter is closed, unless a longer period is necessary because of a regulatory matter, legal claim, insurance requirement, investigation or other documented reason.

• Website, cookie and technical information: for the period stated in our Cookie Policy or, where no fixed period is stated, for no longer than necessary for the relevant purpose.

• Personal data processed solely for a client: in accordance with the client’s documented instructions, the relevant contract and our obligations as processor. The client, as controller, is responsible for setting the principal retention requirements for that processing.

At the end of the applicable retention period, we will securely delete, destroy or anonymise personal data unless we have a documented reason to retain it for longer. Where information is retained beyond its normal period, we will restrict access to it and review the continued need for retention at least annually.

8. Your data protection rights

Depending on the circumstances, you have rights to:

Receive information about how we use your personal data.

Access your personal data and receive a copy.

Have inaccurate personal data corrected.

Have personal data erased.

Restrict how we use your personal data.

Receive certain personal data in a portable format.

Object to processing based on legitimate interests.

Withdraw consent where we rely on it.

Complain to us and to the Information Commissioner’s Office.

Some rights depend on the lawful basis and circumstances of the processing. We will explain any applicable restriction or exemption.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

To exercise your rights, contact us using the details in section 1. You do not have to use a particular form or refer to specific legislation.

We respond without undue delay and within the applicable statutory period. For most rights requests, this is one month, calculated in accordance with data-protection law. Where permitted, we may extend the period by up to two further months because of complexity or the number of requests. We will tell you within the initial period if we need an extension.

We carry out reasonable and proportionate searches when responding to subject access requests.

Requests are normally free of charge. We will explain any exceptional circumstances in which the law permits a reasonable fee or refusal.

9. Cookies and similar technologies

Our website uses cookies and similar technologies to support its operation and, where applicable, understand how visitors use it.

Some technologies are exempt from the PECR consent requirement, provided the relevant legal conditions are met. Where consent is required, we ask for it before using the technology.

You can accept or reject optional cookies through the website’s cookie controls and change your choice subsequently. Browser settings also allow you to manage or delete cookies.

Please read our Cookie Policy alongside the information provided through our cookie controls.

10. Information security

We use appropriate technical and organisational measures to protect personal data against unauthorised or unlawful use, accidental loss, destruction or damage.

These measures include access controls, secure systems, confidentiality requirements and appropriate arrangements for handling and disposing of information.

We limit access to people who need the information for their work and review our safeguards according to the risks involved.

11. Data protection complaints

You have the right to complain to us if you believe we have handled your personal data unlawfully or have not respected your data protection rights.

You can:

Email Data Protection Officer: dpo@hebborn.co.uk

Telephone 0333 772 1510.

Write to Hebborn Consultancy Ltd, Tedder House, Tedder Close, Watton, Norfolk IP25 6HU.

Our Data Protection Complaints Procedure is available on request.

You do not have to use a particular form. If you need assistance or an accessible way to make your complaint, please let us know.

We will acknowledge your complaint within 30 days of receiving it. We will make appropriate enquiries, keep you informed of progress and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO). We welcome the opportunity to address your concerns first, but this does not remove your right to contact the ICO.

Website:Website: ico.org.uk/make-a-complaint 
Telephone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

12. Changes to this policy

We review this policy and update it when our activities or legal obligations change.

The date at the top shows when it was last updated. We will bring significant changes to your attention where appropriate and provide further privacy information before using your personal data for a new purpose where the law requires it.