1. Introduction
This privacy notice is valid from 01/05/2024. The aim of this notice is to give you information on who we are and how we collect and process your personal data (through your use of this website, by email, in person, by phone or via any other communications means).
If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us using the information set out below.
Dufrain Consulting Limited
50 Lothian Road
Festival Square
Edinburgh
EH3 9WL
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (https://ico.org.uk/). We would, however, appreciate the chance to deal with your concerns above so please contact us in the first instance.
We may update this privacy notice from time to time. When we do so, the date of the notice will be updated. By continuing to use our website after a revision takes effect, it is considered you have read and accepted such changes.
2. Who we are
Dufrain Consulting Limited is the controller and is responsible for your personal data. Our contact details are as above.
3. What personal data do we collect?
Personal data means information about an individual from which that person can be identified. We may collect, use, store and transfer the following categories of personal data:
- Identity Data (e.g name, title)
- Contact Data (e.g your business name, address, email and phone number)
- Website Usage and other Technical Data (e.g IP Address, information gathered through tracking cookies and similar)
- Marketing and Communications Data (e.g your preferences as to receiving marketing from us)
- Other information relevant to your general enquiries
- Other information relevant to job applications submitted such as your CV and cover letter
- Other information contained in ongoing communications (emails, call records and team chats.) and any other information you may provide us.
4. What do we use your personal data for?
We will only use your personal data when the law allows us to. Most commonly we will use your personal data in the following circumstances:
- Where we need to perform the contract we are about to enter in with you or have entered in with you;
- Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
- Where you have consented to us doing so;
- For legal claims; to defend or bring a case against you or a third party; or
- Where we need to comply with a legal obligation.
We have set out below, in table format, a description of the ways we plan to use your personal data and which of the legal basis we rely on to do so.
| Purpose/Activity | Type of Data | Lawful basis for processing |
| To provide services to you including under any agreements we enter into with you | Identity Data and Contact data. | Contract Performance. Consent. Legitimate Interests. |
| To facilitate use of our website (responding to your queries) and to ensure content is relevant. | Identity Data and Contact Data. | Contract Performance. Consent. Legitimate Interests. |
| For marketing and business development purposes. To provide you with details of services, newsletters, webinars and invites to events. | Identity Data and Contact Data. | Consent. Legitimate Interests. |
| To improve our services we track email interactions | Identity Data and Contact Data. | Contract Performance. Legitimate Interests. |
| For recruitment purposes. To process your application and assess your suitability. | Identity Data and Contact Data. CV. Application form. | Contract Performance. Consent. Legitimate Interests. |
| To fulfil our legal, risk management or regulatory requirements. | Identity Data. Contact Data. Financial Data. | Legal Obligations. Legitimate Interests. Legal Claims. |
| To ensure we are paid. | Identity Data. Contact Data. Financial Data. | Contract Performance. Legitimate Interests. Legal Claims. |
| To reorganise our business (in the event we are to divest of any of our business). | Identity Data. Contact Data. Financial Data. Transaction Data. | Legitimate Interests. |
All data processed by us will be tracked and recorded within our CRM system for referencing purposes.
5. Marketing communications
We may send you marketing and other communications from time to you but you can opt out at any time by clicking unsubscribe on any email communications or emailing us at enquiries@dufrain.co.uk
6. How is your personal data collected?
We collect data from and about you through the following methods:
- Direct interactions. You may provide us with your identity and contact details by filling in the ‘Contact Us’ form or by using the online chat tool.
- Automated technologies or interactions. As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this data by using cookies and other similar technologies. You can find further information on our Cookies Policy.
- Call recording. We may record telephone calls you make to us and may record calls initiated by us.
- Publicly available sources. For example Linkedin.
- Live chat. We may process information that you provide to us for the purpose of engaging with us via a Live Chat facility. The profile data may include your name, address, telephone number, email address, locations information, IP Address and website / platform navigation path. The profile data may be processed for the purposes of providing our services or support on our services.
- HubSpot. We collect and store client email information gathered during our exchanges with you in our CRM system to manage communication, provide services, and enhance customer experience.
7. How long do we store data for?
Your data will only be kept for as long as necessary to fulfil the purposes we collected it for. All data is stored in line with our retention policy. Our retention periods are based on business needs and good practice.
8. When do we share your personal data with other organisations?
We may share your data with a variety of the following categories of third parties:
- Our professional advisors, bankers and auditors
- Our insurers and insurance brokers
- Third party service providers (e.g HubSpot)
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or assets.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
9. Is your personal data transferred outside the UK or the EEA?
Your personal data is not currently transferred outside the UK or the EEA.
10. Cookies
To find out more information as to how we use cookies, please read our Cookies Policy.
11. Security
We have put in place appropriate security measures to seek to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition we limit access to your personal data to those employees, agents and contractors who have a business need to know. They will only process your data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator if legally required to do so.
12. Your legal rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:
- Request access to your personal data (commonly known as a “data subject access request”).
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
- Request erasure of your personal data.
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes.
- Request restriction of processing of your personal data.
- Request the transfer of your personal data to you or to a third party.
- Withdraw consent at any time where we are relying on consent to process your personal data.
Please contact us as detailed above if you wish to exercise any of these rights.