In short: This website has no cookies, analytics, tracking or forms (it only remembers your light or dark theme choice, on your device). The only personal data that reaches us through it is what you choose to send by email, plus the basic technical logs our web host keeps. We use the information people share with us to reply to enquiries, deliver our services and run our business, and we never sell it.
Who we are
R&R Consulting Ltd (“we”, “us” or “our”) is a private limited company registered in England and Wales and based in London. We provide technology consulting and bespoke application development.
For the personal data described in this policy, we are the controller: we decide how and why it is used, and we are responsible for protecting it under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us at enquiries@randrconsultingltd.com.
Scope of this policy
This policy covers personal data about:
- people who visit this website;
- people who contact us, including prospective clients;
- our contacts at client organisations, before, during and after an engagement; and
- our suppliers and subcontractors, and the people who work for them.
Most people deal with us on behalf of their organisation, but this policy still applies to the personal data we hold about you as an individual.
When we handle data for our clients
When we build, support or review systems for a client, we may have access to personal data held in them, such as details of the client’s staff, customers or users. For that data we act as a processor: we handle it only on the client’s instructions and under a written contract with them, and the client remains the controller.
That processing is covered by the client’s own privacy notice, not this one. If you have a question about it or want to exercise your rights, please contact the client. If you contact us instead, we will refer your request to them.
Information we collect
- Website visitors: this site has no forms or accounts. Like any website, its hosting provider automatically records basic technical information in server logs: your IP address, browser and device type, the pages requested, and the date and time of each request.
- Enquiries: if you email us, we receive your name, email address and whatever you include in your message, such as your job title, organisation and phone number.
- Client contacts: your name, job title, organisation and business contact details, our correspondence and meeting notes, and details we need to work with you on a project, such as access to your organisation’s systems.
- Suppliers and subcontractors: names, business contact and company details, and what we need to engage and pay you, such as contracts, invoices and bank details.
We usually collect information directly from you. Sometimes it comes from someone else, such as a colleague who introduces you to us or names you as a project contact.
We don’t ask for sensitive information, such as health data, so please don’t send it unless it is genuinely needed.
You don’t have to give us personal data to use this website. If you want us to reply to you or work with you, we’ll need your contact details.
How we use your information and our lawful bases
We use personal data only for the purposes below, each of which has a lawful basis under data protection law.
- Responding to enquiries and discussing how we can help. Lawful basis: our legitimate interests in replying to people who contact us and developing our business, or taking steps you have asked for before entering into a contract.
- Delivering our services and managing client relationships, including running engagements and sending proposals and invoices. Lawful basis: performing our contract with you or, where the contract is with your organisation, our legitimate interests in delivering the agreed services.
- Working with suppliers and subcontractors, including engaging and paying them. Lawful basis: performing our contract with you, or our legitimate interests in running our business.
- Running and protecting this website, including keeping it secure, fixing problems and preventing misuse. Lawful basis: our legitimate interests in operating a secure, working website.
- Keeping business, accounting and tax records and meeting other legal duties. Lawful basis: compliance with our legal obligations.
- Establishing, exercising or defending legal claims. Lawful basis: our legitimate interests.
- Helping public authorities where necessary, for example to prevent or detect crime or respond to an emergency. Lawful basis: a legal obligation where the law requires us to share information, or otherwise a “recognised legitimate interest” under the UK GDPR.
Where we rely on legitimate interests, we have checked that they are not outweighed by your rights and interests. You can ask us for details. We do not make decisions about you based solely on automated processing, and we don’t send marketing newsletters.
International transfers
Some of our service providers, such as email and cloud storage providers, may store or access personal data outside the UK. When that happens, we make sure the data is protected as UK law requires. Usually this means that:
- the destination is approved under UK law as providing adequate protection, such as the European Economic Area or, in the United States, organisations certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”); or
- a contract approved for UK transfers is in place, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
Contact us for more information about the safeguards we use.
How long we keep it
We keep personal data only for as long as we need it, including to meet legal, accounting and reporting requirements. As a guide:
- Enquiries that don’t lead to an engagement: up to two years after our last contact.
- Client and supplier records, including contracts and key correspondence: for the relationship and six years after it ends, reflecting the usual six-year period for bringing contract claims.
- Accounting and tax records: six years from the end of the financial year they relate to, as HMRC requires, or longer where the law requires it.
- Website server logs: kept by our hosting provider for a short period for security and troubleshooting, then deleted automatically.
We may keep information longer if we need it for a legal claim or the law requires it. When we no longer need it, we delete it securely or anonymise it.
How we protect it
We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include limiting access to those who need it, using reputable providers with strong security, protecting our accounts and devices, and requiring anyone who works with us to keep information confidential.
Email is not always fully secure. If you need to share something confidential or sensitive, ask us about a more secure way to send it.
Your rights
Under UK data protection law, you have the right to:
- access your personal data and get a copy of it;
- rectification: have inaccurate or incomplete data corrected;
- erasure: ask us to delete your data;
- restriction: ask us to limit how we use your data;
- data portability: receive data you have given us in a machine-readable format, or have it sent to another organisation, where we process it by automated means under a contract with you or with your consent; and
- withdraw consent at any time, in the rare cases where we rely on it.
Your right to object: where we rely on legitimate interests (including recognised legitimate interests), you can object at any time on grounds relating to your situation. We will then stop, unless we have compelling legitimate grounds that override your interests or we need the data for legal claims. You can also object to direct marketing at any time, and we will stop.
Some rights apply only in certain circumstances. To use any of them, email enquiries@randrconsultingltd.com. We don’t usually charge. We will respond within one month, or up to two months longer for complex or multiple requests, in which case we will tell you. We may need to confirm your identity first.
Complaints
If you are unhappy with how we have handled your personal data, you have the right to complain to us. Please email enquiries@randrconsultingltd.com. We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you updated and tell you the outcome.
You can also complain to the UK’s data protection regulator, the Information Commission, known as the ICO (Information Commission’s Office). The ICO will usually ask you to raise your concern with us first, but you can contact it at any time:
- online at ico.org.uk/make-a-complaint; or
- by phone on 0303 123 1113.
Changes to this policy
We may update this policy from time to time, for example if the law or our practices change. We will publish the new version on this page and update the “last updated” date.
Contact us
For questions about this policy, to exercise your rights or to make a complaint, email enquiries@randrconsultingltd.com.