Introduction
This Privacy Notice explains how Laura Brentnall t/a True North Data Governance and Compliance Consultancy collects, uses and protects your personal data.
It also explains your privacy rights under data protection law.
Contact Details
If you have any questions regarding this Privacy Notice or our data protection practices, please contact us:
Registered Address:
Lytchett House
13 Freeland Park
Wareham Road
Poole
Dorset
BH16 6FA
Email:
laurabrentnall@tndgc.co.uk
Telephone:
07305 911235
ICO Registration: ZC083818
Scope of this Privacy Notice
This Privacy Notice explains how we manage your personal data when you interact with us, regardless of your location.
Depending on your relationship with us, we may hold and manage your information where you are:
- a website visitor;
- a contact for a prospective client;
- a contact for an existing client; or
- an individual whose information we process while providing services to one of our clients.
How we manage your information depends upon our relationship with you and whether we are acting as a Data Controller or a Data Processor.
If you are a website visitor, this Privacy Notice should be read alongside our Cookie Policy.
Our website is intended for a general audience and we do not knowingly collect personal data relating to children under the age of 16.
If you believe that we may hold personal data relating to a person under the age of 16, please contact us using the details above.
When We Act as a Data Controller
There are occasions where we act as the Data Controller for personal data that we hold. This includes:
- information relating to our clients; and
- information relating to prospective clients.
We may collect your information directly from you when you:
- visit our website;
- complete a contact form;
- contact us by telephone or email;
- sign up to our newsletter;
- respond to a survey;
- interact with us on social media; or
- engage with us at an event.
In some circumstances, we may collect your information indirectly. For example, we may receive your details through a referral from an existing or prospective client, or from publicly available sources where it is in our legitimate interests to do so.
When We Act as a Data Processor
There are occasions where we have access to, or hold, personal data as a Data Processor acting on behalf of one of our clients.
In these circumstances, our client is the Data Controller and we are the Data Processor.
Any requests, complaints or requests for information made directly to us in relation to that data will be reported to our client and handled in accordance with their instructions.
Where we act as a Data Processor, we will only receive and process personal data under the instructions of our client.
What is Personal Data?
Personal data is any information relating to a living, identifiable individual. This may include information such as your name, email address, telephone number and other contact details.
Certain types of information are classified as special category data. This may include information relating to health, race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, or sexual orientation.
True North Data Governance and Compliance Consultancy does not collect or process special category data or information relating to criminal convictions and offences.
How We Use Your Information
The following table explains how personal data may be used across our business operations, the categories of information involved, and the lawful basis relied upon under the UK General Data Protection Regulation (UK GDPR).
| Purpose | Personal Data | Lawful Basis |
|---|---|---|
| Enquiry Responses To contact you regarding an enquiry or respond to questions. | Contact information | Legitimate Interests |
| Customer Service To handle suggestions, issues or complaints. | Contact information, complaint information and other relevant information | Legitimate Interests |
| Data Subject Rights To manage requests relating to your data protection rights. | Contact information and other relevant information | Legal Obligation |
| Service Fulfilment To fulfil contracts and provide agreed services. | Contact information, surveys and opinions | Legitimate Interests |
| Order Processing To process specific orders. | Contact information | Legitimate Interests |
| Financial Transactions To process payments, refunds and associated accounting. | Contact information | Legitimate Interests |
| Analysis and Feedback For statistical analysis, service feedback and case study invitations. | Contact information, surveys and opinions | Legitimate Interests |
| Website Security To protect the security and integrity of our website. | Cookies and website security information | Legitimate Interests |
| Customer Insights To understand customer behaviour and improve service delivery. | Contact information, surveys and opinions | Legitimate Interests |
| Sales and Prospecting To contact potential business leads regarding our services. | Contact information | Legitimate Interests |
| Marketing Activity To send newsletters, blogs and other relevant communications. | Contact information | Legitimate Interests |
| Marketing Analytics To use cookies for website analytics and marketing purposes. | Website and cookie information | Consent |
| Business Outreach To contact business contacts regarding white papers, toolkits or other assistance. | Contact information | Legitimate Interests |
Data Security and Storage
Your personal data is stored securely in both electronic and hard-copy formats where appropriate.
We have appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised manner, altered or disclosed.
We primarily store personal data within the United Kingdom and the European Economic Area (EEA).
Where personal data is transferred outside these regions, we will ensure that appropriate safeguards are in place to protect your rights and the security of your information.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting or reporting requirements.
Financial and contractual records will typically be retained for six years in order to comply with applicable UK tax and accounting requirements.
Personal data relating to prospective clients will normally be retained for two years from our last contact with you, after which it will be deleted or anonymised where appropriate.
Personal data relating to clients will normally be retained for six years from the end of the financial year in which you cease to be a customer.
There may be circumstances where we need to retain information for longer, including where this is necessary to establish, exercise or defend legal claims.
When personal data is no longer required, it will be securely deleted or anonymised.
Sharing Your Data
We do not sell or rent your personal data to third parties.
We may share your information with trusted service providers who process information on our behalf, such as IT hosting providers, payment providers and accountancy services.
Where these organisations act as our Data Processors, they are required to handle personal data securely and in accordance with applicable data protection requirements.
We may disclose your personal data to:
-
Financial Institutions:
Banks and other financial organisations where necessary to process transactions and maintain financial records. -
Payment Services:
Third-party providers used to facilitate secure payments and process refunds. -
Authorised Service Providers:
Third-party suppliers acting as Data Processors, including IT and hosting providers. -
Regulatory and Tax Authorities:
Government departments and regulatory authorities where disclosure is required by law, including relevant tax authorities. -
Legal and Judicial Authorities:
Law enforcement agencies, courts and other legal or judicial bodies where disclosure is required by law or necessary to establish, exercise or defend legal rights.
Your Legal Rights
Under data protection law, you have a number of rights in relation to your personal data.
Depending on the circumstances, these may include:
-
Right of Access:
You can request a copy of the personal data we hold about you. -
Right to Rectification:
You can ask us to correct personal data that is inaccurate or incomplete. -
Right to Erasure:
In certain circumstances, you can ask us to delete your personal data. -
Right to Object:
You may object to certain types of processing, particularly the use of your personal data for direct marketing. -
Right to Restriction:
In certain circumstances, you may ask us to restrict the way we process your personal data.
It is important that the personal data we hold about you is accurate and current. Please let us know if your information changes.
We may need to verify your identity before completing a request relating to your data protection rights.
Automated Decision-Making
True North Data Governance and Compliance Consultancy does not use automated decision-making.
Updates to this Privacy Notice
Last updated: 13 January 2026
We may update this Privacy Notice from time to time.
Where changes are made, we will publish the updated Privacy Notice. Where a change is significant, we may also contact you directly to notify you of the update where appropriate.
How to Complain
If you have concerns about how we handle your personal data, please contact us first so that we have an opportunity to investigate and resolve the issue.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.
Company Details
True North Data Governance and Compliance Consultancy Ltd
Registered in England at:
Lytchett House
13 Freeland Park
Wareham Road
Poole
Dorset
BH16 6FA
Company Registration Number: 16972548
VAT Registration Number: GB511626618