Privacy Policy

This policy explains what happens to personal information when you use this website, make an enquiry, or engage Vader Barclay Consulting. It applies to everyone we deal with: prospective clients, clients, suppliers and visitors to this site.

1. Who we are

Vader Barclay Consulting (“we”, “us”, “our”) provides management consulting, management accountancy and strategic marketing advisory services. For the purposes of UK data protection law we are the data controller for the personal data described in this policy.

You can reach us about anything in this policy at contact@vaderbarclay.com.

To be completed before publication

Our registered company name, company number, registered office address and, where applicable, our ICO registration number will be stated here. Please ask us for these details in the meantime and we will supply them.

2. What personal data we collect

We collect only what we need. In practice that falls into four groups.

Information you give us

Your name, business name, email address and, if you choose to give it, your telephone number.
The content of your enquiry or message, and of subsequent correspondence.
Information you share with us during an engagement, which may include commercial and financial information about your business and, incidentally, information about your employees.

Information we collect automatically

Basic technical information when you visit this site: IP address, browser type, device type, the pages you viewed and the site you arrived from. This is standard server logging.
Analytics information, but only where you have consented to it. See cookies below.

Information from third parties

Publicly available business information, such as filings at Companies House, where we are assessing a potential engagement or carrying out conflict checks.
Information from a person who has referred you to us, where they have told you they were doing so.

What we do not collect

We do not knowingly collect special category data (health, ethnicity, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation) and we ask you not to send it to us.
We do not take payment card details through this website.

3. Why we use it, and our lawful basis

Under UK GDPR we must have a lawful basis for each use of personal data. Ours are set out below.

What we do	Why	Lawful basis
Reply to your enquiry	So we can answer the question you asked	Legitimate interests: responding to a request you made, and your consent given on the enquiry form
Prepare a proposal	To scope and price work you have asked about	Steps taken at your request prior to entering a contract
Deliver an engagement	To do the work you have engaged us to do	Performance of a contract
Keep records of advice given	Professional prudence, and to answer later questions about what was advised and when	Legitimate interests, and legal obligation where retention periods apply
Invoicing and accounting	To be paid, and to meet our own statutory obligations	Legal obligation
Conflict checks	To ensure we can act for you properly	Legitimate interests
Send the insight letter	To tell subscribers when we publish something	Consent
Site analytics	To understand how the site is used and improve it	Consent
Site security and server logs	To keep the site available and protect against abuse	Legitimate interests

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights and freedoms, and we have concluded it is not. You may object to that processing at any time. See your rights.

We do not use personal data for automated decision-making or profiling.

Marketing

We do not add enquirers to a mailing list. If you contact us about work and decide not to proceed, you will not receive marketing from us and you will not hear from us again unless you write.

We operate one optional list: a short letter announcing new insight articles, which you can join from the sidebar of any article. It works on consent alone. You are added only if you tick the box and submit that form, and nothing else adds you to it. It carries an unsubscribe link in every message, we send nothing else to it, and unsubscribing deletes the address rather than suppressing it. We never pass the list to anyone, and subscribing does not put you into a sales process.

We do not sell personal data, and we do not share it for anyone else’s marketing purposes. We share it only in these circumstances:

Service providers who act on our instructions. Our email, file storage, website hosting and accounting providers. Each is bound by a written contract requiring them to protect the data and to use it only as we instruct.
Your own advisers, where you have asked us to work with them, for example your accountant, solicitor or bank.
Professional advisers of our own, such as our accountants, insurers or lawyers, where genuinely necessary.
Regulators, courts or law enforcement, where we are required by law to disclose information.

Everyone at Vader Barclay is bound by confidentiality obligations, and access to client information within the firm is limited to the people working on your engagement.

5. How long we keep it

We do not keep personal data indefinitely.

Enquiries that do not become engagements: Kept for up to 12 months from the last contact, then deleted. We keep them this long because people frequently return to a conversation months later.
Client engagement records: Kept for 6 years after the engagement ends. This reflects the period in which a question about the advice given could reasonably arise.
Accounting and tax records: Kept for 6 years after the end of the accounting period, as required by law.
Newsletter subscribers: Kept until you unsubscribe, then deleted. We also keep a record of when consent was given and to what wording, which is what makes the consent auditable.
Website server logs: Kept for up to 90 days.
Analytics data: Kept for up to 14 months, where consent has been given.

At the end of these periods information is securely deleted or anonymised. You can ask us to delete information sooner. See below.

6. How we protect it

We take appropriate technical and organisational measures to protect personal data, including:

Encryption in transit: this site is served over HTTPS and our email is encrypted in transit.
Access limited to the people who need it for your engagement.
Multi-factor authentication on the systems that hold client information.
Reputable providers for hosting, email and file storage, each under a written data processing agreement.
Confidentiality obligations binding on everyone who works with us.

No system is perfectly secure, and we would not claim otherwise. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours and tell you without undue delay where the risk is high.

7. International transfers

Our work is carried out in the United Kingdom. Some of the service providers we rely on, for email and file storage for example, may process data outside the UK. Where that happens, we ensure an appropriate safeguard is in place, such as UK adequacy regulations or the International Data Transfer Agreement. You may ask us which providers are involved and what safeguards apply.

8. Your rights

Under UK data protection law you have the following rights. All of them are free to exercise, and we will respond within one month.

Access: To be told whether we hold personal data about you and to receive a copy of it.
Rectification: To have inaccurate data corrected and incomplete data completed.
Erasure: To have data deleted, where we no longer have a good reason to keep it.
Restriction: To have us pause our use of your data while a dispute about it is resolved.
Portability: To receive data you gave us in a structured, machine-readable format, or have it sent to someone else.
Objection: To object to processing we carry out on the basis of legitimate interests.
Withdraw consent: Where we rely on consent, to withdraw it at any time. This does not affect anything done before you withdrew it.

To exercise any of these, write to contact@vaderbarclay.com. We may ask you to confirm your identity before we act, which is a protection for you rather than an obstacle.

If you are unhappy with how we have handled your data, please tell us first. We would rather put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

9. Cookies

This website sets no cookies of its own and loads no third-party trackers, advertising pixels or social media scripts. There are no fonts, scripts or images loaded from other domains. Full detail is on the cookie policy page.

Should analytics be introduced in future, it would be loaded only after you had given consent, and the cookie policy would be updated before it went live.

10. Children

This site and our services are directed at businesses and are not intended for anyone under 18. We do not knowingly collect personal data relating to children. If you believe we have done so, please tell us and we will delete it.

11. Changes to this policy

We will update this policy when our practices change or the law requires it. The version number and date at the top of the page will change, and material changes affecting existing clients will be notified directly rather than posted quietly.

12. Contacting us

For any question about this policy, about how we handle your information, or to exercise any of your rights:

Email:contact@vaderbarclay.com
Subject line: Data protection enquiry

We have not appointed a Data Protection Officer, as we are not required to. Enquiries are handled by a senior member of the firm.

Note on this document

This policy has been drafted to reflect how the firm actually operates and to align with the UK GDPR and the Data Protection Act 2018. It is not legal advice, and it should be reviewed by a qualified solicitor and completed with the firm’s registered details before publication.