Datagrouse Ltd – Privacy & Data Policy
1. Our role and the data we hold
Datagrouse Ltd (company no. 17437566) acts primarily as a Data Controller for standard business-to-business (B2B) administrative data. We collect and process:
Contact Information: Names, business email addresses, and phone numbers of our client points of contact.
Financial Information: Billing addresses and payment records required for invoicing.
Analytics Datasets (Exclusion): All survey data, datasets, and information provided to us for clustering, analysis, or dashboard creation must be fully anonymised by the Client prior to transfer. Fully anonymised data falls outside the scope of UK GDPR. We do not knowingly host, process, or analyse personal data within our mathematical models or algorithms.
2. Lawful Basis for Processing
We process B2B contact and financial data under the following lawful bases:
Performance of a Contract: To fulfill our obligations under a Statement of Work, deliver services, and process payments.
Legal Obligation: To retain financial and transaction records for six years to comply with HMRC tax and accounting laws.
Legitimate Interests: To manage day-to-day business communications and maintain our professional relationship with you.
3. Data Security and Sharing
We apply appropriate technical and organisational measures to protect your contact and billing information. We do not sell your data. We only share it with trusted third-party infrastructure providers (e.g., our business banking provider, HMRC reporting software, and email hosting) solely for the purpose of operating our consultancy.
4. Your Rights
Under UK data protection law, you have the right to request access to, rectification of, or erasure of your personal data. You also have the right to restrict or object to our processing, and to lodge a complaint directly with the Information Commissioner’s Office (ICO). To exercise these rights, please contact us directly.
Standard Data Processing Terms
While Datagrouse Ltd requires all analytical datasets to be fully anonymised, in the event that a Client inadvertently provides data containing personally identifiable information (making the Client the Data Controller and Datagrouse Ltd the Data Processor), the following statutory terms apply to that specific dataset:
Processing Instructions: We will only process the personal data on your documented written instructions (including the relevant Statement of Work) unless required to do otherwise by UK law.
Confidentiality: We ensure that any personnel authorised to process the personal data have committed themselves to confidentiality.
Security: We will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
Sub-processors: We will not engage another processor for the client dataset without your prior specific or general written authorisation.
Assistance: We will assist you, at your cost, in responding to any requests from individuals exercising their data subject rights, and in ensuring compliance with your obligations regarding security and data breaches.
Deletion: Upon termination of the Statement of Work, we will delete or return all personal data to you, unless UK law requires continuous storage.
Compliance: We will make available to you all information necessary to demonstrate compliance with these obligations.