Privacy Policy | Chapter Five Consulting

About this privacy policy

Chapter Five Consulting is a business transformation consultancy. We deliver large scale change programmes for enterprise clients, including human resources and payroll transformation.

This policy explains what personal data we collect, why we hold it, who we share it with, how long we keep it and what rights you have over it. It applies to everyone whose personal data we handle, including:

Visitors to our website
People who work for our clients and prospective clients, and their representatives
Our suppliers, contractors and professional advisers
Our own people, including employees and contractors

Personal data belonging to a client's employees that reaches us during an engagement is covered by section 5 and by the agreement we hold with that client.

Nothing in this policy is legal advice, and nothing in it limits the rights given to you by law.

Who we are and how to contact us

Chapter 5 Consulting Ltd trading as Chapter Five Consulting is a private limited company incorporated in the United Kingdom of Great Britain and Northern Ireland (company number: 14151375) with its registered office at 3 Bucklands Wharf, Kingston Upon Thames, Thameside, KT1 1TF.

Chapter Five Consulting is registered with the Information Commissioner's Office under registration reference ZC177422.

The law that governs our processing is the United Kingdom General Data Protection Regulation (GDPR) and the Data Protection Act 2018. The Information Commissioner's Office is our supervisory authority.

The Managing Director is accountable for data protection at Chapter Five Consulting. Send any question about this policy, any request about your personal data, or any concern about how we have handled it to dpo@chapterfiveconsulting.com

The personal data we collect and why

We collect only the personal data we need for the purpose it is collected for. The table below sets out each purpose, the data involved and the lawful basis we rely on.

Business development and client contact: Name, job title, work email address, work telephone number and the content of our correspondence. Collected from you, from the organisation you work for, or from professional sources such as your public professional profile.Lawful basis: legitimate interests, being our interest in developing and maintaining business relationships.
Delivering an engagement: Name, job title, contact details, signature and the content of correspondence for the people we work with at a client.Lawful basis: contract, or legitimate interests where we hold no contract with you personally.
Contracts, invoicing and payment: Organisation name, contact name, contact details, bank and payment details, and financial information.Lawful basis: contract, and legal obligation for the accounting and tax records we are required to keep.
Suppliers, contractors and advisers: Name, contact details, organisation details and payment details.Lawful basis: contract, and legitimate interests where we hold no contract with you personally.
Our own people: Employment and contractor records, timesheets, training records, and the personal contact details we hold so that we can reach people during an incident.Lawful basis: contract, and legal obligation for payroll, tax and employment records.
Security of our systems: Records of activity on the systems we operate, including sign in and access records.Lawful basis: legitimate interests, being our interest in keeping our own and our clients' information secure.

Where we rely on legitimate interests, we have satisfied ourselves that our interest does not override your rights. You can object to that processing at any time using the contact address above.

We use consent rarely. Where we do rely on it, we ask for it clearly, we record it, and you can withdraw it as easily as you gave it.

Chapter Five Consulting makes no automated decisions about individuals and carries out no profiling.

Visitors to our website

We use Google Analytics to understand how our website is used. Google Analytics sets cookies on your device and collects information about your visit, including the pages you view, how long you spend on them, the site or search that brought you to us, your approximate location, and your device, browser and operating system. We use this to understand which parts of the site are useful and to improve it. We do not use it to identify you, and we do not combine it with any other data we hold about you.

Google LLC acts as our processor for this data. Google's own privacy information explains how it handles data collected through Analytics.

Google Analytics data is retained for 14 months.

Personal data we handle for our clients

A transformation programme, particularly one involving human resources or payroll, can require access to, or the processing of, personal data about a client's employees. This can include employee records, salary information and organisational data, including in test extracts, and it can include special category data such as health information.

Four things govern how we handle that data.

We ask for the minimum the engagement needs. Where a sample will do the work, we ask for a sample rather than a full extract.
Where we hold the data on a client's instructions, we process it only on those instructions, and we apply the client's data protection terms where they are stricter than this policy.
Where we process data on behalf of the client, this is done on client infrastructure. The data is never held on our machines or servers.
Where you are an employee of one of our clients and you want to exercise a right over that data, we pass your request to that client without delay. The client decides how it is answered, because the data is theirs.

Who we share personal data with

We share personal data only where there is a reason to, and we require the organisations we share it with to protect it.

Microsoft: Our main technology supplier, providing the email, document storage and collaboration services we run the firm on.
Our accountants: Hold staff and payment data for accounting and payroll purposes.
Professional advisers and banks: Where a transaction, a contract or a legal matter requires it.
Clients: Where an engagement requires it and the agreement with that client allows it.

Supplier arrangements are recorded in our Approved Supplier List, and the security terms we require are set out in our Supplier Information Security Agreement. Where a supplier handles personal data, the agreement covers what they may do with it, how long they keep it and what happens to it when the arrangement ends.

We do not sell personal data, and we do not share it with third parties for their own marketing.

Transfers outside the United Kingdom

Chapter Five Consulting is a UK based business which means that personal data is not transferred to, stored in, or processed at, a destination outside the United Kingdom ('UK') and/or the European Economic Area ('EEA').

If we transfer personal data to countries outside of the UK or EEA, we are required to comply with all applicable legal requirements and ensure all necessary safeguards are in place to protect your personal data, including your rights and the ability to exercise those rights.

For personal data transfers from the UK or EEA to another country without an Adequacy Decision, we will ensure that:

an appropriate data processing agreement (including the relevant Standard Contractual Clauses) is in place and have established a means for data subjects to obtain a copy of these, and
we have implemented appropriate technical and organisational measures.

How we protect your personal data

Personal data is protected by the controls set out across our information security management system, which covers every person, system, location and supplier in the firm. Those controls include:

Access on a need to know basis, under our Access Control Policy
Encryption of information, under our Cryptographic Policy
Anti-malware and network controls, under our Anti-Malware Policy and Network Security Policy
Security training for our people, and the same obligations on anyone working under contract
Assessment of new services, tools and engagements before personal data is involved in them

If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we notify the Information Commissioner's Office within 72 hours of becoming aware of it, and we tell the people affected where the risk to them is high. Where the data is held on a client's instructions, we tell that client without undue delay and the client decides what is reported.

How long we keep personal data

We keep personal data only as long as it is needed for the purpose it was collected for, including any period we are required to keep it for accounting, tax or employment purposes. Where we hold data on a client's instructions, we keep it for the period the client sets, and at the end of the engagement we return it or destroy it as the agreement requires.

If you want to learn more about our specific retention periods for your personal data, you may contact us at dpo@chapterfiveconsulting.com

Your rights

You have the following rights over the personal data we hold about you. To exercise any of them, contact us at dpo@chapterfiveconsulting.com

To be informed: To know what we do with your personal data. This policy is how we tell you.
Of access: To receive a copy of the personal data we hold about you.
To rectification: To have inaccurate or incomplete data corrected.
To erasure: To have data deleted where we no longer need it and no obligation requires us to keep it.
To restrict processing: To have us hold data without using it, usually while a question about it is resolved.
To data portability: To receive data in a commonly used, machine readable format, where we process it by consent or under a contract and by automated means.
To object: To object to processing we carry out under legitimate interests.
To withdraw consent: To withdraw consent at any time, where consent is the basis we rely on.

We may ask you to confirm your identity before we act on a request. We respond within one month. If a request is complex and we need longer, we tell you within that month and explain why.

These rights do not apply to personal data we hold on a client's instructions. Section 5 explains how we handle a request about that data.

Raising a concern

If you are unhappy with how we have handled your personal data, tell us first at dpo@chapterfiveconsulting.com. We would rather put something right than have you go elsewhere to get it put right.

You also have the right to complain to the Information Commissioner's Office, which is the United Kingdom regulator for data protection. Its guidance and complaints process are at ico.org.uk. Complaining to us first does not affect that right.

Changes to this policy

This policy is reviewed annually, and sooner where something changes that affects it.