Data Protection Policy

This policy sets out the approach of Kingsbury Consulting Ltd (Companies House registration number: 16148652) to the collection, handling, storage, and protection of personal data. It applies to all personal data processed by or on behalf of the company, regardless of the format in which it is held.

This policy applies to all directors, employees, contractors, and virtual assistants acting on behalf of Kingsbury Consulting Ltd. Compliance with this policy is a condition of engagement for all personnel.

We are committed to handling personal data in accordance with UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025. In practice, this means we:

Process data lawfully, fairly, and transparently. We are clear about why we collect data and what we do with it. We do not use data in ways that people would not reasonably expect.

Collect only what we need. We do not collect personal data beyond what is necessary for the specific purpose for which it is collected.

Keep data accurate and up to date. We take reasonable steps to ensure that data held about individuals is correct and current.

Retain data only as long as necessary. We apply defined retention periods to all categories of personal data and delete or anonymise data once those periods have elapsed. Retention periods are set out in our Privacy Policy.

Protect data against unauthorised access, loss, or damage. We apply appropriate technical and organisational measures to keep personal data secure.

Respect individual rights. We respond promptly to requests from individuals exercising their data protection rights and do not place unnecessary barriers in the way of those requests.

Data Controller
Kingsbury Consulting Ltd is the data controller for all personal data collected through our website, assessment tool, and client engagements. Michael Guy, as director, holds ultimate responsibility for data protection compliance.

Contractors and Virtual Assistants
Any contractor or virtual assistant who accesses personal data as part of their work is a data processor acting on our behalf. All such individuals are required to handle data only in accordance with our documented instructions, to maintain confidentiality, and to report any suspected data security incidents immediately.

Clients
Where we access personal data belonging to a client's service users, donors, or staff as part of a consulting engagement, we act as a data processor on behalf of the client. In such cases, our engagement agreement will include appropriate data processing terms.

We identify and document a lawful basis for each category of personal data we process. The bases we rely on are:

Legitimate interests - for processing assessment submissions, enquiries, and prospect records, where we have determined that our legitimate business interest is not overridden by the individual's rights and interests.

Contract performance - for processing data necessary to deliver our services to clients and fulfil our contractual obligations.

Legal obligation - for processing data required to comply with legal requirements, such as financial record-keeping obligations.

We take the security of personal data seriously. Our technical and organisational measures include:

All systems used to store personal data (Airtable, HubSpot, Google Workspace) are accessed via secure, unique credentials with multi-factor authentication enabled where available. Access is limited to individuals who need it to perform their role.

We do not store personal data in unencrypted documents or on personal devices without appropriate security controls.

Third-party processors are selected with care and are required to demonstrate adequate security standards. We review our processor relationships periodically.

Client data shared with us during engagements is stored only in designated, access-controlled systems and is not retained beyond the defined retention period.

In the event of a suspected or confirmed personal data breach, we will:

Contain the breach as quickly as possible, including revoking access to affected systems where necessary.

Assess the likely risk to individuals whose data is involved, considering the nature of the data, the number of people affected, and the likely consequences.

Report the breach to the ICO within 72 hours of becoming aware of it, where the breach is likely to result in a risk to individuals' rights and freedoms.

Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

Document the breach, our assessment, and any steps taken, regardless of whether notification is required.

Any contractor or staff member who becomes aware of a suspected breach must report it to Michael Guy immediately at michael@kingsbury.consulting.

We take individual rights requests seriously and treat them as a priority. On receipt of a valid request, we will:

Acknowledge the request within five working days.

Respond fully within one calendar month, or inform the individual if we require an extension of up to two further months for complex requests.

Not charge a fee for requests unless they are manifestly unfounded or excessive.

All rights requests should be directed to michael@kingsbury.consulting.

We maintain a record of all third-party processors used in the course of our business. Before engaging a new processor, we assess their data protection practices and ensure appropriate contractual terms are in place. A summary of our current processors is available in our Privacy Policy.

This policy is reviewed at least annually, and whenever there is a material change to our data processing activities, our technology stack, or the applicable legal framework. The current version supersedes all previous versions.

Questions about this policy should be directed to Michael Guy at michael@kingsbury.consulting.