About us

CGPM Consulting LLP gathers and processes your personal information in accordance with this privacy notice and in compliance with the relevant data protection Regulation and law. This notice provides you with the necessary information regarding your rights and obligations, and explains how, why and when we collect and process your personal data.

Our registered address is:

CGPM Consulting LLP
40 Gilmerton Place
Edinburgh
EH17 8TP

We are a Company registered in Scotland, registration number SO301891 and are registered with the Information Commissioner’s Office and listed on the Register of Data Controllers under registration number Z1349036; we act as a Data Controller and Data Processor. Our Data Protection Lead is Linda Kean and she can be contacted at the above address.  

Information we process

CGPM takes your privacy very seriously and will never disclose, share or sell your data without your consent, or unless required to do so by law. We only retain your data for as long as is necessary and for the purposes specified in this notice. Where you have consented to us contacting you with publicity or marketing information, you are free to withdraw consent at any time.

The purposes and reasons for collecting and processing your personal data include:

• We have a business relationship with you;
• You have expressed an interest in the work we do;
• We are processing a client's data for which they have a legal basis for processing.

Data we collect

The data we collect will vary according to the relationship we have with you but may include:

Legal basis of processing

• Where we are engaged by a client to undertake an assignment data is processed on the basis of fulfilling a legal obligation;
• Network contacts are processed on the basis of having received consent, this consent may take the form of electronic confirmation, receipt of an email by us or the giving of a business card;
• Potential clients information is obtained from the public domain, passed to us by a regulatory body or a professional adviser acting under a contract to engage or seek an engagement from us.

Your rights

You have the right to access any personal information that CGPM processes about you and to request information about:

• What personal data we hold about you;
• The purposes of the processing;
• The categories of personal data concerned held;
• The recipients to whom the personal data has/will be disclosed;
• How long we intend to store your personal data for;
• If we did not collect the data directly from you, information about the source.

If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to update/correct it as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified. You also have the right to request erasure of your personal data or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Sharing and disclosing your personal information

We may disclose your data to our affiliated organisations and subsidiaries, and to service providers who render services to us or you on our behalf (all of which are contractually obligated to act only on our instructions and in accordance with applicable laws, including GDPR). We also may disclose your information if required by law, requested by law enforcement authorities or to enforce our legal rights, such as pursuant to a subpoena or to HMRC when you claim Gift Aid.

We may share your information in connection with a cessation or reorganisation of CGPM, but in any such case, the terms of this Policy will continue to apply. 

Our service providers include:

• Associates – we obtain services of Associates who work for us on assignments;
• Communication providers – to assist us with the processing and delivery of email, bulk email and other communications;
• Information Technology – services are supported by an outsource IT provider and we use various IT systems to manage our data;
• Legal services – occasionally it is necessary to share data about specific individuals to ensure that their or our needs are properly addressed or protected; and
• Credit reference agency - when conducting Anti-Money Laundering checks, as required by law when taking on new clients, we use the services of a credit reference agency (see https://www.callcredit.co.uk/legal-information/bureau-privacy-notice)

Safeguarding Measures

We take your privacy seriously and we take every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place.

Consequences of Not Providing Your Data

You are not obligated to provide your personal information to us however, as this information is required for us to provide you with our services/deliver your products/legitimate interests, we will not be able to offer some/all of our products or services without it.

• The purposes of the processing;
• The categories of personal data concerned;
• The recipients to whom the personal data has/will be disclosed;
• How long we intend to store your personal data for;
• If we did not collect the data directly from you, information about the source.

If you believe that we hold any incomplete or inaccurate data about you, you have the right to ask us to correct and/or complete the information and we will strive to update/correct it as quickly as possible; unless there is a valid reason for not doing so, at which point you will be notified.

You also have the right to request erasure of your personal data or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Consequences of Not Providing Your Data 

You are not obligated to provide your personal information to us however, as this information is required for us to provide you with our services/deliver your products/legitimate interests, we will not be able to offer some/all of our products or services without it.  

How Long We Keep Your Data 

We only ever retain personal information for as long as is necessary and we have strict review and retention policies in place to meet these obligations. The length of time we keep your data for varies depending on your relationship with us. Typically, this will be one of the following: 

Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent.

Special Categories Data

Where we collect sensitive personal data, we will only request the information required for the specified purpose and always ask for your explicit consent through a signature. You can modify or remove consent at any time, which we will act on immediately, unless there is a legitimate interest or legal reason for not doing so.  

Lodging a complaint 

CGPM only processes your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you may lodge a complaint in writing or by telephone. You also have the right to lodge a complaint with the supervisory authority.