Privacy Notice

This Privacy Notice is issued by Britannia Consultancy Services Ltd (the “Company”, “we”, “us” or “our”). It explains how we collect, use, store, share and otherwise process personal data in the course of our business, and the rights available to individuals under United Kingdom data protection law.

This Notice is intended to satisfy the transparency duties in Articles 12, 13 and 14 of the United Kingdom General Data Protection Regulation (the “UK GDPR”), as supplemented by the Data Protection Act 2018 and amended by the Data (Use and Access) Act 2025. It also addresses our obligations under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”).

This document is a public facing notice. It is not a data processing agreement, a record of processing activities, a legitimate interests assessment or a transfer risk assessment. Those documents are maintained separately where the law requires them.

1. Who we are

The data controller responsible for the processing described in this Notice is:

• Name: Britannia Consultancy Services Ltd
• Company number: 17455909
• Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
• Country of establishment: England and Wales

The controller is the Company, not any individual. Because we process a substantial volume of business contact data in the course of prospecting and campaign work, the Company has specified Julian Britain, Director, as the individual responsible for data protection. Enquiries, rights requests and complaints should be marked for his attention.

Privacy and data protection enquiries should be sent in writing to the registered office, marked for the attention of Julian Britain, or by email to info@britanniaconsultancyservice.com. Mark the subject Data protection so the request is logged against the statutory time limit.

We are a private limited company carrying on business development, sales consultancy and related professional services. We act as an independent consultancy. We are not an employment business and we are not an employment agency within the meaning of the Employment Agencies Act 1973.

We are not required to appoint a Data Protection Officer under Article 37 of the UK GDPR. Specifying Julian Britain as the responsible individual does not make him a Data Protection Officer and does not make him the controller in his personal capacity.

We are the controller of personal data that we determine the purposes and means of processing. Where we process personal data solely on the documented instructions of a client in circumstances that meet the definition of a processor in Article 4(8) of the UK GDPR, we do so under a written contract. In campaign work we may be a controller of early stage prospecting data held on our own systems, and a processor or a separate controller in respect of data once it has been handed to a client. The capacity in which we act is identified in the relevant engagement terms.

2. The law that applies

The principal legislation and regulatory material governing the processing described in this Notice is as follows.

• the UK GDPR, being Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended
• the Data Protection Act 2018
• the Data (Use and Access) Act 2025, including the amendments to the UK GDPR and the Data Protection Act 2018 brought into force on 5th February 2026 and the direct complaints duty in force from 19th June 2026
• the Privacy and Electronic Communications (EC Directive) Regulations 2003, as amended, including by the Data (Use and Access) Act 2025
• the Human Rights Act 1998, so far as Article 8 ECHR is engaged
• guidance published by the Information Commissioner’s Office

Where we process personal data of individuals in the European Economic Area in circumstances that attract the extra territorial application of the EU GDPR, we will comply with that regime in addition to United Kingdom law. We do not, at the date of this Notice, maintain an Article 27 EU representative because we do not carry on processing that requires one. If that position changes we will update this Notice.

3. Who this Notice covers

This Notice applies to living individuals whose personal data we process, including:

• business contacts, directors, partners, owners, procurement staff and other workers of organisations we approach, qualify or introduce in the course of business development and campaign work
• staff and representatives of our clients, introducing consultancies and the organisations on whose campaigns we are engaged
• suppliers, professional advisers, landlords and other commercial counterparties
• individuals who contact us, visit any website we operate, or otherwise deal with us
• applicants for roles or substitution arrangements, and any worker we engage

It does not apply to information that is not personal data. Information that identifies only a company, with no living individual attached to it, falls outside the UK GDPR. In practice most B2B contact records include a named individual or a direct dial or personal corporate email address and are therefore personal data.

We do not knowingly offer services to children and we do not target children with marketing. We do not intend to process personal data relating to anyone under 18 years of age.

4. The personal data we process

4.1 Categories of personal data

Depending on the relationship, we may process the following categories.

Identity and contact data

• name, title, job title, role and seniority
• employer or organisation name, department and business address
• business telephone numbers, mobile numbers used for business purposes, and business email addresses
• LinkedIn or other professional profile identifiers that are publicly available

Campaign and relationship data

• notes of calls, meetings, emails and messages
• stage of an opportunity, objections, next steps and qualification information
• records of proposals sent and meetings booked
• preferences as to contact method, timing and opt out
• source of the record and the date it was obtained

Contract and billing data

• engagement terms, statements of work and commission records so far as they identify an individual
• invoices, purchase orders and payment references
• tax identifiers where they relate to a sole trader or partner

Technical and security data

• call recordings or call metadata where a telephone system retains them
• email headers, delivery and bounce information
• IP address, device and log data generated by our systems, including multi factor authentication logs
• CRM audit trails, access logs and change history

Recruitment and engagement data

• curriculum vitae, right to work information and professional qualifications of any worker or substitute we consider engaging

We do not seek to collect special category data within the meaning of Article 9 of the UK GDPR, nor personal data relating to criminal convictions and offences within the meaning of Article 10. If such data is volunteered to us we will delete it unless we have a lawful basis and an additional condition to retain it.

4.2 Sources of personal data

We obtain personal data from the following sources.

• directly from you, including when you speak to us, email us, book a meeting, submit a form or contract with us
• your organisation, where a colleague or employer provides your business contact details so that we can deal with the organisation
• publicly available sources, including Companies House, organisation websites, press releases, professional networking sites used in a business context, and other public registers
• third party B2B data suppliers, list brokers and enrichment tools, where we have first satisfied ourselves that the supplier obtained the data lawfully and that we can comply with Article 14
• clients, introducing consultancies and campaign principals, where they provide contact details for an agreed campaign
• referrals from other professional contacts

Where personal data has not been obtained from you, Article 14 of the UK GDPR requires us to provide the information in this Notice within a reasonable period, and at the latest within one month after we obtain the data, or at the time of our first communication with you if that is earlier. In B2B prospecting that information is ordinarily given in the first email or at the outset of the first call, together with a link to this Notice and an explanation of the source of the data.

5. Purposes and lawful bases

We process personal data only where a lawful basis in Article 6 of the UK GDPR applies. For B2B prospecting and related commercial activity we rely on ordinary legitimate interests under Article 6(1)(f). We do not use the separate recognised legitimate interests route introduced by the Data (Use and Access) Act 2025 for the processing described in this Notice.

The purposes and the corresponding lawful bases are as follows.

5.1 Business development and B2B prospecting

Purpose: to identify organisations that may have a legitimate commercial interest in products or services we represent, to research the correct professional contact, to make an initial approach by telephone, email or professional networking message, to qualify interest, to book introductions and to maintain an early stage pipeline on systems we control.

Lawful basis: legitimate interests, Article 6(1)(f) of the UK GDPR. Our legitimate interest is the pursuit of our commercial business as an independent consultancy and the legitimate commercial interests of the clients on whose campaigns we work. We have assessed that the processing is necessary for that interest, that it is reasonably aligned with the reasonable expectations of a person contacted in a professional capacity about a product or service relevant to their role, and that the interest is not overridden by the rights of the individual, particularly where an easy opt out is offered and honoured.

A legitimate interests assessment is held on our files and reviewed when the nature of a campaign changes.

5.2 Performing a contract and taking pre contractual steps

Purpose: to enter into and perform contracts with clients, introducing consultancies, suppliers and, where relevant, the individuals who contract with us in their own name; to invoice; to administer commission; and to manage the relationship.

Lawful basis: Article 6(1)(b) of the UK GDPR where the individual is a party to the contract or where the processing is necessary to take steps at the request of the individual before entering into a contract. Where the individual is a staff member of a corporate client rather than a contracting party, the lawful basis is ordinarily Article 6(1)(f).

5.3 Handover of a qualified opportunity

Purpose: once a prospect has reached the agreed stage of being ready to proceed towards a purchase or contract, to transfer the relevant contact and opportunity information to the client or campaign principal so that the customer relationship can sit with that organisation.

Lawful basis: Article 6(1)(f), being our legitimate interest and that of the client in completing an introduction that the prospect has indicated a willingness to progress. Where the handover is a contractual obligation we owe to the client, Article 6(1)(b) may also apply as between us and the client, but it does not by itself authorise the disclosure of a third party’s personal data. The disclosure to the client is therefore assessed under Article 6(1)(f) and, where required, recorded in our record of processing.

5.4 Legal obligation

Purpose: to comply with obligations under the Companies Act 2006, tax legislation including the Taxes Management Act 1970 and associated HMRC requirements, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 where they apply, court orders, and data protection law itself including the duty to respond to rights requests and to maintain a complaints procedure.

Lawful basis: Article 6(1)(c) of the UK GDPR.

5.5 Operating, securing and improving our systems

Purpose: to run our email, CRM, VoIP, storage and related systems; to apply access controls, multi factor authentication and audit trails; to detect and prevent misuse, fraud and security incidents; and to keep backups.

Lawful basis: Article 6(1)(f), being our interest in running a secure and reliable business infrastructure, and Article 6(1)(c) where security measures are necessary to comply with Article 32 of the UK GDPR.

5.6 Establishing, exercising or defending legal claims

Purpose: to take legal advice, to keep evidence, and to bring or defend claims, including claims concerning commission, confidentiality, intellectual property and contract.

Lawful basis: Article 6(1)(f).

5.7 Consent

We do not generally rely on consent for B2B prospecting. We will rely on consent, Article 6(1)(a), only where the law requires it or where we choose to do so for a specific activity, for example certain electronic mail marketing to an individual subscriber, the use of non essential cookies, or the recording of a call where consent is the appropriate basis. Consent will be freely given, specific, informed and unambiguous, and as easy to withdraw as it was to give. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Direct marketing and PECR

Business development contact that promotes goods, services or the aims of an organisation to a particular individual is direct marketing. Direct marketing is regulated by PECR in addition to the UK GDPR. Compliance with one regime does not automatically satisfy the other.

6.1 Telephone marketing

We may telephone corporate subscribers about products or services relevant to their organisation. We screen numbers against the Telephone Preference Service and the Corporate Telephone Preference Service where those registers apply to the number and the nature of the call. We do not make live marketing calls to a number registered on the relevant preference service unless the subscriber has notified us that they do not object to our calls.

We do not use automated calling systems for marketing. We do not make marketing calls to a subscriber who has previously notified us that they do not wish to receive such calls from us.

6.2 Electronic mail marketing

PECR regulation 22 restricts unsolicited electronic mail marketing to individual subscribers. Corporate subscribers are treated differently. An email address of the type info@company.co.uk will ordinarily be a corporate subscriber address. An email address that belongs to an individual, including a named mailbox at a company such as jane.smith@company.co.uk, may be an individual subscriber address. We treat named professional mailboxes with care and we do not rely on a blanket assumption that all B2B email is outside regulation 22.

Where regulation 22 applies we will not send unsolicited electronic mail marketing unless the recipient has consented or another PECR exception applies. The soft opt in in regulation 22(3) applies only to existing customers in the circumstances set out in that regulation and is not used by us as a basis for cold B2B prospecting.

Every marketing email we send will identify us, provide contact details, and include a simple means of opting out of further marketing electronic mail from us.

6.3 Professional networking messages

Messages sent through a professional networking platform may constitute electronic mail for PECR purposes and direct marketing for the UK GDPR. We use such platforms in a restrained way, directed at a person’s professional role, and we honour platform and user restrictions.

6.4 Instigator and sender

Where we carry out marketing for a client or campaign principal, PECR treats both the organisation that instigates the marketing and the organisation that makes the call or sends the message as responsible. Separate systems do not remove that responsibility from the instigator. They do allow each party to control the infrastructure it actually operates. Written engagement terms allocate operational responsibility. They do not displace PECR.

6.5 Transparency at the point of contact

When we first contact you we will say who we are, that we are an independent consultancy, the identity of any client or campaign we are supporting where it is fair and accurate to do so, why we are getting in touch, the source of your data if it was not obtained from you, and how you can object. We will not represent ourselves as an employee or internal member of a client’s staff.

6.6 Objection and suppression

You may object to direct marketing at any time. That right is absolute in respect of the marketing itself. We will stop marketing to you and we will record a suppression marker so that we do not contact you again for that purpose. We keep the minimum data needed to honour that objection. Deleting the record entirely would prevent us from knowing that you have objected, and would increase the risk of contacting you again.

7. Use of artificial intelligence and automated tools

We use software tools, including tools that incorporate machine learning or generative artificial intelligence, to assist with research, drafting, summarising, workflow and the organisation of prospecting activity. Those tools support human work. They do not, at the date of this Notice, make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Articles 22A to 22D of the UK GDPR as amended by the Data (Use and Access) Act 2025.

We do not use automated decision making as the sole basis for determining whether an individual or organisation is approached, qualified or introduced. A human reviewer remains responsible for outbound contact and for any handover to a client.

We do not upload client confidential information, special category data or bulk direct marketing files to a public generative artificial intelligence service unless that service is provided under a contract that meets Article 28 where the provider is a processor, or we have otherwise satisfied ourselves as to the lawful basis, the destination of the data and the security of the processing.

Prompts, workflows and models that we have developed independently remain our background materials. Output that is a deliverable under a client contract is handled in accordance with that contract.

8. Who we share personal data with

We disclose personal data only where it is necessary for a purpose set out in this Notice and a lawful basis applies. Recipients fall into the following categories.

8.1 Clients, introducing consultancies and campaign principals

If you are a business contact in an early stage pipeline held on our systems, we do not treat that pipeline as the property of a client merely because we are engaged by that client. We disclose your details to the relevant client or campaign principal when the opportunity has reached the agreed handover stage, or earlier if you ask us to make an introduction, or if you have agreed that the client may be told.

Once handed over, the client or campaign principal will process your data as a controller in its own right under its own privacy information. We encourage you to read that information.

8.2 Service providers who process data for us

We use other organisations to provide:

• customer relationship management and pipeline software
• email hosting, domain and workspace services
• voice over internet protocol, call routing and, where enabled, call recording
• cloud storage, backup and document management
• accounting, invoicing and banking
• information security, multi factor authentication and device management
• professional advisers including solicitors, accountants and insurance brokers

Where a provider processes personal data for us as a processor, we impose a written contract that meets Article 28 of the UK GDPR. We remain responsible for that processing.

8.3 Authorities and legal disclosure

We will disclose personal data if required to do so by law, by a court, by a regulator including the Information Commissioner, by HMRC, or if disclosure is necessary to protect our legal rights, to investigate suspected wrongdoing or to protect the rights of another person.

8.4 Corporate transactions

If we sell, transfer or merge parts of our business or assets, or if we novate a contract to another company in our group or under common control, personal data may be disclosed to the prospective or actual transferee and its advisers under suitable confidentiality terms. A novation of an engagement from an individual contractor to this Company, or from this Company to another entity, does not of itself change the purposes set out in this Notice.

8.5 We do not sell personal data

We do not sell personal data. We do not share personal data with third parties for their own independent marketing except with a lawful basis and, where PECR requires it, any additional permission the law demands.

9. International transfers

Our registered establishment is in the United Kingdom. Some of our service providers host or access data from other countries, including the United States and the European Economic Area.

Where personal data is transferred to a country outside the United Kingdom we will ensure that a lawful transfer mechanism under Chapter V of the UK GDPR is in place. That may include:

• a UK adequacy regulation in respect of the destination country
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Commission standard contractual clauses
• another transfer mechanism approved for use under United Kingdom law, including any mechanism recognised under Article 47B of the UK GDPR

Where a transfer risk assessment is required we assess whether the standard of protection in the destination is not materially lower than the standard under the UK GDPR, with particular attention to the risk of material harm to individuals, in line with the amendments made by the Data (Use and Access) Act 2025.

A transfer within the United Kingdom, or to a country covered by a UK adequacy regulation, is not a restricted transfer.

10. Retention

We keep personal data only for as long as is necessary for the purposes set out in this Notice, including any legal, accounting or reporting requirement. In deciding the period we take account of the volume, nature and sensitivity of the data, the risk of harm from unauthorised use or disclosure, the purposes of the processing and whether those purposes can be achieved by other means, and the applicable legal requirements.

Unless a longer period is required by law or needed for a live claim, our working periods are as follows.

• early stage prospecting records that do not result in a handover or a live opportunity: 12 months from the last meaningful contact, or sooner if you object to marketing and no other purpose applies
• suppression and opt out records: for as long as is necessary to honour the objection, reviewed at least every two years
• records relating to a handed over opportunity or a concluded introduction: six years from the end of the relevant engagement or from the last commission event, reflecting the primary limitation period for contract claims under the Limitation Act 1980
• contracts, invoices and accounting records: six years from the end of the financial year to which they relate, in line with company and tax record keeping practice
• security and access logs: 12 months, unless they form part of an incident investigation
• rights requests and data protection complaints: three years from closure

At the end of the retention period we will delete or irreversibly anonymise the personal data, unless we are legally required to keep it. Backup copies fall out of live systems according to the backup cycle and are then overwritten.

11. Security

Article 32 of the UK GDPR requires us to implement appropriate technical and organisational measures. Taking account of the state of the art, the costs of implementation, the nature of the processing and the risk to individuals, we apply measures that include:

• access controls and unique user credentials
• multi factor authentication where the system supports it
• encryption of portable devices and of data in transit with our principal providers
• current anti malware software and prompt operating system updates
• restricted use of public wireless networks for live campaign work, and use of a virtual private network where appropriate
• need to know access to CRM records
• secure disposal of paper and the deletion of electronic copies when no longer required
• staff and contractor direction on confidentiality and incident reporting

No method of transmission or storage is completely secure. We will notify the Information Commissioner of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals, in accordance with Article 33. Where the breach is likely to result in a high risk to individuals we will inform those individuals in accordance with Article 34.

12. Websites, cookies and similar technologies

If we operate a website, PECR regulation 6 restricts the storage of information, or the gaining of access to information stored, on your device. Strictly necessary storage and access that is required to provide a service you have requested does not require consent. Anonymous, aggregate statistical analytics may fall within the exception introduced by the Data (Use and Access) Act 2025, subject to the conditions of that exception including clear information and a simple means of objecting.

Any cookie that does not fall within an exception will be used only with consent. A separate cookie notice will be published on the website if cookies other than those that are strictly necessary are used. This Privacy Notice should be read with that cookie notice.

Server logs may record IP address, browser type and pages requested for security and diagnostic purposes. The lawful basis is Article 6(1)(f).

13. Your rights

Subject to the conditions and exemptions in the UK GDPR and the Data Protection Act 2018, you have the following rights.

• Right to be informed. This Notice is the principal means by which we discharge that right.
• Right of access. You may request confirmation of whether we process your personal data and a copy of it, together with the information required by Article 15.
• Right to rectification. You may require us to correct inaccurate personal data and to complete incomplete personal data.
• Right to erasure. You may require deletion in the circumstances set out in Article 17, including where the data is no longer necessary or where you object to marketing.
• Right to restrict processing. You may require us to restrict processing in the circumstances set out in Article 18.
• Right to data portability. Where processing is based on consent or on a contract and is carried out by automated means, you may receive the data you provided to us in a structured, commonly used and machine readable format and transmit it to another controller.
• Right to object. You may object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing.
• Rights in relation to automated decision making. You have the safeguards in Articles 22A to 22D where those provisions apply. As stated above, we do not currently take qualifying automated decisions about you.

Send a rights request to info@britanniaconsultancyservice.com or to the registered office. Mark the subject Data protection so the request is logged against the statutory time limit. We will respond within the applicable time period in Article 12 of the UK GDPR as amended. That period is one month, measured from the relevant time, being the latest of receipt of the request, receipt of any identity information we reasonably require, or payment of any fee that is lawfully payable. We may extend the period by two further months where the request is complex or where we have received a number of requests. We will tell you about any extension before the first month expires.

We may refuse a request that is manifestly unfounded or excessive. We may charge a reasonable fee in those circumstances or for further copies. We will tell you if we rely on an exemption.

These rights are not always absolute. Legal obligation, the defence of legal claims, the rights of another person and certain exemptions in Schedules 2 to 4 of the Data Protection Act 2018 may limit what we can do.

14. How to complain to us

From 19th June 2026 a controller must provide a means for an individual to complain directly to the controller about the processing of personal data. That duty sits in the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025.

You may raise a data protection complaint by writing to the registered office or by emailing info@britanniaconsultancyservice.com. Mark the subject Data protection so the request is logged against the statutory time limit. State:

• your name and a contact address
• a description of the processing you are concerned about
• what you would like us to do

We will acknowledge a data protection complaint within 30 days of receipt. We will investigate and we will provide an outcome without undue delay, explaining the steps we have taken or why we consider we have complied with the law.

A data protection complaint is distinct from a commercial or service complaint, although the same facts may give rise to both. Raising a complaint does not affect your right to make a rights request, and making a rights request does not prevent you from complaining.

15. How to complain to the Information Commissioner

You have the right to lodge a complaint with the Information Commissioner’s Office if you believe our processing of your personal data infringes United Kingdom data protection law. You may do so without first complaining to us, although the Commissioner ordinarily expects individuals to raise concerns with the controller where that is reasonable.

Information Commissioner’s Office

• Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Website: ico.org.uk
• Helpline: 0303 123 1113

You also have the right to bring proceedings in the courts of England and Wales, including a claim for compensation for material or non material damage under Article 82 of the UK GDPR and section 168 of the Data Protection Act 2018.

16. Joint controllers and processors

If we determine the purposes and means of processing jointly with another organisation we will put in place the arrangement required by Article 26 of the UK GDPR and we will make the essence of that arrangement available to you on request.

If we act as a processor for a client we will process only on documented instructions, impose confidentiality, implement appropriate security, assist with rights requests and breaches, delete or return personal data at the end of the engagement subject to legal retention, and impose equivalent terms on any sub processor, in accordance with Article 28.

17. Third party websites and platforms

Our correspondence and any website we operate may contain links to other organisations, including clients and professional networking platforms. This Notice does not govern those organisations. We are not responsible for their processing.

18. Changes to this Notice

We may update this Notice from time to time to reflect changes in our processing, in the law or in regulatory guidance. The effective date at the head of the document will change. Where a change is material we will take additional steps to inform individuals that it is reasonable to notify, having regard to Article 12.

The current version will be available on request from the registered office and, if we operate a website, from that website.

19. Governing law

This Notice is issued under the law of England and Wales. Nothing in this Notice creates a contract between us and a person who is merely the subject of processing. Contractual terms, where they exist, are contained in the relevant engagement documents.

20. How to contact us

Britannia Consultancy Services Ltd

Company number 17455909

128 City Road

London

United Kingdom

EC1V 2NX

Email: info@britanniaconsultancyservice.com

For the attention of: Julian Britain, Director specified for data protection

Mark the subject Data protection so the request is logged against the statutory time limit. Please mark written correspondence Data protection so that it is directed promptly to Julian Britain.

Schedule 1: Information we give on first contact where data was not obtained from you

Where we have obtained your business contact details from a source other than you, our first email or the opening of our first call will ordinarily include the following, either in the body of the communication or by a clear link to this Notice.

1. our identity and that we are an independent consultancy
2. the fact that we have obtained your details from a stated source or category of source
3. the purpose of the contact, described in concrete terms
4. the lawful basis, which will ordinarily be legitimate interests
5. the identity of any client or campaign we are supporting, where it is accurate to name them
6. the fact that you may object, and a simple method of doing so
7. a link to, or a copy of, this Notice
8. the fact that you may complain to us and to the Information Commissioner

If the first contact is by telephone we will give the same information in short form and we will send this Notice if you ask for it or if the conversation continues beyond a brief introduction.

Schedule 2: Glossary

In this Notice the following expressions have the following meanings.

“Controller” means the natural or legal person that determines the purposes and means of the processing of personal data, as defined in Article 4(7) of the UK GDPR.

“Personal data” means any information relating to an identified or identifiable living individual, as defined in Article 4(1) of the UK GDPR.

“Processing” means any operation performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, restriction, erasure and destruction.

“Processor” means a natural or legal person that processes personal data on behalf of a controller, as defined in Article 4(8) of the UK GDPR.

“Special category data” means the categories listed in Article 9(1) of the UK GDPR, including data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health, and data concerning a person’s sex life or sexual orientation.

“Direct marketing” means the communication, by whatever means, of advertising or marketing material which is directed to particular individuals, consistent with the definition applied for PECR and the Data Protection Act 2018.

Britannia Consultancy Services Ltd