Privacy Policy

This Privacy Notice explains how EMC uses personal data.

Data Controller: Neil Edwards

Evolution Management Consultancy Lt

Why we collect your data:

We collect and process data for the following reasons:

• To deliver consultancy services

• To communicate with clients and stakeholders

• To manage projects, appointments, and reporting

• To comply with legal obligations

Legal basis for processing:

We rely on one or more of the following legal bases:

• Contractual necessity

• Legal obligation

• Legitimate interest

• Consent (where applicable)

Data retention:

Personal data is retained only as long as necessary for its original purpose or as required by

law. Project-related data is usually retained for up to 6 years for audit and compliance

reasons.

Your rights:

Under UK GDPR, you have rights including:

• Access to your data

• Correction of inaccurate data

• Erasure (“right to be forgotten”)

• Restriction or objection to processing

• Data portability

To exercise any of these rights, please contact: [Insert contact email]

Third Parties:

We do not sell or share personal data with third parties except where required for service

delivery (e.g., secure file sharing with consultants) or to meet legal requirements.

Training and Awareness

All EMC staff and subcontractors are expected to complete annual training in cyber security

and data protection. New staff must be trained during onboarding.

Breach Management and Reporting

Any member of staff who suspects a data breach must report it without delay. The breach

will be recorded and assessed by the Data Protection Lead. Notifiable breaches will be

reported to the ICO and, where required, to the affected data subjects.

Policy Review

This policy is reviewed annually or when significant changes occur in data protection law,

cyber risk landscape, or internal systems.

Signed: Neil Edwards 12/07/25