Data Privacy Policy

Introduction

This Policy tells you what to expect when SOIF Consult collects information about individuals. When we use personal data, we are required to do so in accordance with the Data Protection Act 2018 and the UK GDPR. We are responsible as a ‘controller’ of personal data for the purposes of the Data Protection Act 2018 and the UK GDPR.

We do not meet the criteria for a mandatory appointment of a Data Protection Officer under the United Kingdom General Data Protection Regulation (“UK GDPR”). We have allocated informal responsibility to a person in our business who can deal with any data protection related matters. If you need further information or have any questions or complaints about our privacy notice or privacy practices, please contact us by email at: info@soifconsult.com.  Please mark the subject line, ‘For the attention of the Privacy Manager’.

This policy describes:

• The personal information that we collect
• How we obtain personal information
• How we use personal information
• The basis upon which we use personal information
• How long we keep personal information
• Who we share personal information with
• Which countries we transfer personal information to
• How we protect personal information
• The legal rights of individuals whose personal information we process

The personal information that we collect

Personal information (personal data) means any information relating to an identified or identifiable natural person.

Because of the wide-ranging nature of our work, and the different reasons why we need to use personal information, what we collect is very varied and includes:

• Identity and contact data – including name, date of birth, email address, postal address, telephone numbers, passport details and information provided or collected as part of our client take on or employee recruitment processes and as a result of individuals’ interactions with us in the course of our business
• Financial and transaction data – including bank account details, payment card details and details of payments from and to individuals
• Technical and usage data – including information about how individuals use our website
• Marketing data – including communications with individuals for marketing purposes, individuals’ preferences in receiving marketing from us and information provided to us for the purpose of attending events such as dietary information and accessibility requirements

Information used to provide our services – including information provided to us by or on behalf of our clients or otherwise provided to us or generated by us in the course of providing services to our clients

In particular in order to provide our services, we collect special category data and personal data relating to criminal convictions and offences. Special category data includes personal data which reveals racial or ethnic origin, religious or philosophical beliefs, trade union membership, data concerning health and data concerning a person’s sex life or sexual orientation.

How we obtain personal information

We obtain personal information in different ways, including through:

• Direct contact – individuals may give us their personal information by corresponding with us by post, email or telephone or otherwise.
• Clients – our clients may give us personal information of individuals (for example a client’s employees) to enable us to provide our services
• Third parties or publicly available sources – we may receive personal information of individuals from third parties in connection with the provision of services by us to our clients. We may also receiveinformation from business contact databases or enrichment services which use publicly available information to improve the accuracy and detail of data. We may also receive information from sources such as Companies House, credit reference agencies and suppliers of information that enables us to comply with our anti money laundering, sanctions and other due diligence obligations.

Our website – We use cookies to help the Site work better and provide help in the background to make the process of using the Site easier. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Site may become inaccessible or not function properly.

If you contact us through our website form, we keep a copy of your name, email address, message, IP address and browser details in our website records, so that we can respond to you and keep a record of your enquiry. We review these records regularly and delete them when we no longer need them.

How we use personal information

We use personal information in a variety of ways including:

• To provide our services to our clients
• To continually improve the quality and efficiency of the services we provide
• To promote our services and to manage our relationships with clients, prospective clients and business contacts
• For the purposes of business intelligence to inform the management and development of our services
• For internal training and development purposes
• To meet our legal and regulatory obligations
• To meet our audit and insurance obligations

In our work, we may, where appropriate, use Artificial Intelligence (AI) tools to enhance the quality and efficiency of the advice and services we provide. AI tools may be used when, for example, drafting documents, conducting legal research and analysing data. Additionally, we may utilise AI tools for internal-facing functions, such as administrative organisation and optimising our processes. They may either be AI tools obtained by collaboration with third-party providers or bespoke tools we have built and developed. Where we develop our own AI tools, we may use personal information to train and improve these tools.

We use AI based tools in accordance with our regulatory and legal obligations and where personal or confidential information is processed, where we have assessed that information will remain confidential and secure. We are committed to principles of fair and responsible use of AI within our business.

The basis upon which we use personal information

We will only use personal information (including special category data and data relating to criminal convictions and offences) when the law allows us to. Most commonly, we will use personal data in the following circumstances:

• Where it is necessary for our legitimate interests (or those of a third party such as one of our clients) and the interests and fundamental rights of the individual whose personal information we are using do not override those interests – for example where we act for a client in bringing regulatory proceedings
• Where we need to do so to perform a contract we are about to enter into or have entered into – for example a contract of employment
• Where it is necessary to comply with a legal or regulatory obligation

When we use special category data and data relating to criminal convictions and offences it will normally be when this is necessary for the establishment, exercise or defence of legal claims or where we need to do so as an employer.

Consent to receiving direct marketing communications can be withdrawn at any time, through our website or by sending a mail to info@soifconsult.com.

Toolkit downloads

When you download our Start-up Legal & Compliance Toolkit, we ask for your name and email address, and we keep a record of your consent, your IP address and the date and time of the download. We use these details to provide the toolkit, and our legal basis is your consent.

We will not add you to a marketing list because you downloaded the toolkit. We will only send you marketing emails if you separately sign up and agree to receive them. You can ask us to delete your details at any time by emailing info@soifconsult.com. We keep download records only for as long as we need them for this purpose, and we review them regularly. We do not sell your details, and our website provider processes them on our behalf.

Cookies and similar technologies

Cookies are small files that a website stores on your device. We keep our use of them to a minimum. Our visitor statistics tool is set to a cookie-free mode, so it does not store a cookie on your device.

Our website hosting provider, GoDaddy, may use cookies to measure visits to our website. Our pages also load fonts from Google Fonts and show video thumbnails from YouTube, so Google receives your IP address when you view those pages. If you click through to watch a video, YouTube’s own cookie policy applies. We do not use cookies for advertising.

You can block or delete cookies in your browser settings, and the website will still work.

How long we keep personal information

We will keep personal information in accordance with our data retention practices, which apply appropriate retention periods for each category of personal information. In setting retention periods, we take account of the purposes for which the personal information was collected, legal and regulatory obligations on us to retain information, limitation periods for legal action and our business purposes. If you want to learn more about our specific retention periods for your personal data established in our retention policy you may contact our Privacy Manager at the address given above.

Who we share personal information with

We may share personal information with third parties including:

• When undertaking necessary enquiries to comply with our anti money laundering, sanctions and other due diligence obligations in connection with employment and provision of client services – for example when verifying identity documents
• In the course of providing services to our clients – for example when instructing a medical expert to produce a report or counsel to provide advice
• When we outsource certain support services – for example reception, administrative or photocopying services
• With suppliers of IT storage, infrastructure and related tools and services for core business purposes
• Our professional advisers – for example our auditors, bankers and insurers
• To regulatory authorities, courts, tribunals and law enforcement agencies
• Third parties to whom we transfer personal information are required to respect the security of the information and treat it in accordance with the law. We do not sell personal data to third parties.

Which countries we transfer personal information to

In the course of providing services to our clients we may need to transfer personal information outside the UK.

Whenever we transfer personal information outside the UK, we implement at least one of these safeguards or ensure that at least one of these conditions applies:

• If one of the exceptions in the UK GDPR applies
• By transferring to a country in relation to which there are UK ‘adequacy regulations’
• If we put in place one of the ‘appropriate safeguards’ referred to in the UK GDPR, including where necessary for the provision of legal services

How we protect personal information

We have put in place appropriate security measures to prevent personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have put in place appropriate measures to inform our staff about how we collect, handle and keep information secure.

We have put in place measures to deal with any suspected personal information breach and will notify relevant individuals and the Information Commissioner of a breach when we are legally required to do so.

The legal rights of individuals whose personal information we process

10.1Individuals have the rights set out below. If you wish to exercise any of these rights, please contact our Privacy Officer using the contact details given above.

Request access to their personal information (commonly known as a “data subject access request”). This enables individuals to receive a copy of the personal data we hold about them and to check that we are lawfully processing it.

Request correction of the personal information that we hold about them. This enables individuals to have any incomplete or inaccurate information we hold corrected, though we will need to verify the accuracy of the new information provided to us.

Request erasure of their personal information. This enables individuals to ask us to delete or remove personal information where there is no good reason for us continuing to process it. Individuals also have the right to ask us to delete or remove their personal information where they have successfully exercised their right to object to processing (see below), where we may have processed their information unlawfully or where we are required to erase their personal information to comply with local law. Note, however, that we may not always be able to comply with a request of erasure for specific legal reasons which will be notified to the individual, if applicable, at the time of their request.

Object to processing of personal information where we are relying on a legitimate interest (or that of a third party) and there is something about the individual’s particular situation which makes her/him want to object to processing on this ground as she/he feels it impacts on her/his fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process the information which overrides those rights and freedoms. Individuals also have the right to object where we are processing their personal information for direct marketing purposes.

Request restriction of processing of their personal information. This enables individuals to ask us to suspend the processing of their personal information in the following scenarios: (a) if the individual wants us to establish the information’s accuracy; (b) where our use of the information is unlawful but an individual does not want us to erase it; (c) where the individual needs us to hold the information even if we no longer require it as she/he needs it to establish, exercise or defend legal claims; or (d) the individual has objected to our use of their information but we need to verify whether we have overriding legitimate grounds to use it.

Withdraw consent at any time where we are relying on consent to process the personal information. However, this will not affect the lawfulness of any processing carried out before consent is withdrawn.

Complaints

Individuals have a right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk). We would, however, appreciate the chance to deal with any concerns before the ICO is approached so please contact our Privacy Manager using the contact details given above, in the first instance.

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated in October 2026.