Privacy Policy

Keystone Governance Ltd (“Keystone Governance”, “we”, “us” or “our”) is a company registered in England and Wales, providing information governance and data protection consultancy to the engineering and construction sector.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Keystone Governance Ltd is the data controller for the personal data collected through this website and in the course of providing our services.

We are registered with the Information Commissioner’s Office (ICO) as a data controller. You can contact us at hello@keystonegovernance.co.uk.

Depending on how you interact with us, we may collect:

• Enquiry data — name, firm, work email, the nature of your enquiry and any message content you submit through the contact form.
• Engagement data — information you share while we deliver audits, training or retained advisory work, including documents, interview notes and records of decisions.
• Technical data — basic request metadata such as your browser user-agent, submitted with contact form entries to help us detect abuse.
• Correspondence — records of emails, calls and meetings you have with us.

We do not knowingly collect special category data through this website. If a client engagement requires processing of special category or criminal offence data, it is handled under a written contract and appropriate safeguards.

• To respond to enquiries and prepare proposals — legitimate interests(responding to a request you have made) and, where relevant, steps taken at your request prior to entering a contract.
• To deliver our consultancy services — contract with your organisation.
• To meet our regulatory, professional and insurance obligations — legal obligation and legitimate interests.
• To keep records of advice given and decisions taken — legitimate interests in maintaining a defensible professional file.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data.

Keystone Governance Ltd is the data controller for personal data collected through this website, for enquiries made to us, and for records of our business operations.

When we deliver consultancy, audits, training or fractional DPO services and process personal data on behalf of a client organisation, we act as a data processor under a written Article 28 processing agreement. That agreement defines the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subject, and the client’s and our respective obligations and rights.

We share personal data only where necessary, with:

• Vetted processors that help us run the business — for example our hosting provider, email provider and secure document storage — under written Article 28 terms.
• Professional advisers (accountants, insurers, lawyers) where reasonably required.
• Regulators, courts or law-enforcement bodies where we are legally required to do so.

We do not disclose client information to third parties for marketing purposes.

Where a processor is located outside the UK, we rely on UK adequacy regulations or the ICO’s International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

• Unconverted enquiries: up to 24 months from last contact, then deleted.
• Client engagement records: for the duration of the retainer and 6 years after the end of the engagement, in line with limitation periods and professional indemnity requirements.
• Financial records: 6 full financial years, as required by HMRC.

We apply the controls we recommend to our clients: role-based access, multi-factor authentication, encryption of data in transit and at rest with reputable providers, documented starter/leaver processes, and an incident response procedure aligned to ICO reporting timescales.

Under the UK GDPR you have the right to:

• Be informed about how we use your personal data (this notice).
• Request a copy of the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to erase personal data where there is no good reason for us to keep it.
• Restrict or object to certain processing.
• Request portability of data you provided to us.
• Withdraw consent at any time where we rely on consent (this will not affect the lawfulness of processing carried out beforehand).

To exercise any of these rights, email hello@keystonegovernance.co.uk. We will respond within one month.

This website uses only strictly necessary cookies required to serve pages and, where enabled, to prevent abuse of the contact form. We do not use advertising cookies or cross-site tracking. If we add analytics in future, we will update this notice and, where required, request your consent first.

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

We review this notice at least annually and whenever our processing activities change materially. The “last updated” date at the top reflects the most recent version.