Privacy Notice

This Privacy Notice explains what personal data Paradigm Consulting Limited collects, how we use it, the legal basis on which we rely, and your rights under the Data Protection (Jersey) Law 2018 (“DPJL”). We are committed to handling personal data responsibly and transparently.

Our contact details

Name

Ian Silvester, Director

Address

Hawk House, 22 Esplanade, St Helier, JE1 1BR, Jersey

Phone

Email

ian.silvester@paradigmconsulting.je

What type of information we collect

We collect and process the following categories of personal data, depending on the nature of our relationship with you:

• Personal identifiers and contact details — name, job title, organisation, email address, telephone number and postal address
• Professional and business information — the organisation you represent, your role, and information relevant to the engagement we are conducting
• Engagement data — information provided to us during the course of a client engagement, which may include personal data about third parties (for example, employees of a client organisation) where this is relevant to our work
• Website and communications data — IP address, browser type, and information submitted through our website contact form or LinkedIn
• Financial information — invoicing details, including name, organisation, and payment records, as necessary to manage our business relationship

How we get the information and why we have it

Most of the personal data we process is provided to us directly by you, or by the organisation that has engaged us, for one or more of the following reasons:

• To deliver professional services under an engagement contract
• To respond to an enquiry or request for information
• To manage our business relationship with you, including invoicing and communications
• To send relevant updates, insights or commentary where you have expressed interest in receiving these

We may also receive personal data indirectly in the following circumstances:

• From client organisations, where they provide us with information about their staff, trustees or third parties in connection with an engagement
• From publicly available sources, including LinkedIn and company registry records, where relevant to our business development activity

Under the Data Protection (Jersey) Law 2018, the lawful bases we rely on for processing this information are:

A.  Your consent — for example, where you have opted in to receive updates or insights from us. You may withdraw your consent at any time by contacting us at the details above.

B.  We have a contractual obligation — the processing is necessary to perform our obligations under an engagement contract with you or your organisation.

C.  We have a legal obligation — where we are required to retain or process data to comply with applicable law or regulation.

F.  We have a legitimate interest — for example, maintaining records of business contacts, conducting business development activity, or improving our services. We have considered the balance between our interests and your rights and concluded that our legitimate interests are not overridden by your interests or fundamental rights.

What we do with the information we have

We use the personal data we collect to:

• Deliver professional services under an engagement contract
• Communicate with you about an engagement or a request you have made
• Issue invoices and manage payment
• Send relevant governance, risk and assurance insights and commentary, where you have consented to receive these
• Maintain records of our business relationships and interactions
• Improve the quality and relevance of our services

We may share your information with:

• Associates and subcontractors engaged by us to assist with delivery of an engagement — only to the extent necessary and subject to confidentiality obligations
• Our IT and cloud services providers, where personal data is processed as part of the platforms we use to run our business (for example, Microsoft 365)
• Professional advisors (legal, accountancy, insurance) where disclosure is necessary in connection with a business matter
• Regulatory bodies or courts, where we are legally required to disclose information

We do not sell, rent or otherwise disclose your personal data to third parties for their own marketing or commercial purposes.

How we store your information

Your information is securely stored within Paradigm Consulting’s cloud-based systems, principally Microsoft 365, which is operated from UK and EU data centres.

Data storage: Microsoft 365 (SharePoint, Outlook, Teams)

Data location: UK and EU (Microsoft-managed, with appropriate safeguards)

Access controls: Role-based access, multi-factor authentication, and encryption in transit and at rest

We retain personal data for as long as necessary for the purposes for which it was collected, and in accordance with applicable legal and professional obligations. Our standard retention periods are:

• Client engagement records — 7 years from the end of the engagement, in line with Jersey’s limitation period for contractual claims
• Financial and invoicing records — 7 years, in line with tax and regulatory requirements
• Business contact and marketing records — 3 years from the date of last contact, or until you withdraw consent
• Website contact form submissions — 12 months from the date of submission

At the end of the applicable retention period, we will dispose of your information by secure deletion from our systems.

Your data protection rights

Under data protection law, you have the following rights:

Your right of access

You have the right to ask us for copies of your personal data. We will respond within four weeks of receiving your request.

Your right to rectification

You have the right to ask us to correct personal data you believe is inaccurate, or to complete information you believe is incomplete.

Your right to erasure

You have the right to ask us to erase your personal data in certain circumstances — for example, where it is no longer necessary for the purposes for which it was collected.

Your right to restrict processing

You have the right to ask us to restrict the processing of your personal data in certain circumstances — for example, while the accuracy of data is being contested.

Your right to object to processing

You have the right to object to the processing of your personal data where we are relying on legitimate interests as our lawful basis. We will stop processing unless we can demonstrate compelling legitimate grounds.

Your right to data portability

Where processing is based on your consent or a contract, you have the right to receive your personal data in a structured, commonly used and machine-readable format, or to ask us to transfer it to another organisation.

You are not required to pay any charge for exercising your rights. If you make a request, we will respond within four weeks of receipt.

To exercise any of your rights, please contact us at:

Ian Silvester, Director

Paradigm Consulting Limited

Hawk House, 22 Esplanade, St Helier, JE1 1BR, Jersey

ian.silvester@paradigmconsulting.je

How to complain

If you are unhappy with how we have handled your personal data, we encourage you to contact us in the first instance so that we can try to resolve your concern.

You also have the right to complain to the Jersey Office of the Information Commissioner (“JOIC”):

Jersey Office of the Information Commissioner (JOIC)

2nd Floor, 5 Castle Street, St Helier, Jersey, JE2 3BT

enquiries@jerseyoic.org

+44 (0) 1534 716530

www.jerseyoic.org

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, services or legal obligations. The current version will always be available on our website at paradigmconsulting.je and on request. The date at the top of this Notice indicates when it was last updated.