Privacy Policy

---

At The Yellow Brick Road we are committed to protecting and respecting your privacy. This Privacy Policy outlines how we collect, use, and protect personal data in accordance with the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

By using our services, you agree to the collection and use of your personal information as described in this policy. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

We may collect and process the following personal data:

• Personal Identification Information: Name, job title, company name, email address, phone number, postal address, and other contact information.
• Financial Information: Bank details or payment information necessary for invoicing and receiving payments.
• Professional Information: Business-related details such as services provided, contract information, and client feedback.
• Technical Information: IP addresses, browser type, and other similar technical data automatically collected when you visit our website.
• Any Other Information: Information you provide voluntarily, such as through forms or inquiries on our website or via email.

We use personal data to provide consultancy services and manage our business relationship with you. Specifically, we may use your information for the following purposes:

• Service Delivery: To communicate with you regarding our services, consultancy advice, and project management.
• Billing and Invoicing: To process payments for services rendered.
• Marketing: To provide you with updates, newsletters, and information related to our services (you may opt-out of receiving these communications at any time).
• Legal Compliance: To comply with any legal obligations, such as tax reporting or regulatory compliance.
• Improving Our Services: To monitor and analyse how our services are used, improving the experience for clients.

We will process your personal data under one or more of the following lawful bases:

• Performance of a Contract: When the data is necessary to fulfil a contract with you.
• Legitimate Interests: When processing is necessary for our legitimate business interests, as long as these interests do not override your rights.
• Consent: When you have given us explicit consent to process your personal data for a specific purpose (e.g., marketing).
• Legal Obligation: When we need to comply with a legal obligation (e.g., record-keeping for tax purposes).

We will not share, sell, or lease your personal data to third parties unless required for the purposes outlined below:

• Service Providers: We may share your information with third-party service providers who assist us in delivering our services (e.g., accountants, IT services, payment processors).
• Legal Requirements: We may disclose your personal information if required by law or in response to legal requests (e.g., court orders, government regulations).
• Business Transfers: In the event of a business transfer or sale, your data may be part of the transferred assets.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements.

• Business records: Retained for a minimum of six years to comply with tax and legal obligations.
• Marketing data: Retained until you opt out of receiving communications or withdraw your consent.

Under UK GDPR, you have several rights concerning your personal data:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccuracies in your data.
• Right to Erasure ("Right to be Forgotten"): You can request the deletion of your personal data, subject to legal retention requirements.
• Right to Restrict Processing: You can request the restriction of how we use your data.
• Right to Data Portability: You can request that your personal data be transferred to another service provider.
• Right to Object: You can object to how we use your data in certain circumstances, such as for direct marketing.
• Right to Withdraw Consent: If processing is based on consent, you may withdraw your consent at any time.

If you wish to exercise any of these rights, please contact us at harpreetkaur@theyellowbrickroad.io.

We are committed to ensuring that your personal data is secure. We have implemented appropriate physical, technical, and administrative measures to safeguard the information we collect and process.

However, please note that data transmission over the internet may not be completely secure, and while we take precautions to protect your data, we cannot guarantee its absolute security.

We do not routinely transfer personal data outside of the UK. If we engage third-party service providers based outside of the UK or European Economic Area (EEA), we will ensure that appropriate safeguards are in place to protect your data, such as using standard contractual clauses.

We reserve the right to update this Privacy Policy at any time. We will notify you of any material changes by posting the revised policy on our website. Please review this policy periodically for any updates.

If you have any questions or concerns about this Privacy Policy or how your personal data is handled, please contact us:

• Email: HarpreetKaur@theyellowbrickroad.io
• Postal Address: Regus, Victory Way, Dartford, DA2 6QD

If you believe that your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the UK:

• Website: https://ico.org.uk/
• Phone: 0303 123 1113
• Postal Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

This privacy policy helps to protect your consultancy by complying with UK data protection law, being transparent with clients, and outlining their rights and your responsibilities. If you have any unique practices, such as international data transfers or specialised marketing, make sure to adjust those sections.