This website, www.copperbeech-group.com, is operated by Copper Beech Group Limited. We are the data controller for the personal data described in this policy.

Copper Beech Group Limited is registered in England and Wales, company number 16835067. Our registered office is Granville Hall, 11 Granville Road, Leicester LE1 7RU. Our London office is Floor 2, 33 Duke Street, London W1U 1LH.

If you have a question about this policy or about how we handle your personal data, email info@copperbeech-group.com with "Data protection" in the subject line, or write to us at the London office above.

Our website is informational. You cannot create an account, and we do not sell anything through it. We collect personal data in three situations.

When you contact us. If you email info@copperbeech-group.com or careers@copperbeech-group.com, we receive your name, email address, anything you include in your message and, if you attach one, your CV.

When we work with you. If you or your organisation engage us, or discuss engaging us, we hold business contact details, correspondence and the information needed to carry out and record the work.

When you visit the website. We use website analytics to understand how the site is used. This collects your IP address, the pages you visit, the type of device and browser you use, and the date and time of your visit. We look at this information in aggregate. We do not use it to identify you.

We do not knowingly collect personal data from anyone under 18.

UK data protection law requires us to have a lawful basis for each use of personal data. Ours are set out below.

Purpose / Lawful Basis

• Responding to enquiries and correspondence: Legitimate interests - running our business and answering people who contact us
• Considering job applications: Legitimate interests, and taking steps at your request before entering a contract
• Delivering and recording client work: Performance of a contract, or steps taken at the client's request before a contract
• Keeping the website secure and available: Legitimate interests -protecting our systems and our visitors
• Understanding how the website is used: Consent, given through the cookie banner
• Meeting legal and regulatory duties, including accounting and tax records: Legal obligation

Where we rely on legitimate interests, we have checked that our interests are not outweighed by your rights. You can ask us for more detail on this at any time.

We do not use your personal data for automated decision-making or profiling. We do not send marketing emails to people who have not asked for them.

We use a small number of cookies. Essential cookies make the website work and remember your cookie choice. Analytics cookies, which are optional, help us understand how the site is used. Analytics cookies are set only if you choose Accept on the cookie banner. You can withdraw that choice at any time by clearing cookies in your browser, and the banner will appear again on your next visit.

We share personal data only where we need to. This includes:

• the companies that host the website and provide our email and document systems
• our website developer, for maintenance and support
• our accountants, lawyers and insurers, where needed
• regulators, courts or law enforcement, where the law requires it

We do not sell personal data. Our service providers act on our instructions and are bound by contract to keep your data secure.

We have offices in London, New York and Dubai. Personal data may be accessed from these offices so that our team can respond to you and deliver our work. Some of our service providers also store data outside the UK.

Where personal data leaves the UK, we rely on the UK Government's adequacy regulations or on the UK International Data Transfer Agreement, or the Addendum to the EU Standard Contractual Clauses, so that your data has the same protection it would have in the UK. You can ask us for a copy of the safeguards we use.

We keep personal data only as long as we need it.

• General enquiries: 12 months from our last contact with you
• Job applications: 6 months after the role is filled or the application closes, unless you ask us to keep your details for future roles
• Client records: 6 years from the end of the engagement, to meet our legal and accounting duties
• Website analytics : 2-14 months

When we no longer need personal data, we delete it or anonymise it.

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct data that is wrong or incomplete
• ask us to delete your data
• ask us to restrict how we use your data
• object to our use of your data where we rely on legitimate interests
• receive your data in a portable format
• withdraw consent at any time, where consent is our lawful basis

To exercise any of these rights, email info@copperbeech-group.com with "Data protection" in the subject line. We will respond within one month. We may need to confirm your identity first.

If you are unhappy with how we have handled your personal data, please contact us first so that we can try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Telephone: 0303 123 1113

Website: ico.org.uk

We protect personal data with appropriate technical and organisational measures, including access controls, encryption in transit and staff guidance on handling data. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take reasonable steps to protect the data we hold.

We may update this policy from time to time. The date at the top shows when it was last changed. Any change takes effect when it is published on this page.