Last updated – July 2026

This privacy policy has been written to clearly inform those who may be concerned with how their ‘personal data’ is used by Digital Works Consulting Ltd (t/as Digital Works Group) – ‘Company’.

Our privacy policy should give you a clear understanding of how we collect, use, protect or otherwise handle your personal data.

1. What types of information do we collect and use?

The types of information that we collect fall under two general categories: personal data and non-personal data:

• Personal data consists of any information which can be used to specifically identify you as an individual;
• Whereas, non-personal data consists of aggregate information or any information that does not reveal your identity.

The following sections describe how your personal data is collected by us and how we use such information.

2. What types of personal information do we collect?

We collect information about you which enables us to send you communications, via email and other forms, about Company services which may be relevant to your needs.  This is collected in our capacity as an expertise business that provides digitally-led business transformation services to prospects and clients.

In order to do this we collect personal information which includes, but not limited to, your first name, surname, email address (both personal and business), telephone number, company job title, company name, job function, location, and sector.

We DO NOT collect sensitive personal data about you, in the form of health or medical information, racial or ethnic origin, sex life or sexual orientation, political opinions, religious beliefs, trade union membership and biometric data.

3. Where do we collect personal data about you from?

The following are the different sources we may collect personal data about you from:

• Directly from you. This is information you provide when communicating by email or meeting in person.
• From an agent/third party acting on your behalf. This may be your company, own limited company, an umbrella company or other source.
• Through publicly available sources. We use the following public sources:
  • Social media and networking sites, including LinkedIn
  • Companies House (or equivalent in the relevant jurisdiction)
  • Corporate websites
  • By word of mouth.

  Where we collect your information through publicly available sources as set out above, we may do this with the aid of software programmes.  Where we use these programmes, their use is restricted to only searching for information (e.g. job title, location, skillset) from public sites where there is a reasonable expectation that such information may be collected and used by companies to conduct Marketing Communications to that individual.

4. How and why we use your personal data

We will use your data so that we can provide our services to you, including:

• Sending you marketing communications regarding the Company service which may be of interest to you.
• Responding to your requests or questions when you contact us.
• Carrying out our contractual obligations with you, including any contracts we intend to enter into with you.
• Notifying you of changes in our services or in this Privacy Policy.
• Managing our relationship with you and with our clients and perform administrative and operational tasks.
• Complying with our legal obligations and rights, under contracts and at law, and to cooperate with authorities and investigations.

5. What marketing communications do you send?

We may send marketing communications to you by email, through social media, SMS or by post.

You may opt out of receiving any further marketing communications by clicking the “unsubscribe” link in an email received from the Company or by contacting us at contact@digitalworksgroup.com.

6. How long do we keep your personal data for?

We keep your information for as long as you want us to and to use your information as described above.  We may retain some of your information after you cease to use our services if it is necessary to meet our legal obligations.

Our standard policy is to retain personal information for 5 years but when determining the relevant retention periods, we will take into account:

• Our contractual obligations and rights in relation to the relevant information;
• Legal obligations under applicable law to retain data for a certain period of time;
• Our legitimate interest where we have carried out a balancing test;
• Statute of limitations under applicable law;
• Disputes, whether potential or actual;
• If you have made a request to have your information deleted;
• Guidelines issued by relevant data protection authorities.

If we determine that we can delete your data, we will do so securely.

7. Who do we share your personal data with?

Your personal data may be shared with certain third parties who will be subject to contractual obligations of confidentiality and compliance with relevant laws, including:

• Suppliers, contractors and agents who may perform services for us, including payroll providers, umbrella companies, professional advisers such as accountants or lawyers, insurance brokers, consultants, background check agencies, email marketing agencies, event organisers.
• Government or law enforcement authorities or any other third party in any jurisdiction, if we believe that we have an obligation to do so or that such action is necessary to protect, defend or enforce our rights.
• In the event of a sale, merger, liquidation, receivership or transfer of assets to any third party provided they are obliged to only use your personal data for the purposes that you have provided it to us.

8. What legal basis do we have for using your information?

We only process your personal data when we have a valid legal basis to do so under the UK GDPR. Depending on our relationship with you, we rely on one or more of the following lawful bases:

• Performance of a Contract: If you are a client, independent associate, or supplier—or if we are actively negotiating an agreement with you—we process your personal data because it is necessary to perform our contractual obligations or take pre-contractual steps at your request.
• Legitimate Interests: Where we collect publicly available business data (such as job titles, sectors, or corporate contact details from sources like LinkedIn) to send targeted business-to-business (B2B) marketing communications, we do so on the basis of our legitimate commercial interests. We always balance our commercial interests against your privacy rights through a documented Legitimate Interests Assessment (LIA) to ensure our outreach is reasonable, expected, and non-intrusive.
• Legal and Regulatory Obligation: We process and retain certain personal data where we are legally required to do so. This includes fulfilling our statutory duties under UK tax laws, corporate record-keeping rules, or when cooperating with law enforcement and regulatory authorities.
• Consent: In specific scenarios where you have explicitly granted permission—such as subscribing to our newsletter via our website or opting into a specific tracking preference—we process your data based on your clear consent. You retain the absolute right to withdraw this consent at any time.

9. What happens if you do not provide us with the information we request or ask that we stop processing your information?

If you do not provide the personal data we request or withdraw your consent for the processing of your personal data, we may not be able to provide useful marketing communications or provide services to you.

10. Do we transfer your data outside of the UK or the EEA?

Yes. To provide our digital transformation consultancy services, we may transfer, store, and process your personal data in countries outside the United Kingdom (UK) and the European Economic Area (EEA). This typically happens when we use cloud-hosted software providers, secure data storage systems, or deliver project services for international clients.

Where personal data is transferred to a country outside the UK or EEA that has not been granted an “adequacy regulation” by the UK Government or European Commission, we ensure your information remains protected by putting in place strict statutory safeguards. This includes implementing:

• The UK International Data Transfer Agreement (IDTA);
• The UK Addendum to the European Commission’s Standard Contractual Clauses (SCCs); or
• Corporate binding mechanisms that guarantee an equivalent level of data security.

By submitting your personal data to us, you acknowledge and agree to these necessary operational transfers. If you would like further details on the specific geographic locations of our third-party processors or wish to request a copy of the safeguards we have in place, please contact us at contact@digitalworksgroup.com.

11. What security measures do we have in place?

We have appropriate technical and organisational security measures in place to protect your personal information under our control and to prevent unauthorised access, destruction, transmission, misuse or alteration of it.  However, we cannot guarantee that such unauthorised access, destruction, transmission, misuse or alteration will not happen.

Transfer of data via the internet is not completely secure and while we do our best to protect your personal data, any data you transmit to us is at your own risk.  Once we have received your data we will follow our procedures and policies to protect it.

If we share any links to external websites operated by other organisations (such as clients, training providers etc) with you, any data you submit to those websites (including clicking on any link) is outside our control and will be subject to that third party’s data protection and privacy policies.  We cannot guarantee that any third party will be compliant with relevant laws and best industry practice and accept no responsibility or liability for these third parties.

12. Do we use cookies to collect personal data on you?

To provide better service to you on our websites, we use cookies to collect your personal data when you browse.

13. What rights do you have in relation to the data we hold on you?

By law, you have a number of rights when it comes to your personal data. Further information and advice about your rights can be obtained from the data protection regulator in your country.

13.1. The right to be informed

You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this Policy.

13.2. The right of access

You have the right to obtain access to your information (if we’re processing it), and certain other information (similar to that provided in this Privacy Policy).

This is so you’re aware and can check that we’re using your information in accordance with data protection law.

13.3 The right to rectification

You are entitled to have your information corrected if it’s inaccurate or incomplete.

13.4. The right to erasure

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there’s no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.

13.5. The right to restrict processing

You have rights to ‘block’ or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future.

13.6. The right to data portability

You have rights to obtain and reuse your personal data for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your information easily between our IT systems and theirs safely and securely, without affecting its usability.

13.7. The right to object to processing

You have the right to object to certain types of processing, including processing for direct marketing or if you no longer want to be contacted with potential opportunities.

13.8. The right to lodge a complaint

You have the right to lodge a complaint at any time about the way we handle, store, or process your personal data. If you are based in the United Kingdom, your national data protection regulator is the Information Commissioner’s Office (ICO).

You can contact the ICO through the following channels:

• Website: https://ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you live or work within the European Union (EU) or EEA, you also retain the right to lodge a complaint with your local supervisory authority. We would, however, appreciate the opportunity to resolve any concerns or grievances with you directly before you approach a regulator, so please contact us first at contact@digitalworksgroup.com

13.9. The right to withdraw consent

If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for marketing purposes.

We usually act on requests and provide information free of charge, but may charge a reasonable fee to cover our administrative costs of providing the information for:

• baseless or excessive/repeated requests,
• or further copies of the same information.

Alternatively, we may be entitled to refuse to act on the request.

Please consider your request responsibly before submitting it. We’ll respond as soon as we can. Generally, this will be within one month from when we receive your request but, if the request is going to take longer to deal with, we’ll come back to you and let you know.

14. How will we contact you?

We may contact you by phone, email or via social media or networking sites. If you prefer a particular contact means over another please just let us know.

15. How can you contact us?

We will review your personal data to ensure it is up to date and accurate but rely on your cooperation to keep us informed if any such data changes.  If you would like to change any information you have provided to us, please just let us know

If you are unhappy with how we’ve handled your information, or have further questions on the processing of your personal data, contact us here:

FAO Data Protection Officer:  contact@digitalworksgroup.com

16. Who controls your personal data?

The controller of your personal data is: Digital Works Consulting Limited (t/as Digital Works Group) a company registered in England and Wales under registration number 07726470 whose registered office is at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF

17. Will we change this Privacy Policy?

This Privacy Policy was last updated in July 2026. It will be reviewed from time to time to take account of new laws, changes within Digital Works Group and to ensure it remains compliant with best practice and applicable laws.  Any information we hold will be governed by the most recent version of this Policy.

Any changes we make to this will be posted on the website or communicated through other appropriate means of communication.  We recommend that you check the terms of this Privacy Policy to keep up to date with any changes.