Data held
in confidence.

Oakwell Consulting Ltd (“Oakwell”, “we”, “us”) is a strategic research and advisory firm registered in England & Wales.

For the purposes of applicable data protection law, Oakwell acts as a data controller in respect of its own business contacts and as a data processor where it processes personal data on behalf of a client.

This Policy explains how we handle personal data relating to clients, prospective clients, research participants, suppliers, and visitors to our digital properties.

It applies alongside our Terms & Conditions and any engagement-specific data processing agreement.

Identity and contact data — name, job title, organisation, email address, telephone number.

Engagement data — correspondence, meeting notes, briefing materials, and deliverable feedback.

Research data — responses to interviews, surveys and panels, which we anonymise wherever practicable.

Commercial data — billing contacts, purchase orders, and payment records.

Technical data — IP address, browser type, device information and usage analytics.

Directly from you when you contact us, enter an engagement, or participate in research.

From your organisation where it appoints you as a point of contact.

Automatically through cookies and analytics when you use our digital properties.

From legitimate public and licensed third-party sources used in market research.

Performance of a contract — to deliver services set out in an Agreement.

Legitimate interests — to operate, promote and secure our business, balanced against your rights.

Consent — for research participation and optional marketing, withdrawable at any time.

Legal obligation — to meet accounting, tax and regulatory requirements.

To deliver, manage and improve our research and advisory services.

To communicate about engagements, proposals and service updates.

To produce anonymised and aggregated insight for internal benchmarking and thought leadership.

To administer invoicing, credit control and internal record-keeping.

We share personal data only where necessary: with vetted subcontractors and specialist researchers, professional advisers, and technology providers acting under contract.

All processors are bound by written terms requiring confidentiality and appropriate security measures.

We do not sell personal data under any circumstances.

Where personal data is transferred outside the UK or EEA, we rely on adequacy regulations or approved safeguards such as the International Data Transfer Agreement or Standard Contractual Clauses.

Engagement records are retained for the duration of the relationship and for seven (7) years thereafter to satisfy legal and contractual obligations.

Research data is anonymised or deleted once the research purpose is fulfilled.

Marketing contact data is retained until consent is withdrawn or the contact becomes inactive.

We apply role-based access control, encryption in transit and at rest, secure device management and supplier due diligence.

Personnel receive confidentiality obligations and periodic data protection training.

We maintain an incident response process and will notify affected parties and regulators where legally required.

You have the right to access, rectify, erase, restrict or object to processing, and to data portability.

Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

Requests are acknowledged promptly and answered within one (1) month, extendable where a request is complex.

Our digital properties use strictly necessary cookies and, subject to your consent, analytics cookies that help us understand usage.

You may manage cookie preferences at any time through your browser settings or our cookie controls.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Our services are directed at organisations. We do not knowingly collect personal data from individuals under the age of 16.

We review this Policy at least annually. Material changes will be communicated to active clients and reflected in the version control table.

Data protection enquiries: [privacy@oakwellconsulting.com] · Oakwell Consulting Ltd, [Registered Address].

If you are dissatisfied with our response, you may complain to the Information Commissioner’s Office (ICO) at ico.org.uk.