Big Little Governance Limited is a company registered in England and Wales under company number 17373515.

Registered office: 124 City Road, London, EC1V 2NX, United Kingdom.

For the purposes of UK data protection law, Big Little Governance Limited is the controller of personal information covered by this notice.

Big Little Governance Limited is registered with the Information Commissioner’s Office (ICO) as a data controller.

ICO registration number: ZC245466

If you have any questions about this Privacy Notice or how we use your personal information, please contact:

emma@biglittlegovernance.co.uk

Depending on how you interact with us, we may collect:

• your name, job title and organisation;

• your email address, telephone number and other contact details;

• information you provide when contacting us through our website, by email or otherwise;

• information provided in connection with an enquiry, proposal or client engagement;

• business and professional information relevant to the services we provide;

• billing and payment information; and

• technical information relating to your use of our website, including information collected through cookies and website analytics.

Where we provide services to a client, we may also process personal information relating to directors, employees, shareholders, advisers and other individuals where this is necessary to provide those services.

We usually obtain personal information directly from you or from the organisation for which you work. We may also receive information from our clients, their directors, employees and professional advisers, publicly available sources such as Companies House, and other organisations involved in an engagement.

We may use personal information to:

• respond to enquiries and communicate with you;

• consider and prepare proposals for potential work;

• provide company secretarial, governance and related services;

• manage our relationships with clients and suppliers;

• administer our business, including invoicing and record keeping;

• operate, maintain and understand the use of our website;

• protect our business, systems and information; and

• comply with legal, regulatory and professional obligations.

We do not currently use contact details submitted through our website to send newsletters or general marketing emails.

Under UK data protection law, we must have a lawful basis for using personal information. Depending on the purpose, we may process personal information because:

• responding to an enquiry or preparing a proposal is necessary to take steps before entering into a contract, or supports our legitimate interests in developing and operating our business;

• providing services and managing a client relationship is necessary to perform a contract, or supports our legitimate interests in properly delivering and administering our services;

• managing relationships with suppliers and professional advisers is necessary to perform a contract or supports our legitimate interests in operating our business;

• invoicing, accounting and maintaining statutory records is necessary to perform a contract or comply with our legal obligations;

• protecting our systems, confidential information and legal interests supports our legitimate interests in maintaining security, preventing misuse and establishing, exercising or defending legal claims;

• operating and maintaining our website supports our legitimate interests in providing a secure and functional website; and

• using non-essential cookies or analytics is based on consent where consent is required.

Where we rely on legitimate interests, those interests may include operating and developing Big Little Governance, delivering and improving our services, maintaining appropriate business records, protecting confidential information and systems, and establishing or defending legal rights. We consider those interests against the rights and interests of the individuals concerned.

When information is required

Some personal information is required so that we can respond to an enquiry, enter into or perform a contract, provide the agreed services, issue invoices or meet our legal obligations.

If the necessary information is not provided, we may be unable to respond to an enquiry, accept an instruction or provide the relevant services.

Automated decision-making

We do not make decisions about individuals based solely on automated processing where those decisions would have legal or similarly significant effects.

For our own business administration, relationship management and professional activities, Big Little Governance decides why and how personal information is used and acts as a controller.

In some engagements, we may process personal information solely on a client’s documented instructions. In those circumstances, the client will usually be the controller and Big Little Governance will act as its processor. The relevant processing will be governed by a Data Processing Schedule or other agreed contractual terms.

Our role will depend on the particular activity being carried out. Big Little Governance may act as a controller for some activities and as a processor for others within the same client relationship.

We do not sell your personal information.

We use trusted third-party service providers to help us operate Big Little Governance and provide our services. These currently include Microsoft for business productivity and communications, Proton for secure cloud storage, and Squarespace for website hosting, website forms and analytics.

These providers may process personal information on our behalf in accordance with their applicable terms and data protection arrangements.

We may also share personal information with professional advisers, clients and their advisers or service providers where reasonably necessary to provide our services, or where disclosure is required by law, regulation or a competent authority.

Where we work within a client’s own systems, information may also be accessed or processed through those systems as necessary to provide the agreed services.

Some of the service providers we use operate internationally and personal information may therefore be processed or accessed outside the United Kingdom.

Where personal information is transferred outside the UK, we take appropriate steps to ensure that it is protected in accordance with applicable data protection law. This may include relying on UK adequacy regulations or appropriate contractual safeguards and other approved transfer mechanisms.

You may contact us using the details above if you would like further information about the safeguards used for a particular transfer.

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include the use of secure cloud storage, multi-factor authentication, restricted access to appropriate systems and devices, and appropriate security measures across the systems used by Big Little Governance.

Where appropriate, we can also work within a client’s own systems and information-security requirements.

No method of electronic storage or transmission is completely secure, but we take reasonable and proportionate steps to protect the information entrusted to Big Little Governance.

We keep personal information only for as long as reasonably necessary. As a general guide:

• enquiry and proposal information will normally be retained for up to two years after our last meaningful contact where an engagement does not proceed;

• client engagement files and related correspondence will normally be retained for six years after the engagement ends;

• invoices, accounting information and statutory business records will be retained for the periods required by applicable law; and

• website analytics and cookie information will be retained in accordance with the periods applying to the relevant Squarespace services and cookie settings.

We may retain information for longer where reasonably necessary to comply with a legal obligation, respond to a complaint or establish, exercise or defend legal claims. Information may be deleted sooner where it is no longer required.

Our website is hosted by Squarespace.

We use Squarespace’s built-in analytics to help us understand how visitors use the website. This may include information such as pages visited, traffic sources, browser or device information and other information about visits to the site.

Our website uses cookies and similar technologies. Some cookies are necessary for the website to operate. Non-essential cookies are restricted unless a visitor chooses to accept them.

You can accept, decline or manage non-essential cookies using the cookie banner when you visit the website. You can change your preferences later using the Cookie Preferences option in the website footer.

Depending on the circumstances, UK data protection law gives you rights in relation to your personal information. These may include the right to:

• ask for access to the personal information we hold about you;

• ask us to correct inaccurate or incomplete information;

• ask us to delete your information in certain circumstances;

• ask us to restrict how we use your information;

• object to certain uses of your information;

• receive certain information in a portable format; and

• withdraw consent where we rely on consent.

You have the right to object where we process your personal information on the basis of our legitimate interests. We will consider any objection in light of the particular circumstances and applicable legal requirements.

These rights are subject to certain legal conditions and exemptions.

To exercise your rights or ask a question about your personal information, please contact emma@biglittlegovernance.co.uk.

If you have concerns about how we use your personal information, please contact us first so that we can try to resolve them.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

We may update this Privacy Notice from time to time to reflect changes to our services, systems, use of personal information or applicable legal requirements.

The latest version will be published on this website with the date of the most recent update shown at the top.