Website Privacy Policy

This policy explains how Sterling DPO collects and uses your personal data when you visit sterlingdpo.com or get in touch with us, and what rights you have over it.

1. Who we are

Sterling DPO is a trading name of Sterling DPO/GRC LTD, a UK data protection and AI governance consultancy. For the personal data described in this policy, we are the data controller.

2. What this policy covers

This policy covers personal data we collect through our website, by email, through our booking and intake forms, and when you enquire about our services (Rapid DPIA, DPO-as-a-Service, ISO 27001 and ISO 42001 gap assessments, and AI governance advisory).

It does not cover personal data we handle on behalf of clients while delivering our services. In that situation the client is the controller, and we act as its processor under a written data processing agreement, and the client’s own privacy notice applies.

Our website is aimed at businesses and organisations and is not intended for children.

3. Personal data we collect

We collect only what we need, in the following ways.

• Information you give us: your name, job title, organisation, email address, telephone number, and the content of your message or enquiry, when you use a contact or intake form, book a call, or email us.
• Booking information: details you enter when scheduling a call, such as name, email address, and any notes you add.
• Intake and scoping information: answers you give on our online intake forms about your organisation, its data processing and its compliance needs. Please do not include special category data or information about individuals in these forms.
• Commercial information: billing contact details and payment records when you purchase a service. Card details are handled by our payment provider; we do not see or store full card numbers.
• Technical information: your IP address, browser type, device, pages viewed and referring page, collected through server logs and any cookies or analytics we use (see section 5).
• Correspondence: records of emails and calls between you and us.

4. How we use your data and our lawful bases

We only use personal data where UK GDPR gives us a lawful basis to do so.

Where we rely on legitimate interests, we have balanced them against your rights and freedoms. You can ask us for details of that assessment. Where we rely on consent, you can withdraw it at any time. We do not carry out solely automated decision-making with legal or similarly significant effects.

5. Cookies and similar technologies

Under the Privacy and Electronic Communications Regulations (PECR), we only set non-essential cookies with your consent.

• Strictly necessary: needed for the site to work and stay secure. These do not need consent.
• Functional and embedded services: cookies set by embedded tools, such as a booking calendar or intake form, when you load or use them.

You can change or withdraw your cookie choices at any time by clearing cookies in your browser.

6. Who we share your data with

We do not sell your personal data. We share it only with trusted service providers who process it on our instructions, and where the law requires.

We may also share data with professional advisers (such as accountants, insurers and lawyers), regulators and law enforcement where required, and with a successor if our business is sold or restructured.

Each processor is bound by a data processing agreement or equivalent terms that meet Article 28 UK GDPR.

7. International transfers

Some of our providers are based in, or use infrastructure in, countries outside the UK, including the United States. Where your data is transferred outside the UK, we make sure a lawful transfer mechanism is in place. This may be a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified), the ICO’s International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where needed. You can contact us for details of the safeguards used.

8. How long we keep your data

We keep personal data only as long as we need it for the purpose it was collected and then delete or anonymise it.

9. How we protect your data

We use appropriate technical and organisational measures to keep personal data secure. These include encrypted connections (HTTPS) on our website, access controls and multi-factor authentication on our systems, encrypted storage, supplier due diligence, and restricting access to people who need it. No system is completely secure. If a breach affects your rights and freedoms, we will notify you and the ICO as the law requires.

10. Your rights

Under UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access a copy of your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data in certain circumstances.
• Restrict our processing in certain circumstances.
• Data portability, where we process your data by consent or contract using automated means.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent where we rely on it, without affecting earlier processing.

To exercise any of these rights, email us at privacy@sterlingdpo.com. We may ask you to verify your identity. We will respond within one month, which can be extended by up to two further months for complex or numerous requests. There is normally no fee.

11. Complaints

Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.

12. Changes to this policy

We may update this policy from time to time. The current version is always on our website, and we will tell you about material changes where appropriate.