How we handle personal information

Trilogy Consulting Group Ltd (“Trilogy”, “we”, “us”) works with senior leaders and their teams at moments that matter to them. Much of what we are told is sensitive, and all of it is handled with care. This notice explains what personal information we hold, why we hold it, who sees it and what you can ask us to do about it.

We are the data controller for the information described here. We are a company registered in England and Wales, number 14393104, with our registered office at Victoria House, 14 St Johns Road, Hedge End, Southampton, Hampshire, England, SO30 4AB. You can reach us about anything on this page at spen@slideclinic.com.

We handle personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The information we hold

When you get in touch

If you complete the form on our contact page, or email us, we hold your name, your organisation, your email address and whatever you choose to tell us about the situation you are facing.

When you ask for one of our papers

If you ask us to send you a paper, we hold your name, your email address and your organisation if you give it. We use it to send you the paper you asked for and nothing else. We do not run a newsletter and we do not add you to a follow-up sequence.

When we work together

During an engagement we hold the names, roles and contact details of the people involved, the commercial context of the work, correspondence, our own notes and working materials, and the records we need for invoicing and accounts. Where an organisation engages us to work with its people, we also hold what the organisation tells us about those individuals and the purpose of the work.

When you visit this website

Our hosting provider keeps standard server logs, which include the IP address of the device making a request, the browser it uses, the pages requested and the time of each request. This site loads its typefaces from Google Fonts, which means your IP address is disclosed to Google when a page loads.

Cookies

This website does not set cookies. We do not use analytics, advertising trackers or profiling tools of any kind, so there is nothing here for you to consent to or turn off. If that changes, we will say so on this page and ask for your consent where the Privacy and Electronic Communications Regulations 2003 require it.

Why we hold it, and our lawful basis

We rely on the following lawful bases under Article 6 of the UK GDPR.

Responding to an enquiry

Taking steps at your request before entering into a contract, and our legitimate interests in answering people who approach us (Article 6(1)(b) and 6(1)(f)).

Sending a paper you have requested

Your consent, given when you submit the form, which you can withdraw at any time (Article 6(1)(a)).

Carrying out an engagement

Performance of our contract with you, or our legitimate interests in delivering the work where our contract is with your organisation rather than with you personally (Article 6(1)(b) and 6(1)(f)).

Keeping business and accounting records

Our legal obligations, and our legitimate interests in running the business and establishing or defending legal claims (Article 6(1)(c) and 6(1)(f)).

Keeping this website available and secure

Our legitimate interests in protecting the site and the people who use it (Article 6(1)(f)).

Where we rely on legitimate interests, we have considered whether our interest is overridden by your interests, rights and freedoms, and you can ask us for that assessment.

Confidentiality of our work

Individual conversations stay confidential. We do not report the content of a one-to-one discussion back to the organisation that engaged us. Where an engagement includes feedback to a sponsor, we agree the form of it with everyone involved at the outset, and it is thematic rather than attributed. The exceptions are narrow: where you ask us to share something, where the law requires it, or where there is a serious risk of harm to someone.

We do not ask for information about health, beliefs or other special category data, and we do not record it. If something of that nature comes up in conversation, it is treated in confidence and not written down unless you ask us to and it is necessary for the work.

Who else sees it

We use a small number of suppliers who process personal information on our behalf, covering website hosting and form handling, email and file storage, and accounting. Each is bound by a written contract that meets Article 28 of the UK GDPR and may only act on our instructions.

Where an engagement needs additional expertise, we may bring in an associate adviser. We tell you who they are, and they are bound by the same duties of confidentiality that we are. We also share information with our professional advisers where we need to, and with anyone we are legally required to disclose it to.

We do not sell personal information, and we do not share it with anyone for their own marketing.

Where your information is held

Some of our suppliers store information outside the United Kingdom. Where they do, we rely either on UK adequacy regulations covering that country, or on the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, together with any additional safeguards the transfer requires.

How long we keep it

Enquiries that do not lead to work are kept for 12 months and then deleted. Details given when requesting a paper are kept until you ask us to remove them, or after 24 months without contact. Records of an engagement are kept for the duration of the work and for six years afterwards, which reflects the limitation period for contractual claims and HMRC’s record-keeping requirements. Server logs are kept for the period our hosting provider operates, currently 30 days.

Your rights

Under the UK GDPR you have the right to ask us for a copy of the personal information we hold about you; to have it corrected if it is wrong or incomplete; to have it erased; to restrict how we use it; to receive it in a portable form; and to object to our using it, including an absolute right to object to direct marketing at any time. Where we rely on your consent, you can withdraw it whenever you like, and withdrawing it does not affect anything we did beforehand.

Write to us at spen@slideclinic.com and we will respond within one month. There is normally no charge.

If you are unhappy

Please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk, on 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes to this notice

We update this page when the way we work changes. The date at the top shows when it was last revised.