Privacy Policy

Bellemont Consulting Limited (“Bellemont”, “we”, “us”, “our”) is a company registered in England under company number 13742175, with a registered address at 71-75 Shelton Street, London, England, WC2H 9JQ. We operate the website www.bellemontconsulting.com (the “Site”).

Bellemont understands that privacy is important and is committed to respecting your privacy and protecting your personal data. This policy sets out our approach to the collection, storage, use, transfer and disclosure of information you provide to us, and information we collect in the course of operating our business or in connection with the Site. It also describes your data protection rights, which in some circumstances include a right to object to the processing we carry out.

For any enquiry relating to this policy or to data protection at Bellemont generally, please contact london@bellemontconsulting.com.

Information We Collect

We collect, receive, store and process the following information:

• information you provide when using the Site or contacting us through it
• information you provide when enquiring about or instructing our services, including contact details necessary for client relationship management
• information necessary to fulfil the terms of our contracts, including financial and billing information
• information you provide when applying to work with us or offering your services, including any CV, identity documents and screening information
• information contained in, or relating to, any communication you send to us

Information supplied for these purposes may include names, business contact details, job titles, dates of birth, identity and screening information, banking and financial details, and any other information you supply.

How We Use Personal Data

We use personal data for purposes which include:

• providing our services and maintaining our business relationship with you
• responding to enquiries and complaints
• fulfilling our contractual obligations, and engaging and paying consultants and suppliers
• meeting our legal, regulatory and compliance obligations
• establishing, exercising or defending legal claims
• keeping our systems secure and preventing fraud

We do not sell personal data, and we do not use it for marketing without your consent.

Legal Basis for Processing

We process personal data on the following bases:

• Contract — where processing is necessary to enter into or perform a contract with you, or to take steps at your request before doing so
• Legal obligation — where we are subject to a legal requirement, including where we are obliged to disclose personal data to a court, regulator or law enforcement agency in response to a lawful request
• Legitimate interests — where we or a third party have a legitimate interest in the processing, and we have satisfied ourselves that it is not overridden by your rights and freedoms. Our legitimate interests include providing our services, responding to enquiries, maintaining client relationships, and conducting our business efficiently and securely
• Consent — where we ask for your consent to process personal data in a particular way. Where we rely on consent, you may withdraw it at any time

Where we process data relating to criminal offences or alleged offences, we do so under a condition in Schedule 1 to the Data Protection Act 2018 and in accordance with our Appropriate Policy Document, which is available on request.

Disclosure to Third Parties

We do not share personal data with third parties except where required by law, where necessary to fulfil the purpose for which it was provided, or as otherwise set out in this policy. We share personal data with our professional advisers, accountants, bank, and service providers acting as processors on our instructions, including cloud storage and communications providers, and with consultants engaged to assist us, who are bound by written confidentiality, security and data protection obligations, and who may not sub-contract without our consent.

We may transfer all or part of our business in the circumstances of a merger or sale. In those circumstances personal data may be transferred, but only where the acquiring company has agreed to standards of privacy equivalent to those in this policy.

International Transfers

Where we transfer personal data outside the United Kingdom — including when we engage a consultant, deliver a report to a client, or use services whose providers store or access data outside the UK — we take steps to ensure it is protected to a standard equivalent to that required under UK data protection law, including by contractual measures with those who receive it.

Security

The security of personal data is of the highest importance to us. We apply technical and organisational measures appropriate to the risk, including encryption, access controls, and restrictions on the systems and services which may be used to handle engagement material.

Transmission of information over the internet is not completely secure. Once we have received information, we use strict procedures and security features to prevent unauthorised access.

Cookies

The Site does not use cookies or similar technologies to store information on your device, other than any strictly necessary for security or to deliver the Site itself. We do not use analytics, advertising or tracking cookies.

Data Processed During the Provision of Services

This policy relates principally to personal data collected as a result of operating our business or your interaction with the Site. However, in the course of providing our services — including due diligence, corporate investigations and regulatory advisory — we process personal data about individuals who are the subject of, or relevant to, those services.

We are a controller of that personal data. It is collected from public registers, court and regulatory records, licensed commercial databases, published media, open sources, our client, and source enquiries with individuals in our professional network. It typically includes identity and corporate information, litigation, regulatory and enforcement records, sanctions and watchlist screening results, and a summary of the individual’s profile or reputation. It may include data relating to criminal offences and alleged offences. We do not obtain information by unlawful means, and we do not access private records, systems or communications without authorisation.

The lawful basis for this processing will vary with the nature of the data and the engagement, but will include that the processing is:

• necessary for the purposes of our or our client’s legitimate interests, which may include ensuring that the client does not take action resulting in legal liability, regulatory breach, reputational harm or other adverse effect
• necessary for the prevention or detection of an unlawful act
• necessary for the establishment, exercise or defence of a legal claim
• in relation to data manifestly made public by the data subject

We do not provide a fair processing notice to individuals whose data we process in the course of providing our services, because to do so would seriously impair the achievement of the objectives of that processing. We make this statement in compliance with our obligation under Article 14(5)(b) UK GDPR to make public the nature of the information that would otherwise be contained in such a notice.

Third parties with whom we may share this data include the client who commissioned the work, and consultants engaged by us to assist in gathering information.

Individuals whose data is processed in the course of our services have the same rights as any other data subject, and their data is subject to the same safeguards as are set out in this policy.

Your Rights

Subject to certain limitations and exemptions, you have the right to be informed about how we use your personal data; to request a copy of the personal data we hold about you; to have inaccurate data corrected or incomplete data completed; to request erasure; to object to or restrict our processing; and, in certain cases, to receive your data in a portable format.

You may exercise any of these rights by contacting london@bellemontconsulting.com. We will respond within one month, and will ask you to verify your identity before we do so.

Most of these rights are qualified. Where we hold personal data in connection with an engagement, we may be unable to confirm whether we hold data about you, or to disclose it, where an exemption in the Data Protection Act 2018 applies — for example where disclosure would be likely to prejudice the prevention or detection of crime, or would disclose information about another person. We consider each request on its merits and will give our reasons if we are unable to comply.

Retention

We keep personal data no longer than is necessary for the purposes for which it was processed, in accordance with our internal retention schedule. Material provided by a client is deleted within thirty days of the end of the engagement, or returned if the client so requests, other than material incorporated into or evidencing the report we delivered. Records of our own work are generally kept for six years. We may retain personal data for longer where necessary to comply with a legal obligation, or in connection with a dispute, claim or regulatory request.

Complaints

If you are unhappy with how we have used your personal data, please contact us at london@bellemontconsulting.com so that we can try to resolve the matter. You are also entitled to lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or at ico.org.uk/concerns.

Changes to This Policy

This policy may be changed, amended or supplemented from time to time. New versions will be published on the Site and take effect on publication.