Privacy Policy

Eaton Square Consulting Ltd ("we", "us", "our") is a healthcare commercial consultancy registered in England and Wales. We provide commercial strategy, NHS tender support, business development and executive advisory services to healthcare organisations across the United Kingdom.

For the purposes of UK data protection law, Eaton Square Consulting Ltd is the data controller responsible for your personal data.

Contact: [email protected]

We may collect and process the following categories of personal data:

• Identity data — your full name and job title • Contact data — email address, telephone number and postal address • Organisation data — the name and type of organisation you represent • Communication data — the content of messages, enquiries and correspondence you send to us • Technical data — IP address, browser type, device information and pages visited (collected via cookies and analytics tools where consent has been given) • Marketing preferences — your preferences for receiving communications from us

We do not collect any special category data (such as health, financial or biometric data) through this website.

We collect personal data in the following ways:

• Directly from you — when you complete our contact form, send us an email, book a consultation or communicate with us by telephone • Automatically — when you visit our website, we may collect technical data through cookies and similar technologies (subject to your consent) • From third parties — we may receive information about you from professional networking platforms such as LinkedIn, where you have chosen to make that information publicly available

We use your personal data for the following purposes:

• To respond to your enquiries and provide the consultancy services you have requested • To manage our business relationship with you and your organisation • To send you relevant updates, insights and communications where you have given your consent • To improve our website and understand how visitors use it • To comply with our legal and regulatory obligations • To protect our legitimate business interests

We will only use your personal data for the purposes for which it was collected, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose.

We process your personal data on the following legal bases under UK GDPR:

• Consent — where you have given us clear consent to process your data for a specific purpose, such as receiving marketing communications • Contract — where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract • Legitimate interests — where processing is necessary for our legitimate business interests, such as responding to enquiries, improving our services and maintaining business relationships, provided those interests are not overridden by your rights • Legal obligation — where processing is necessary to comply with a legal obligation to which we are subject

You have the right to withdraw consent at any time where we rely on consent as our legal basis.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting or reporting requirements.

• Enquiry and contact data — retained for up to 3 years from the date of last contact • Client and engagement data — retained for up to 7 years following the end of an engagement, in accordance with legal and tax obligations • Marketing preferences — retained until you withdraw your consent or request deletion

When personal data is no longer required, we will securely delete or anonymise it.

We do not sell, rent or trade your personal data to third parties.

We may share your personal data with trusted third-party service providers who assist us in operating our business, including:

• IT and software providers (including our website platform and email systems) • Professional advisers such as solicitors and accountants, where necessary

All third parties are required to handle your personal data securely and in accordance with UK data protection law. We do not permit them to use your data for their own purposes.

We may also disclose your personal data where required to do so by law, court order or regulatory authority.

We are based in the United Kingdom and primarily process personal data within the UK. Where we use third-party service providers that process data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR, including adequacy decisions or standard contractual clauses.

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you have the right to request a copy of the personal data we hold about you • Right to rectification — you have the right to request that we correct any inaccurate or incomplete data • Right to erasure — you have the right to request that we delete your personal data in certain circumstances • Right to restrict processing — you have the right to request that we restrict the processing of your data in certain circumstances • Right to data portability — you have the right to receive your personal data in a structured, commonly used format • Right to object — you have the right to object to processing based on legitimate interests or for direct marketing purposes • Rights related to automated decision-making — we do not use automated decision-making or profiling

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. There is no charge for making a request.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.

Our website uses cookies to improve your experience and, where you have given consent, to help us understand how visitors use our site. For full details of the cookies we use and how to manage them, please see our Cookie Policy.

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The most current version will always be available on this page, with the date of the most recent update shown at the top. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Eaton Square Consulting Ltd Email: [email protected]

You also have the right to make a complaint to the Information Commissioner's Office (ICO): Website: www.ico.org.uk Telephone: 0303 123 1113