Privacy notice.
How we use the contact details of the people we deal with, where they come from, and how to make us stop.
1. Who we are
AEDRA is an operational resilience consultancy. AEDRA Ltd, company number SC904905, registered office 21 Reed Way, Strathaven, ML10 6XR, is the controller of the personal data described in this notice. We are registered with the Information Commissioner's Office, number ZC266414.
Contact us about anything in this notice at [email protected].
This notice covers the people we deal with: those who contact us, book a call, ask for a Snapshot, or whom we contact. Documents a client gives us are covered by how we handle your data and our data processing agreement.
2. What we hold, and where it comes from
If you contact us, book a call or ask for a Snapshot
Your name, role, firm, work email address, and what you tell us. It comes from you.
If we contact you first
Your name, role, firm and work contact details. We find these in public sources: your firm's website, the FCA Register, Companies House, and your public professional profile. We tell you which in our first message.
If your firm is a client
The contact details of the people we work with, and our correspondence.
If you visit this site
This site sets no cookies and does not track you. The company that hosts it keeps standard server logs, which include IP addresses, for security.
We do not collect special category data, and we ask you not to send us any.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Replying to you, arranging and holding calls, producing a Snapshot you asked for | Our legitimate interest in responding to enquiries, and steps taken at your request before a contract |
| Contacting people at regulated firms and their suppliers about our services | Our legitimate interest in finding clients for a service relevant to their role. You can object at any time and we will stop |
| Delivering work to a client and getting paid | Contract |
| Keeping records for tax, accounting and to defend legal claims | Legal obligation, and our legitimate interest in defending claims |
We do not make automated decisions about you, and we do not sell or rent personal data.
4. How long we keep it
- Enquiries and outreach that go nowhere: 12 months after the last contact, then deleted.
- If you ask us to stop contacting you: we keep your name and email on a short do-not-contact list, so that we don't contact you again.
- Clients: contact details and correspondence for six years after the last engagement ends.
- A supplier list sent for a free Snapshot: 30 days, unless your firm engages us.
5. Who we share it with
Only companies that provide services to us, under written data protection terms:
| Company | What for | Where data is held |
|---|---|---|
| Email, calendar, booking page, file storage | Google's data centres, which may be outside the UK, including in the United States | |
| Notion | Our record of firms and contacts | United States |
| Cloudflare | Hosting this site | Cloudflare's global network; visitor log data is processed in the United States and Europe |
We may also share it with our professional advisers and insurers, and with a regulator or court where the law requires it.
6. Transfers outside the UK
Some of these companies hold or can access data outside the UK. Where that happens the transfer is covered by a UK adequacy decision or by approved contract clauses: the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses. Ask us and we will tell you which applies.
7. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you
- correct it
- delete it
- restrict how we use it
- stop using it, where we rely on legitimate interests
- stop contacting you about our services, at any time and without giving a reason
Write to [email protected]. We reply within one month. There is no charge. If you are in the EU, the same rights apply.
8. Complaints
Tell us first at [email protected]. We acknowledge a complaint within 30 days and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
9. Changes
We update this page when anything here changes, and change the date at the top.