Privacy Notice

​

For our clients, partners, workshop participants, suppliers and website visitors

​

 

1. Who we are

Roretti Ltd is a public sector consultancy that helps UK local authorities overcome service delivery challenges. In this notice, “Roretti”, “we”, “us” and “our” mean Roretti Ltd, a company registered in England and Wales (company number 12189298) with its registered office at 1st Floor, 2 Station Close, Potters Bar, Herts, EN6 1TL.

​

We are the controller of the personal data described in this notice. Our Data Protection Officer is Emma McGowan, who you can contact at emma.mcgowan@roretti.com or on 07811112033.

​

This notice explains how we use personal data about people we work with who are not our employees. Our staff and job applicants have a separate privacy notice.

​

2. Who this notice covers

• staff of our clients, such as councils, and of our partners

• suppliers and their staff

• people who contact us, visit our website

 

If we are working on a council’s behalf. When we handle personal data for a client, for example records of residents or service users that a council shares with us for a project, the council is the controller and its own privacy notice applies. We act only on its instructions. Please contact the council about that information.

​

3. The information we collect

• Contact and role details: name, job title, organisation, work email, phone number and business address

• Project information: communications with us, meeting notes, and your contributions to workshops, interviews, surveys and Miro boards

• Event information: attendance, and any dietary or accessibility needs you choose to tell us about

• Supplier information: contract, payment and contact details

• Marketing preferences: whether you want to hear from us

• Website information: information collected by cookies and analytics, such as IP address and pages visited

 

Accessibility or dietary needs can reveal health or religious information. We only use this to make arrangements for you, with your consent, and delete it after the event.

​

4. Where we get it from

Most information comes directly from you. We may also receive it from your organisation (for example, when a council names its project team), from colleagues who introduce you, or from public sources such as your organisation’s website or professional networking sites.

​

5. How we use it and our lawful basis

 

Purpose

Lawful basis

​

Delivering projects and managing our relationship with clients and partners

Legitimate interests (delivering our services); contract, where you contract with us directly

​

Running workshops, interviews, surveys and engagement sessions

Legitimate interests (delivering the project for our client)

​

Making event arrangements for dietary or accessibility needs

Consent

​

Managing suppliers and paying invoices

Contract; legal obligation (tax and accounting records)

​

Responding to enquiries

Legitimate interests

​

Sending updates about our work and services

Legitimate interests for people at organisations we work with; consent where the law requires it. You can opt out at any time.

​

Keeping our systems secure, and establishing or defending legal claims

Legitimate interests; legal obligation

 

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more detail.

​

6. Who we share it with

• service providers that help us run our business, such as Microsoft (email, Teams and file storage) and Miro (online workshops), under contracts that protect your data

• our client or partner organisations, where this is part of the project you are involved in

• professional advisers, such as lawyers, accountants and insurers

• regulators, law enforcement or other public bodies where the law requires it

• a buyer, if all or part of our business is sold, under confidentiality terms

 

We do not sell your personal data.

​

7. International transfers

Some of our service providers may store or access data outside the UK. [Miro is based in the United States.] Where this happens, we make sure appropriate safeguards are in place.  You can ask our DPO for details.

​

8. How long we keep it

​

Information

Typical retention

​

Client and partner contact details

2 years after the project ends, unless we keep working together

​

Workshop outputs, Miro boards and drafts

Deleted at project closure, unless the client asks us to keep them

​

Contracts and project deliverables

6 years after the contract ends

​

Supplier and financial records

6 years from the end of the financial year

​

Enquiries

12 months after the last contact

​

Event dietary and accessibility information

Deleted after the event

​

Marketing contacts

Until you unsubscribe; reviewed every 2 years

​

9. Keeping your information secure

We store information in secure Microsoft 365 systems with multi-factor authentication and access restricted to the people who need it. Our staff are trained in data protection. If a breach is likely to result in a high risk to you, we will tell you without undue delay.

​

10. Your rights

You have the right to:

• access your personal data

• have inaccurate data corrected

• have your data deleted, in some circumstances

• restrict how we use your data, in some circumstances

• receive your data in a portable format, where we rely on consent or a contract

• withdraw consent at any time, where we rely on it

 

Your right to object. Where we rely on legitimate interests, you can object to us using your data on grounds relating to your situation, and we will stop unless we have compelling grounds to continue. You can always object to marketing, and we will stop straight away.

​

We do not make decisions about you based solely on automated processing. To use your rights, contact our DPO. We will normally respond within one month and there is usually no charge.

​

11. Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can complain by email to emma.mcgowan@roretti.com. We will acknowledge your complaint within 30 days and keep you informed.

​

You also have the right to complain to the Information Commission (ICO), the UK data protection regulator, at https://ico.org.uk or on 0303 123 1113.

​

12. Changes to this notice

We may update this notice from time to time. The latest version will always be on our website, and we will tell you about any significant changes.