Privacy Policy

1. Who We Are

PEAM Consulting Ltd ("PEAM", "we", "us", "our") is an asset management consultancy and professional training provider registered in England and Wales (Company No. 15436275). Our registered office is at 128 City Road, London, EC1V 2NX, United Kingdom.

PEAM Consulting Ltd is the data controller for personal data collected through this website and in connection with our services. This means we determine the purposes and means of processing your personal data and are responsible for it being handled lawfully.

If you have any questions about this policy or how we handle your data, please contact us at info@peamconsulting.com.

2. Personal Data We Collect

We collect personal data only when you actively provide it to us or when it is generated automatically as part of your use of our website. The categories of personal data we may collect include:

• Identity data, your first name, last name, and job title when you submit an enquiry, register for a course, or contact us.
• Contact data, your email address, telephone number, and company name.
• Training and booking data, course selections, delegate names, dietary or accessibility requirements, and correspondence relating to training bookings.
• Financial data, billing address and payment card details. Card transactions are processed securely by Stripe, Inc. We do not store full card numbers on our own systems. Stripe's privacy policy is available at stripe.com/gb/privacy.
• Technical data, IP address, browser type and version, time zone, browser plug-in types, operating system, and other technology identifiers on the devices you use to access our website.
• Usage data, information about how you use our website, including pages visited, time spent, and referring URLs.
• Communications data, records of correspondence when you contact us by email, telephone, or through our website forms.

3. How We Collect Your Data

We collect personal data through the following means:

• Direct interactions, when you complete a contact or enquiry form, book a training course, request a brochure, or correspond with us by email or telephone.
• Automated technologies, as you interact with our website, we may automatically collect technical and usage data using cookies, server logs, and similar technologies. Please see our Cookie section below.
• Third parties, we may receive data about you from analytics providers, payment processors (Stripe), and, where applicable, your employer or a third party making a booking on your behalf.

4. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

• Contract, processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. This applies to training bookings and the delivery of our services.
• Legitimate interests, processing is necessary for our legitimate business interests, such as responding to enquiries, improving our website, preventing fraud, and maintaining the security of our systems, provided those interests are not overridden by your rights.
• Legal obligation, processing is necessary to comply with a legal obligation, such as maintaining financial records for HMRC.
• Consent, where we rely on consent (for example, for certain marketing communications or non-essential cookies), you have the right to withdraw that consent at any time by contacting us at info@peamconsulting.com.

5. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiries and provide information about our consultancy services and training courses.
• To process and administer training bookings, including issuing confirmations, joining instructions, and certificates of completion.
• To process payments and manage billing, including through our payment processor Stripe.
• To deliver our consultancy and training services and manage our client relationships.
• To send you service-related communications, including booking confirmations, course updates, and important notices.
• To send you marketing communications about our services where you have consented or where we have a legitimate interest in doing so. You may opt out at any time.
• To improve our website and services through analysis of usage data.
• To comply with our legal and regulatory obligations.

6. Sharing Your Data

We do not sell, rent, or trade your personal data. We may share your data with the following categories of third parties, strictly for the purposes described in this policy:

• Payment processors, Stripe, Inc., to process course booking payments securely. Stripe is certified to PCI DSS Level 1.
• IT and hosting providers, companies that provide website hosting, email, and other infrastructure services, who process data on our behalf under data processing agreements.
• Professional advisers, accountants, lawyers, and auditors who require access to data to provide their services to us, subject to confidentiality obligations.
• Regulatory and law enforcement authorities, where we are required to disclose data by law, court order, or regulatory requirement.

7. International Data Transfers

Some of our third-party service providers are based outside the United Kingdom. Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR, such as the UK International Data Transfer Agreement (IDTA) or adequacy regulations.

Stripe, Inc. is based in the United States. Stripe's data transfers are governed by Standard Contractual Clauses and other appropriate safeguards. Details are available in Stripe's privacy policy at stripe.com/gb/privacy.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Training booking and payment records are retained for 7 years from the date of the transaction to comply with HMRC requirements.
• Enquiry and contact records are retained for up to 3 years from the date of last contact, unless a booking or engagement follows.
• Website usage and technical data is retained for up to 26 months.
• Marketing consent records are retained for as long as you remain on our mailing list, plus 3 years after you unsubscribe.

9. Cookies

Our website uses cookies and similar tracking technologies. Cookies are small text files placed on your device when you visit our website.

We use strictly necessary cookies to enable core website functionality. We may also use analytics cookies to understand how visitors use our site. Non-essential cookies are only placed with your consent, which you can manage via our cookie consent banner.

You can control and delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access, you have the right to request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification, you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure, you have the right to request that we delete your personal data in certain circumstances (the "right to be forgotten").
• Right to restrict processing, you have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object, you have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

11. Data Security

We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These measures include encrypted data transmission (TLS/HTTPS), access controls, and secure payment processing via Stripe.

Where we have given you (or where you have chosen) a password to access certain parts of our website, you are responsible for keeping that password confidential. We ask you not to share a password with anyone.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and, where required, notify you directly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The date at the top of this policy indicates when it was last revised.

Where changes are material, we will take reasonable steps to notify you, for example by posting a prominent notice on our website or, where we hold your contact details, by email.

13. Contact Us & Complaints

If you have any questions, concerns, or complaints about how we handle your personal data, or if you wish to exercise any of your rights, please contact us: