Privacy Policy

Quantum Six Consulting (”We”) are committed to protecting and respecting your privacy.

This Privacy Notice explains how we collect, use, and protect your personal data when you engage with us as a client, supplier, or website visitor.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (“DUAA”).

This includes new DUAA introduced requirements relating to data subject rights, recognised legitimate interests, automated decision making safeguards, data protection complaints handling, and updated international transfer standards.

This Notice sets out how we comply with these obligations and the rights available to you under the UK GDPR, DPA 2018 and the DUAA.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purposes of data protection legislation in force from time to time, the data controller is Quantum Six Consulting at the registered address; 22 Wycombe End, Beaconsfield, Buckinghamshire, United Kingdom, HP9 1NB

Our nominated Data Protection Officer is Gino Brenzini; [email protected]

Who We Are and What We Do

We are an Advisory Management Consultancy providing strategic and operational advice to clients across various sectors, other than financial management. We are registered in the United Kingdom under Standard Industrial Classification (SIC) code 70229.

We process personal data in accordance with the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA), which introduces additional requirements relating to data subject rights, complaints handling, recognised legitimate interests and safeguards for automated decision making.

What Personal Data We Collect

We may collect and process the following types of personal data:

Name, job title, and contact details
Business name and address
Email correspondence and meeting notes
Billing and payment information
Any other information you voluntarily provide
Information provided through DUAA mandated data subject interactions, including complaints submitted directly to us under the DUAA.

How We Use Your Data

We use your data to:

Provide consultancy services
Communicate with you about projects or services
Manage contracts and billing
Comply with legal obligations
Meet our obligations under the DUAA, including responding to data protection complaints, supporting reasonable and proportionate searches for data, and fulfilling DUAA-aligned rights requests.

Legal Basis for Processing

We process your data under one or more of the following lawful bases:

Performance of a contract
Legal obligation
Legitimate interests (standard UK GDPR legitimate interests)
Recognised Legitimate Interests (as introduced under the DUAA 2025, e.g., preventing fraud, ensuring network and information security, safeguarding economic wellbeing)
Consent (where applicable)

Data Sharing

We do not sell your data. We may share it with:

Professional advisors (e.g. accountants, legal counsel)
IT service providers who support our systems
Regulatory authorities if required by law
The Information Commission (formerly ICO), where required in connection with DUAA compliant data protection complaints.

Data Retention

We retain personal data only as long as necessary for the purposes outlined above, typically for up to 7 years after the end of our relationship, unless a longer period is required by law.

Retention is assessed in line with the DUAA’s emphasis on data minimisation, proportionality, and justifiable access.

Your Rights

You have the right to:

Access your data – See ‘Access to Information’ below.
Correct inaccuracies of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us to continue processing it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing
Object to the processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground. You also have the right to object to where we are processing your personal information for direct marketing purposes.
Request the transfer of your personal information to another party in certain formats, if practicable.
Withdraw consent (where applicable) – See Consent below
Lodge a complaint directly with us as the data controller (a new right introduced by the DUAA)
Escalate your complaint to the Information Commission (formerly ICO) if you remain dissatisfied, using the DUAA aligned complaints process

Access to Information

You have the right to access your personal data under the UK GDPR, DPA 2018 and the DUAA 2025. We also encourage you to contact us to ensure your data is accurate and complete.

A Subject Access Request (SAR) should be submitted to;

Gino Brenzini – Email: [email protected]

Phone: +44 (0)7717 282005

We will perform “reasonable and proportionate” searches for your data, as clarified and codified under the DUAA 2025.

Our legitimate interests

Our legitimate interests in collecting and retaining your personal data are described below:

We may process personal data where it is necessary for our legitimate business interests, provided that those interests are not overridden by your rights and freedoms under data protection law. Our legitimate interests include:

Providing and developing our business and advisory services to fintech and financial services clients, including responding to enquiries, preparing proposals, Statements of Work, delivering advice, and managing client relationships.
Communicating with clients, prospective clients, and professional contacts in the ordinary course of business, including updates about the services we offer, regulatory developments, and industry insights that are relevant to your role or organisation.
Running and improving our business, including internal administration, record-keeping, billing, audit, risk management, and business continuity.
Maintaining the security of our systems, networks, and information, and preventing fraud, misuse, or unauthorised access to data.
Protecting our legal rights and interests, including establishing, exercising, or defending legal claims and complying with professional or regulatory expectations.

In addition, where applicable, we may rely on Recognised Legitimate Interests introduced under the DUAA, which do not require a balancing test (e.g., preventing fraud, ensuring security of networks and information).

When we rely on legitimate interests, we consider the potential impact on you and put appropriate safeguards in place. You have the right to object to processing based on legitimate interests at any time, and we will respect that right unless we have compelling legitimate grounds to continue processing.

Consent

Should we want or need to rely on consent to lawfully process your data we will request your consent orally, by email or by an online process for the specific activity we require consent for and record your response on our system. Where consent is the lawful basis for our processing, you have the right to withdraw your consent to this particular processing at any time. All employees, contractors and associates are encouraged to report concerns of misconduct to their line manager or to a director, as appropriate, without fear of reprisal. Reports will be handled confidentially and investigated promptly.

Where consent is used as a lawful basis, DUAA rules require that individuals can easily withdraw consent and that such withdrawal is promptly respected.

Disclosure of Your Information

We may disclose your personal information to third parties:

If we sell or buy any business or assets, we will disclose your personal data to the prospective seller or buyer of such business or assets.
If Quantum Six Consulting or substantially all of its assets are acquired by a third party, personal data held by it about its customers will be one of the transferred assets.
If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of Quantum Six Consulting, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

We may also disclose information as required to fulfil obligations under the DUAA, such as responding to data protection complaints or regulatory enquiries from the Information Commission.

Contact Us

If you have any questions or wish to exercise your rights, please contact:

Gino Brenzini – Director

[email protected]

Phone +44 (0)7717 282005

Quantum Six Consulting will review this notice regularly to ensure it is up to date and relevant.