Privacy Policy & Data Governance

1. Data Controller Identification

The Office of Business Efficiency ("OBE", "we", "us", or "our") is committed to safeguarding the privacy and confidentiality of corporate and individual data collected in connection with our commercial efficiency audits. For the purposes of the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), the data controller is:

2. Categories of Information Collected

When you request a Business Efficiency Review or communicate with our consultancy, we collect:

• Identity & Contact Data: Full name, corporate email address, direct telephone number, trading name, and registered office postcode.
• Operational & Tariff Data: Industry vertical, premises count, utility meter identifiers (MPAN/MPRN), merchant processing statements, and EPOS till configurations supplied voluntarily for auditing.

3. Lawful Basis for Processing (UK GDPR Article 6)

We process personal and commercial data strictly under the following statutory grounds:

• Performance of a Contract / Pre-contractual Steps (Art. 6(1)(b)): To conduct your requested Business Efficiency Review, compile your bespoke report, and schedule appointments.
• Consent (Art. 6(1)(a)): Where you provide express, affirmative consent for SMS or telephone notifications regarding review scheduling or relevant government grant updates.
• Legitimate Interests (Art. 6(1)(f)): To maintain operational audit records, prevent fraud, and verify commercial entity bona fides.

4. Data Retention & Security Protocols

Corporate audit documents (invoices, statements) are held strictly for the duration of the audit cycle and for up to 24 months to facilitate comparative annual benchmarking, after which they are securely purged. All digital transmissions are encrypted using Transport Layer Security (TLS 1.3).

5. Your Statutory Rights

Under UK GDPR, you maintain enforceable rights including:

• Right of Access (Subject Access Request): Request copies of personal data held.
• Right to Rectification: Request correction of inaccurate information.
• Right to Erasure: Request deletion of data where retention is no longer legally justified.
• Right to Withdraw Consent: Revoke SMS or marketing consent at any time by contacting us directly.

To exercise any statutory right, contact our Data Protection Officer at Contact@officeofbusinessefficiency.org. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.