Privacy Notice
Solico London Limited

This notice explains how Solico London Limited collects, uses and protects personal data, and the rights you have over your information. It applies to our work generally. Where we run a specific programme or project, we may give you a separate, more detailed notice for that activity, which sits alongside this one.

1. Who we are and how to contact us

Solico London Limited ("Solico", "we", "us") is the data controller for the personal data described in this notice. This means we decide how and why your personal data is used.

Company Solico London Limited (company number 13969851)
Address 167-169 Great Portland Street, 5th Floor, London W1W 5PF
Email privacy@solico.org.uk
ICO registration ZB571101

2. What this notice covers

This notice covers the personal data we handle in the course of running Solico, including when we provide consultancy and services to clients, deliver programmes and projects, and work with suppliers, contractors and associates. It does not form part of any contract and we may update it from time to time (see section 12).

3. The personal data we collect

The personal data we hold depends on your relationship with us. In general it may include:

  • Clients, business contacts and prospects. Name, job title, employer, business contact details, correspondence with us, and information needed to provide and bill for our services.

  • People on programmes and projects we deliver. Name and contact details, and information relevant to the support or service being provided, which may include monitoring information we are asked to collect by a funder or partner.

  • Suppliers, contractors and associates. Name, contact details, the information needed to engage and pay you, and records of the work.

  • People who contact us or use our website. Any details you give us when you get in touch, and limited technical information collected by our website (see section 9).

Special category data

Some of our work involves more sensitive personal data, known as special category data. In particular, we collect information about ethnicity, and we may in future collect health information, where this is needed, for example for equality monitoring or to deliver a programme appropriately.

We only collect special category data where it is necessary, and we rely on an appropriate condition under the UK GDPR in addition to a lawful basis. For equality monitoring, such as ethnicity, we rely on the substantial public interest condition for equality of opportunity or treatment set out in the Data Protection Act 2018. Where we collect health or other special category data for a different purpose, we will rely on the most appropriate condition, such as your explicit consent, and we will tell you which one at the point we collect it.

We keep special category data to a minimum, limit who can see it, and aggregate or anonymise it as soon as we can.

4. How we use your data, and our lawful bases

Under UK data protection law we must have a lawful basis for using your personal data. The main ways we use data, and the bases we rely on, are set out below.

  • Provide consultancy and deliver our services to clients. To carry out our work and meet our commitments to you. Our lawful basis is contract, where you are the client, or our legitimate interests in running our business and serving organisational clients.

  • Deliver programmes and projects, and support participants. To provide the support and services of the programme. Our lawful basis is our legitimate interests, or a contract, and, where we deliver on behalf of a public body, the performance of a task in the public interest.

  • Monitor and report on programmes to funders and partners. To meet funding and reporting requirements. Our lawful basis is our legitimate interests, and a legal obligation where one applies.

  • Manage relationships with suppliers, contractors and associates. To engage and pay them and manage the work. Our lawful basis is contract, and our legitimate interests.

  • Keep financial and business records. To run the business and meet tax and accounting duties. Our lawful basis is legal obligation, and our legitimate interests.

  • Respond to enquiries, rights requests and complaints. To deal with your query, request or complaint. Our lawful basis is our legitimate interests, and a legal obligation for data protection rights and complaints.

Where we rely on legitimate interests, we have considered whether this is fair to you and does not override your rights. You can ask us about this at any time.

5. Where we get your data from

Most of the personal data we hold comes directly from you. We may also receive personal data from our clients, for example where a client shares information with us so that we can carry out work for them. And we may receive limited information from others, such as a funder, partner or referring organisation where you take part in a programme, or from publicly available sources when we are getting in touch about our work.

6. Who we share your data with

We do not sell your personal data. We share it only where we need to, and with appropriate protections in place. Depending on the situation, this may include:

  • Service providers who process data on our behalf, such as our IT, cloud, email and document tools (for example Microsoft 365) and our accounting software. They act on our instructions under a contract.

  • Funders, commissioners and delivery partners, where a programme requires us to report on the support provided.

  • Professional advisers, such as our accountant or legal advisers, where needed.

  • Authorities or regulators, where we are required to share information by law.

7. Sending data outside the UK

We aim to keep your personal data within the UK or the European Economic Area. Some of our service providers may process data elsewhere. Where that happens, we make sure an appropriate safeguard recognised under UK data protection law is in place, such as UK adequacy regulations or standard contractual clauses with the UK addendum.

8. How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this notice, and then delete or anonymise it. How long that is depends on the type of data. For example, we keep financial records for as long as tax and company law requires, and programme data for the period agreed with the relevant funder. Our Data Retention Schedule sets out how long we keep each main type of record.

9. Cookies and our website

Our website is built on Squarespace and uses a small number of cookies. Some are strictly necessary for the site to work and to remember your cookie choice. Others are analytics cookies that count visitors and show how the site is used. We do not use Google Analytics or any other third party analytics or advertising tools, the analytics cookies are Squarespace's own.

When you first visit, a cookie banner lets you accept all cookies, manage your choices, or decline non-essential cookies. We hold the analytics cookies back until you accept them, and you can change your choice at any time using the cookie preferences control on the site.

Strictly necessary cookies

  • Crumb keeps the site secure by preventing cross-site request forgery. Kept for the session.

  • Test checks whether your browser supports cookies. Kept for the session.

  • ss_performancecookiesAllowed remembers your cookie choice. Kept for 30 days.

Analytics cookies, set only if you accept

  • ss_cid, ss_cpvisit, ss_cvr recognise unique visitors and track sessions on the site. Kept for up to 2 years.

  • ss_cvisit, ss_cvt track a single visit. Kept for 30 minutes.

The exact cookies can vary as the site changes. Squarespace keeps a current list of the cookies it uses, which we link to from the cookie banner.

10. Your rights

Under UK data protection law you have rights over your personal data. Depending on the lawful basis we rely on, these include:

  • Access, to ask for a copy of the personal data we hold about you.

  • Rectification, to ask us to correct data that is wrong or incomplete.

  • Erasure, to ask us to delete your data in certain circumstances.

  • Restriction, to ask us to limit how we use your data.

  • Objection, to object to our use of your data, including where we rely on legitimate interests.

  • Portability, to ask us to transfer certain data to you or another organisation.

To make a request, contact us at privacy@solico.org.uk. We will respond without undue delay and within one month. There are some exemptions, which may mean we cannot always action a request in full, and we will explain if that applies.

11. Your right to complain

If you are unhappy with how we have handled your personal data, you have the right to complain to us. We will acknowledge your complaint within 30 days and look into it. You can complain using our online complaint form at https://www.solico.org.uk/data-complaint, by emailing privacy@solico.org.uk, or in writing to the address in section 1. Our Data Protection Complaints Procedure explains how we deal with complaints.

You also have the right to complain to the Information Commissioner's Office (the ICO), the UK's data protection regulator, at any time. We would ask you to raise your concern with us first so we have the chance to put things right.

ICO post Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ICO helpline 0303 123 1113
ICO online www.ico.org.uk/make-a-complaint

12. Changes to this notice

We may update this notice to reflect changes in how we work or in the law. When we make significant changes, we will update the version and date at the top, and where appropriate we will tell you.

This notice does not affect any separate, programme-specific privacy notice we may give you, which will provide additional detail for that activity.