Privacy Policy

Version: 1.4

Effective Date: 15 July 2022

Review Date: 15 July 2023

Registered Address: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ

1. Purpose and Commitment

Equity Sherpa is committed to protecting the privacy and security of personal data. The
company complies with the UK General Data Protection Regulation (UK GDPR) and the Data
Protection Act 2018.

The company ensures that personal data is processed lawfully, fairly, and transparently, and that
appropriate safeguards are in place to protect it.

2. Scope

This policy applies to all personal data collected, stored, or processed by Equity Sherpa. It
applies to all directors and employees of the company (this will be a three-person consultancy
that might also use associates). It also applies to contractors, consultants, and any third parties
acting on behalf of the company.

3. Data Collection and Use

Equity Sherpa collects only the personal data necessary for the provision of its strategy and
training services. Personal data is used solely for business purposes, such as communication
with clients, managing contracts, and fulfilling legal or regulatory obligations.

4. Data Storage and Security

  • Personal data is stored securely on encrypted hard drives and within secure cloud
    services hosted in the UK/EU.
  • The company does not transfer personal data outside the UK or the EU.
  • Appropriate technical and organisational measures are in place, including:
  • ○ Strong passwords
    ○ Full-disk encryption on all devices
    ○ Multi-factor authentication
    ○ Up-to-date anti-virus protection

5. Data Retention Schedule

Personal data will be retained only for as long as necessary to fulfil the purposes for which it was collected, and to comply with legal and regulatory requirements. Standard retention periods are:

  • Client records: 6 years after the end of the client relationship (in line with standard
    business and tax requirements).
  • Employee and associate records: 6 years after termination of engagement.
  • Financial and invoicing records: 6 years, in compliance with HMRC requirements.

At the end of the retention period, data will be securely deleted or anonymised.

6. Incident Response Procedure

In the event of a suspected or actual data breach:

  1. The incident must be reported immediately to a director.
  2. The director will investigate the nature and scope of the breach.
  3. If personal data is compromised, the company will notify the Information Commissioner’s Office (ICO) within 72 hours, in line with UK GDPR requirements.
  4. Affected individuals will be informed promptly if the breach poses a high risk to their
    rights or freedoms.
  5. Corrective measures will be taken to prevent recurrence.

7. Rights of Individuals under UK GDPR

Individuals whose personal data is held by Equity Sherpa have the following rights:

  • Right of access – to request a copy of the personal data held.
  • Right to rectification – to request correction of inaccurate or incomplete data.
  • Right to erasure – to request deletion of personal data when it is no longer necessary
    or lawfully required.
  • Right to restrict processing – to request limited use of their data in certain
    circumstances.
  • Right to data portability – to request that personal data be transferred to another
    organisation in a commonly used format.
  • Right to object – to object to the processing of personal data where applicable.

Requests should be directed to the company directors, who will respond within the statutory
timeframe.

8. Review and Oversight

This policy will be reviewed annually or sooner if required by changes in legislation or business practices.

Let's Talk

To help scale the equity value of your firm,

speak to the experts.

Google reCaptcha: Invalid site key.