Privacy Policy

This notice explains how Cahoot Consulting Ltd processes personal data under UK GDPR and the Data Protection Act 2018. Some placeholder items (cookie table, live sub-processor list) are completed at go-live.

1. Who we are

Cahoot Consulting Limited (“Cahoot”, “we”, “us”, “our”) provides ISO consultancy and supplier due diligence / assurance reporting under the Hume brand.

We are the data controller for personal data we collect about clients and prospective clients (people who enquire, complete intake, pay, or receive reports).

For personal data about supplier personnel — whether we collect it from public sources (OSINT) or it appears in a redacted agreement you upload — we act as your data processor on your instructions to prepare your report (see Section 8); you remain the controller of that data. Where we determine purposes independently (e.g. our own business records), we are controller.

2. Scope of this policy

This policy explains how we collect, use, store, and share personal data when you:

• visit our website or intake forms;
• purchase or receive a Hume report or a Hume Watch subscription;
• communicate with us by email or otherwise.

It does not cover third-party websites we link to (Companies House, supplier sites, Stripe checkout, etc.).

3. What personal data we process

3.1 Data you give us (clients)

We ask you not to submit personal data or commercially sensitive information in intake fields or uploads except where the service explicitly requires it (PII pack and above: redacted agreement only). See Section 6.

3.2 Data you give us about suppliers (not your personal data)

To run checks we process supplier identifiers you provide:

• legal entity name;
• Companies House number (UK);
• primary domain / website;
• (T1+) redacted contractual documents.

These may contain third parties’ personal data (e.g. signatories, directors named in agreements). You are responsible for ensuring you have a lawful basis and any required consents before sharing such documents with us.

3.3 Data we collect automatically

We use no third-party analytics on our intake forms at present. If this changes, we will update this policy and cookie notice.

3.4 Data we obtain from public sources (OSINT)

Our reports are built from publicly available sources (Companies House, UK government registers, supplier public legal pages, DNS/technical records, accreditation databases, sanctions lists, etc.). That evidence may include personal data about supplier personnel already published by law (e.g. Persons with Significant Control). We do not use AI to determine findings; evidence is collected by automated and manual OSINT rules.

3.5 What we process about you, and how — by tier

At every tier (the entry report and above):

• You can keep it non-identifying. You may ask us to return your report to a generic, role-based email address (for example info@yourcompany.org). If you do, we process no personal data identifying an individual — only your organisation (inferred from the email domain) and the procurement context described below.
• If you give us your name — whether in your email address or separately — we process it only to: (a) return your report and provide related after-sales service; and (b) send you marketing about Hume. You may opt out of marketing at any time, and opting out does not affect delivery of your report.
• The one commercially sensitive fact. The only potentially commercially sensitive information you give us is that your organisation is considering procuring a particular product or service from a particular supplier. We process that information solely to prepare your report and to maintain the audit and accounting records we are required to keep (see Section 7). We do not disclose it to the supplier, and we do not share it except as set out in Section 5.

At the higher packs (PII and above), where you upload a supplier agreement for review:

• We parse the document, extract only the information relevant to the checks you have ordered, and redact everything else.
• The uploaded document is retained for one month and then deleted (see Section 7). Relevant extracted information is kept with your report under Section 7.
• You remain the controller for any third-party personal data in the document (Section 8); please redact any personal data we do not need before uploading.

4. How we use personal data (lawful bases)

We do not sell personal data. We do not use client data to train AI models.

5. Who we share data with (sub-processors and recipients)

Challenge to “contact details only”: In operating Hume we share data beyond client contact details. The table below reflects the current and planned stack (see Technology-Stack-and-Platform.md). Update before go-live.

Public OSINT queries: When we query government registers and supplier websites, we transmit supplier identifiers in HTTP/API requests. Those third parties process data under their own policies. We do not “share” your contact details with those sources except where a register query is traceable to our IP address.

A live sub-processor list will be published at [URL] and updated when we add or change providers.

6. Your obligations — do not send us what we do not need

Standard and Commercial packs: We only need supplier identifiers and your business contact details. Do not include:

• personal data about your staff, customers, or patients in free-text fields;
• unredacted commercial terms, pricing, or trade secrets;
• special category data (health, ethnicity, etc.) or criminal offence data.

PII pack and above: Upload only a redacted executed agreement. Redact at minimum: personal names and direct contact details of individuals (except where necessary to show party identity), customer/patient/employee lists, pricing, trade secrets, and security configurations.

If you send us personal or sensitive data by mistake: Tell us promptly at cath@cahootconsulting.com. We will delete it as soon as reasonably practicable unless we must retain it for legal reasons, and we will tell you what we did.

7. Retention

Retention may be longer if required for dispute, regulatory, or insurance purposes.

8. Processor role (supplier personal data)

Where you provide supplier identifiers or redacted agreements so we can deliver your report, you are typically the data controller for any personal data about supplier personnel contained in that material, and we act as your processor under UK GDPR Article 28.

A Data Processing Agreement (DPA) is available on request for the PII pack and above, and enterprise clients. Standard and Commercial packs: processing is limited to public OSINT and incidental personal data in public filings; many clients rely on legitimate interests / procurement necessity rather than a full DPA — your DPO should confirm.

We process supplier-related data only on your documented instructions (the order, intake, and these terms), unless required by law.

9. International transfers

Your personal data is hosted and processed primarily in the United Kingdom. Our intake application and its data are hosted on Google Cloud Platform in Google's London region (europe-west2), and Cahoot is a UK-established data controller regulated by the ICO. Your relationship with us is governed by UK data protection law (UK GDPR and the Data Protection Act 2018).

Some processing takes place outside the UK:

report, our assessor accesses and processes personal data from Spain. This is a transfer of personal data from the UK to an EEA country. The UK Government has determined that the EEA provides an adequate level of protection (UK adequacy regulations), so this transfer is made on the basis of that adequacy finding and requires no additional safeguards.

outside the UK/EEA. Where they do, we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs, or the provider's Binding Corporate Rules, as appropriate.

• Our assessor operates from Spain (EEA). To prepare and review your
• Certain sub-processors (see Section 5) may process limited personal data

Copies of transfer safeguards are available on request.

10. Security

We apply appropriate technical and organisational measures, including:

• access controls and least-privilege for operator accounts;
• encryption in transit (HTTPS/TLS);
• password-protected or tokenised report delivery;
• secure storage for uploaded contracts;
• no storage of card details (Stripe handles payments).

No method of transmission is 100% secure. We cannot guarantee absolute security.

11. Your rights

If we process your personal data as controller, you have rights under UK GDPR:

• Access — copy of your personal data;
• Rectification — correct inaccurate data;
• Erasure — in certain circumstances;
• Restriction — limit processing in certain circumstances;
• Object — to processing based on legitimate interests (including direct marketing);
• Data portability — where processing is by automated means under contract/consent;
• Withdraw consent — where processing is based on consent;
• Complain to the ICO: https://ico.org.uk/make-a-complaint/

To exercise rights: cath@cahootconsulting.com. We respond within one month (extendable for complex requests).

12. Cookies and similar technologies

[Complete before publication]

We do not use non-essential cookies without consent where PECR requires it. Stripe and form-host cookies may apply during checkout / submission.

13. Children

Our services are for business users. We do not knowingly collect data from anyone under 18.

14. Changes

We may update this policy. Material changes will be posted on our website with a new “last updated” date. Continued use after changes constitutes notice; for material reductions in your rights we will seek renewed consent where required.

Last updated: 22 June 2026

Document control