Privacy Policy

Who we are

CBS Business Consulting Ltd, trading as CBS Change Partners (“CBS”, “we”, “us” or “our”), is the controller of the personal data described in this policy.

Company number: SC308891. Email: info@cbschangepartners.co.uk. Postal address: 83 Princes Street, Edinburgh, EH2 2ER. We also have an office at 3 More London Riverside, London, SE1 2RE.

This policy applies to personal data collected through our website (including HubSpot forms, website chat and insights subscriptions), HubSpot Meetings bookings, LinkedIn Lead Gen Forms, and related business communications.

Personal data we collect

Depending on how you interact with us, we may collect:

• name and contact details (such as email address and, where provided, telephone number);
• professional details (such as company name and job title or role);
• the content of an enquiry, content request, chat conversation, meeting booking or expression of interest in working with CBS;
• marketing preferences and records of objections or unsubscribes; and
• technical and usage information from our website, such as IP address, browser or device type, pages viewed and interactions, via HubSpot and related site tools.

You do not have to give us your details, but we need them to respond to you or send the content you ask for.

We do not ask you to provide special category data (such as health or political opinions) through these channels. Please do not include that kind of information in free-text fields.

Where the data comes from

Most data comes directly from you when you submit a form, chat with us, book a meeting or complete a LinkedIn Lead Gen Form. Some technical data is collected automatically when you use the website. LinkedIn may also pre-fill Lead Gen Form fields from your LinkedIn profile before you choose to submit them to CBS.

How and why we use personal data

We use HubSpot as our customer relationship management (CRM) and marketing platform to store form submissions, manage contacts and send communications.

Our legitimate interests include responding to professional contacts, providing requested materials, developing our consultancy business in a proportionate way, and keeping our systems secure. We take into account that LinkedIn may supply a personal email address, and we do not treat that as a licence for unrestricted marketing.

Marketing and your right to object

You can ask us to stop using your personal data for direct marketing at any time. Use the unsubscribe link in a marketing email, or email info@cbschangepartners.co.uk.

Some free content, such as our horizon scan, is offered on the basis that you agree to receive occasional emails from us. You can unsubscribe at any time, including straight away, and still keep the content.

Electronic marketing is also regulated by PECR. We only send marketing emails to a personal email address with your consent. Before making any unsolicited marketing call, we check the number against the Telephone Preference Service (TPS) or Corporate Telephone Preference Service (CTPS). Where we rely on legitimate interests for business contact, you still have an absolute right to object to direct marketing. If you object or unsubscribe, we may keep a minimal suppression record so we do not contact you again by mistake.

Cookies and website analytics

Our website uses cookies and similar technologies, including tools provided through HubSpot. Details are set out in our Cookie Policy.

Who we share data with

We do not sell personal data. We share it only where needed with trusted service providers that help us run the website and our business, including:

• HubSpot — forms, CRM, email, chat, meetings and website analytics;
• LinkedIn — when you submit a Lead Gen Form (LinkedIn also processes data as a separate controller for its platform);
• our website hosting provider (currently Vercel);
• content delivery providers (Google Fonts, cdnjs by Cloudflare and the jQuery CDN), which receive your IP address when your browser loads fonts and code libraries for our pages; and
• professional advisers or other processors where required for legal or business administration.

We may also disclose data where required by law, to protect CBS or others, or in connection with a corporate transaction. Providers that process personal data for us are expected to do so under appropriate contractual terms.

International transfers

Our HubSpot account uses HubSpot’s EU data centre. Some providers (including HubSpot, LinkedIn, our hosting provider and content delivery providers) may still process or access personal data outside the UK, including in the United States. Where that happens, we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations or approved contractual transfer tools, as applicable to that provider.

How long we keep personal data

We keep personal data only for as long as it is needed for the purpose for which it was collected.

• Enquiry and content-request contacts stored in HubSpot are reviewed at least every 24 months. If there is no ongoing relationship or legitimate reason to retain them, we delete or anonymise them.
• After an unsubscribe or marketing objection, we may keep a minimal suppression record.
• Technical logs and analytics data are kept only for as long as needed for security and site improvement.

Security and automated decisions

We use appropriate technical and organisational measures to protect personal data, including limiting access to people and providers who need it for their work. HubSpot and our other providers also apply their own security controls.

We do not use the personal data covered by this policy to make decisions based solely on automated processing that have legal or similarly significant effects on you.

Your data protection rights

Under the UK GDPR and the Data Protection Act 2018, you may have the right to:

• be informed about how your data is used;
• request access to your personal data;
• ask us to correct inaccurate or incomplete data;
• ask us to erase data in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to processing based on legitimate interests, and object at any time to direct marketing;
• receive certain data in a portable format; and
• withdraw consent where processing is based on consent.

These rights are not always absolute. To exercise a right, email info@cbschangepartners.co.uk. We may need to confirm your identity. We will respond within one month. If a request is complex or we receive several from you, we may extend this by up to two further months and will tell you why.

Complaints and other websites

If you are unhappy with how we have used your personal data, you can complain to us by emailing info@cbschangepartners.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO). Visit ico.org.uk/make-a-complaint or call 0303 123 1113.

Our website may link to other sites and platforms. Their use of personal data is governed by their own privacy information.