Stop renting compliance.
Start building capability.

The data controller is Resilient Tech Risk and Control Ltd, trading as Resilient Control (“we”, “us”), a private company limited by shares registered in England and Wales under company number 17500049. For any privacy question or request, email sainul.hossain@resilientcontrol.co.uk.

• Contact details you give us when you email, call or message us — name, job title, organisation, email address and phone number.
• Correspondence and meeting notes from consultations and engagements.
• Business information shared during an engagement, which may include personal data about your staff or third parties (for example, control owners named in a risk register).
• Technical data — our hosting provider automatically processes IP addresses and basic request information in server logs to deliver and secure the website.

We do not intentionally collect special category data. Please don't send it to us unless an engagement specifically requires it and we have agreed how it will be protected.

• Responding to enquiries and arranging consultations — legitimate interests (running and promoting our business), or steps taken at your request before entering into a contract.
• Delivering services — performance of a contract with you or your organisation.
• Accounting, tax and legal obligations — legal obligation.
• Operating and securing this website — legitimate interests.
• Occasional business updates to existing contacts — legitimate interests, and you can opt out at any time. We never sell your data.

We share personal data only where necessary, with service providers acting on our instructions: our website host (Microsoft Azure), our domain and email provider, accounting and professional advisers, and secure document-storage providers. We may disclose data where required by law or a regulator. All information shared during a consultation or engagement is treated as strictly confidential.

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

• Enquiries that do not lead to an engagement: up to 24 months from last contact.
• Engagement records and correspondence: 6 years after the engagement ends, for legal and contractual purposes.
• Accounting records: as required by UK law (normally 6 years).
• Client data shared during an engagement: returned or securely deleted at the end of the engagement, unless the contract says otherwise.

We apply security controls appropriate to the sensitivity of the data, including encryption in transit and at rest, multi-factor authentication, least-privilege access and secure disposal. As a technology risk practice, we hold ourselves to the standards we recommend to clients.

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased in certain circumstances;
• restrict or object to our processing, including objecting to direct marketing at any time;
• data portability, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where we rely on consent.

To exercise any right, email us. We will respond within one month and will not normally charge a fee.

This website does not set cookies and does not use analytics, advertising or tracking technologies, so no cookie banner is required. If that changes, we will update this notice and ask for your consent where the law requires it.

Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.