3Kites - Privacy policy

3Kites Consulting – Privacy Policy

Personal data held by us

We hold and process personal data which we have captured from

Business cards/contact details given to us,

Correspondence and documentation we have created,

Correspondence and documentation sent to us, or

Public sources, such as organisations’ websites.

The information we hold is subject to certain legal safeguards specified in the UK General Data Protection Regulation (GDPR), the Data Protection Act, 2018 (DPA) and other legislation (collectively referred to as the DP Legislation). The DP Legislation imposes restrictions on how we may process that information.

3Kites Consulting Limited is the data controller for the personal data described in this policy. Our registered office is Chancery House, 30 St. Johns Road, Woking, GU21 7SA, and our company number is 5644909.

How we use your personal information 

a) Legitimate interests

3Kites Consulting may process personal information for the legitimate interests of our business.  In particular, in order to contact individuals in the course of an engagement or potential engagement for a client, or otherwise as is necessary to perform our duties in the course of an engagement, in order to market ourselves (for example, in order to inform individuals of our services, providing articles and commentary and inviting individuals to events), in order to issue or pay invoices, or in order to enquire about other organisations’ products and services.  

We believe that these activities form part of a relevant and appropriate relationship between us and other organisations or individuals and that our use of personal information is within the reasonable expectations of the data subjects whose personal information we hold.

Legitimate interests means our interests in conducting and managing our business to enable us to give our clients the best possible service, to be informed about products and services available and to send out marketing information that is relevant to the recipients.

When we process personal information for our legitimate interests we make sure to consider and balance any potential impact on the individual (both positive and negative) and their rights under data protection laws.  Our legitimate interests do not automatically override the individual’s interests.

We will not use personal data for activities where our interests are overridden by the impact on the individual (unless we have their consent or are otherwise required or permitted to do so by law). 

Personal data will only be processed for the specific purposes notified to the data subject when the data was first collected or for any other purposes specifically permitted by the GDPR. Personal data will not be collected for one purpose and then used for another. If it becomes necessary to change the purpose for which the data is processed, the data subject will be informed of the new purpose before any processing occurs.

b) Consent

For the purposes of EU e-privacy legislation, we seek to obtain consent to our direct marketing by email.

You may withdraw your consent at any time by emailing contact@3kites.com with UNSUBSCRIBE in the header.

Security

We keep personal data in secure systems and co-ordinate our marketing and other activities in order to avoid contacting individuals with an unreasonable level of frequency.  We will never sell individuals’ personal details to other organisations.

We take systematic steps to keep personal data up to date and to delete data which is no longer needed.

We rely solely on UK and EU hosted service providers.

Third parties and processors

We may share personal data with trusted third‑party service providers who support the operation of our business, such as cloud hosting providers, IT and communications services, accounting and finance systems, and professional advisers. These third parties process personal data only on our instructions and are subject to appropriate contractual obligations to protect confidentiality and security. We do not sell personal data to third parties.

Data retention

We take systematic steps to keep personal data up to date and to delete data which is no longer needed. In particular, if you wish to be deleted or unsubscribe from our direct marketing email lists we will promptly delete your personal data, except where we need to retain a record that you do not wish to be contacted by us.

Your rights

You have certain rights under data protection laws in relation to your personal data. In particular, you have the right to

Request access to your personal data,

Request correction of the personal data that we hold about you,

Request erasure of your personal data,

Object to processing of your personal data when we are relying on a legitimate interest and there is something about your personal situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms,

Request restriction of processing of your personal data, and

Request the transfer of your personal data to you or a third party.

If you have any questions about this policy or how we handle personal data, please contact us at contact@3kites.com and we will deal with your request in accordance with applicable data protection law.

Complaints

You have the right to make a complaint at any time to the Information Commissioner's Office ("ICO"), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

3Kites Consulting, March 2026