Privacy Policy

Our privacy policy gives you information about how Geodesic Partners collects and uses your personal data belonging to you or your personnel in the context of providing advisory services to you or your business, through your use of the firm's website, or any of the other ways we interact, as set out in more detail below.

1. Important information & who we are

Controllers and Processors

The Geodesic Group is made up of different legal entities, details of which are set out in the introduction above. This privacy policy is issued on behalf of the Geodesic Group so when we refer to it as such or by substitutions such as we, us, or our, in this privacy policy, we are referring to the relevant entity in the Geodesic Group responsible for processing your data. Where we provide a service to you, the ultimate controller of your data is likely to be the specific entity providing that service. In most cases, this will be the LLP. The Company operates and maintains our website and acts as a controller of technical and usage data collected in that context. However other data you actively provide via the website is collected on behalf of the LLP at controller, pursuant to management services the Company provides to it.

2. The personal data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Identity data includes first name, last name, any previous names, username or similar identifier, marital status, title, date of birth, gender, and identifying photographic or videographic materials.
Contact data includes billing addresses, delivery addresses, email addresses and telephone numbers.
Financial data includes bank account and payment card details.
Transaction data includes details about payments to and from you and other details of products and services you have purchased from us.
Technical data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website.
Profile data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
Usage data includes information about how you interact with and use our website, products and services.
Marketing data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
Special category and criminal offence data includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, genetic and biometric data, and information about criminal convictions and offences. We do not generally seek to collect these categories. However, such data may occasionally be provided to us incidentally, for example within documents or communication you or your business share with us in the course of an engagement.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ usage data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

The firm's website is not intended for children and we do not knowingly collect data relating to children.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of our engagement with you (as set out in an engagement letter or other applicable terms of business), and you fail to provide that data when requested, we may not be able to perform the services set out in the engagement letter.

3. How is your personal data collected?

We have grouped together the different methods we use collect data from and about you and the circumstances in which we do so into the following two categories:

proactive collection, which applies to data you actively provide to us, give us access to, or consent to us collecting from a third party; and
passive collection, which applies to data we collect automatically or from public sources without reference to you.

Proactive collection

We proactively collect data about you when you engage with us in the following ways:

In the process of carrying out work for you (or your business) where we will in almost all instances act as a controller. In very limited circumstances we may act as a processor (we process the data only on your instructions, for example if we are handling data on behalf of your business rather than for our own business purposes) in which case we will let you know and ensure that an appropriate contract is put in place.

When we communicate with you by email or other electronic correspondence, by telephone or using video conferencing software. You may give us your identity, contact and financial data by corresponding with us by email, by post or otherwise, filling in forms via or website, or communicating it to us by telephone or video call, by instant message or otherwise. This includes personal data you provide when you:

make a request for our services or submit a contact form;
subscribe to our publications or request marketing to be sent to you;
complete a survey or provide us with feedback;
submit a job application to us;
attend networking events (either online or in-person) organised by us or on our behalf;
use of any guest Wi-Fi service we may provide or by virtue of any CCTV footage we may have access to where you attend our place(s) of business; or
otherwise engage with us and we provide services to you in connection with an engagement or potential engagement for advisory services.

Passive collection

We also collect data from and about you passively via our website and other online or public sources:

Through automated technologies or interactions. As you interact with our website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. See our cookie notice for further details.
Through third parties or publicly available sources. We may receive personal data about you from third parties, such as your employer, our clients and service providers. We may also obtain personal data about you ourselves by searching publicly available sources, such as Companies House.
technical data is collected from analytics providers, such as Google and Squarespace, based outside the UK; advertising networks, such as LinkedIn, based outside the UK; and service providers we use to run our business, such as Xero, HubSpot, and Toggl.
Contact, financial and transaction Data from providers of technical, payment and delivery services.
Identity and contact data from publicly available sources such as Companies House and the Electoral Register based inside the UK.
Identity and contact data from third parties connected to our work for you, such as your colleagues, other advisers, partners, suppliers and stakeholders involved in a project, and from information contained in documents shared with us in the course of an engagement.

4. How we use your personal data

Lawful basis for processing

The law requires us to have a lawful basis for collecting and using your personal data. We rely on one or more of the following lawful bases.

Performance of a contract with you: Where we need to perform the contract, we are about to enter into or have entered into with you.
Legitimate interests: Where it is necessary for our legitimate interests (or those of a third party), and your interests and fundamental rights do not override those interests. Our legitimate interests include delivering our services and managing our relationships with clients, prospective clients and their staff; running and administering our business; keeping our systems and information secure; and meeting our professional and contractual responsibilities. Before relying on legitimate interests, we consider whether our use of your data is necessary for the relevant purpose and whether using it would reasonably be expected in the circumstances. You can object to this use at any time (see section 3 below). We do not rely on legitimate interests to send you marketing communications.
Legal obligation: Where we need to comply with a legal obligation to which we are subject.
Consent: We rely on consent only where we have asked for your specific agreement to use your personal data for a particular purpose, for example if you subscribe to our newsletter. This is separate from agreeing to our terms of engagement: where we need your personal data to provide our services, we rely on performance of a contract instead. You can withdraw your consent at any time, and this will not affect the services we provide to you.

Special categories of data

We do not generally seek to collect special categories of data or criminal offence data. Where it is provided to us in connection with an engagement or potential engagement, we will only process it:

Where our advisory services require it and we have obtained your explicit consent, in which case we will not use this data for any purpose other than the engagement or matter in connection with which it was provided. You may withdraw your consent at any time; if we have no other lawful basis to continue processing that data, we will delete it.
Where another condition under data protection law applies, for example where it is necessary to establish, exercise or defend legal claims.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Purpose/Use	Type of data	Lawful basis
To carry out client onboarding checks, including conflict of interest checks and, where applicable, identity, sanctions and fraud checks	Identity Contact Financial	Performance of a contract with you Necessary to comply with a legal or regulatory obligation Public interest Necessary for our legitimate interests (to detect and prevent the commission of fraud, money laundering and terrorism offences)
To deliver our services to you including engaging service providers, managing payments, fees and charges and collecting and recovering money owed to us	Identity Contact Financial Transaction Marketing	Performance of a contract with you Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you which will include notifying you about changes to our terms or privacy policy	Identity Contact Profile Marketing	Performance of a contract with you Necessary to comply with a legal obligation Necessary for our legitimate interests (to keep our records updated and to study how customers and clients use our products and services)
To enable you to complete a survey	Identity Contact Profile Usage Marketing	Performance of a contract with you Necessary for our legitimate interests (to study how customers and clients use our products and services, to develop them and grow our business)
To administer and protect our business and our website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	Identity Contact Technical	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) Necessary to comply with a legal obligation
To deliver relevant website content to you and measure or understand the effectiveness of the marketing we provide to you	Identity Contact Profile Usage Marketing Technical	Necessary for our legitimate interests (to study how customers use our products and services, to develop them, to grow our business and to inform our marketing strategy)
To use data analytics to improve our website, products and services, marketing, customer relationships and experiences	Technical Usage	Necessary for our legitimate interests (to define types of clients and customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To make suggestions and recommendations to you about services that may be of interest to you	Identity Contact Technical Usage Profile Marketing	Consent

Direct marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We may use your identity, contact, technical, usage and profile data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

We will only send you marketing communications, such as newsletters, insights or event invitations, where you have agreed to receive them. You can withdraw your consent at any time by following the unsubscribe link in any message or by contacting us.

Third-party marketing

We will get your express opt-in consent before we share your personal data with any third party for marketing purposes.

Opting out of marketing

You can opt out of marketing communications at any time by clicking the ‘unsubscribe’ or ‘opt-out’ link included in any message sent by us or on our behalf.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes, notably in relation to any mandate you have engaged us on.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, see our cookie notice.

5. Disclosures of your personal data

We require all third parties to whom we disclose your personal data to respect its security and integrity and to treat it in accordance with the law. The categories of third party we might share your personal data with for the purposes described in section 4 are set out below.

Software and online service providers: Providers of the software and online services we use to run our business: Google Workspace (email and document storage), Squarespace (website hosting), Xero (accounting), HubSpot (client relationship management and email communications), and Toggl (time recording). These providers process personal data on our behalf under applicable data processing terms. Toggl may also use some personal data for its own limited purposes as an independent controller, as described in Toggl’s privacy policy.
Banks and payment service provider: HSBC UK Bank plc and Wise Payments Limited, to make and receive payments. They act as independent controllers and use your personal data in accordance with their own privacy notices, including to meet their legal obligations relating to fraud and money laundering.

Business counterparties: Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.
Professional advisers, such as:
- our accountants, Burgess Hodgson LLP, who have access to the information held in our accounting system (Xero). For clients and suppliers, this is typically contact details, bank and invoicing details, VAT number and the amounts invoiced or paid;
- any legal advisers we may appoint, where we need independent legal advice, for example in connection with an engagement or a dispute; and
- any IT support providers we may appoint, who may have access to our systems and the information held on them when maintaining and securing them.
Other members of the Geodesic Group: Where reasonably required to provide our services or to run our business; in particular the LLP may give the Company access to your personal data to facilitate corporate services the Company provides to it.
Relevant Authorities: HM Revenue & Customs, regulators, law enforcement and other authorities, where we are required or permitted by law to share information.

Except as described above, we do not allow them to use your personal data for their own purposes. Our service providers act under written contracts that require them to process your personal data only on our instructions, keep it confidential and secure, and delete or return it when our services end, and our professional advisers are subject to professional or contractual duties of confidentiality.

6. International transfers

We may transfer your personal data to service providers that carry out certain functions on our behalf, such as email and document storage (Google Workspace), accounting (Xero), Squarespace (website hosting), client relationship management (HubSpot), and time recording (Toggl). This may involve transferring personal data outside the UK, including to the European Economic Area (EEA), the United States, New Zealand and Australia, some of which have laws that do not provide the same level of data protection as UK law.

Whenever we transfer your personal data out of the UK to service providers, we ensure a similar degree of protection is afforded to it by ensuring that at least one of the following safeguards is in place:

We transfer your personal data to countries that have been deemed by the UK to provide an adequate level of protection for personal data, namely the countries of the EEA and New Zealand (under the UK’s adequacy regulations), and the United States where the recipient is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US data bridge).
Where a country is not covered by UK adequacy regulations, we use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers. To obtain a copy of these contractual safeguards, please contact us using the details in section 10 below.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

8. Data retention

We will generally only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, unless circumstances arise after it has been collected that require it to be retained for a longer or shorter period. These circumstances include:

if you make a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you; and
deleting your data in accordance with a request you may make (see Erasure under section 9 below), and there is no overriding requirement for us to retain it.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

More details of retention periods that apply to different aspects of your personal data and how they are determined in our data retention policy which can be obtained by contacting us.

9. Your rights and how to exercise them

Data protection rights

You have the following rights in relation to your personal data under data protection laws.

Access: Request access to your personal data (commonly known as a subject access request). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Correction: Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Erasure: Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. We may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Objection: Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the lawful basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
Opt-out: Where we rely on your consent to use your personal data (see the table in section 4), you can withdraw it at any time. This will not affect any processing carried out before you withdraw it. You also have the absolute right to object at any time to our use of your personal data for direct marketing (see Opting-out of marketing in section 4 above).
Transfer: Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Restriction: Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

if you want us to establish the data's accuracy;
where our use of the data is unlawful but you do not want us to erase it;
where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

If you wish to exercise any of the rights set out above, please contact us using the details set out in section 10 below.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. Contact details

If you have any questions about this privacy policy or about the use of your personal data or you want to exercise your privacy rights, please contact us in the following ways:

By email at: feedback@geodesicllp.com

By post at: Geodesic Partners LLP, New Wing, Somerset House, London WC2R 1LA, United Kingdom

11. Complaints

Where you consider there has been a breach of your rights or our obligations in relation to your personal data, you have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

12. Changes to this policy or to your data

We keep our privacy policy under regular review. This version was last updated in October 2026. Historic versions can be obtained by contacting us.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

13. Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.