Ethica Consulting Ltd: Privacy Notice

---

Ethica Consulting Ltd: Privacy Notice

Last updated: October 2026

1. Introduction and Important Information

This Privacy Notice applies between you, the user of this website, and Ethica Consulting Ltd ("we", "us", or "our"), the owner and provider of this website. Ethica Consulting Ltd respects your privacy and is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act.

This privacy notice informs you of how we collect, handle, and look after your personal data when you visit our website (regardless of where you visit it from), when you make an enquiry, or when you engage our adult social care consultancy, mock inspection, and governance advisory services. It also informs you of your legal rights and how the law protects you.

This website is not intended for children, and we do not knowingly collect data relating to children via this website.

2. Data Controller and Contact Details

Ethica Consulting Ltd is the data controller responsible for your personal data.

Company details:

• Company Name: Ethica Consulting Ltd
• Company Registration Number: 16996972 (Incorporated in England and Wales)
• Registered Office Address: 124-128 City Road, London, EC1V 2NX
• Telephone: 0203 576 7712 or 07479 557239
• Data Protection Officer: Adam Tighe
• Designated Data Protection Email: dpo@ethica-consulting.co.uk
• General Enquiries: hello@ethica-consulting.co.uk

3. Third-Party Links

This website may include links to third-party websites, plug-ins, and external applications (such as social media platforms or statutory bodies like the Care Quality Commission). Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

4. The Personal Data We Collect About You

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

• Identity Data: First name, last name, title, professional role, or job title.
• Contact Data: Business address, postal address, email address, and telephone numbers.
• Professional and Care Service Data: Care provider name, CQC location or provider ID, service type (such as supported living, residential care, or domiciliary care), and information provided during compliance audits, mock inspections, or governance reviews.
• Technical Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Usage Data: Information about how you use our website, pages viewed, time spent on pages, and navigation paths.
• Marketing and Communications Data: Your preferences in receiving regulatory updates, newsletters, or marketing communications from us.

We also collect, use, and share Aggregated Data (such as statistical or demographic data) for website performance analysis. Aggregated Data is derived from your personal data but is not considered personal data in law because it does not directly or indirectly reveal your identity.

Special Categories of Personal Data: We do not collect special categories of personal data about website visitors (such as race, ethnicity, religious beliefs, sex life, sexual orientation, political opinions, or trade union membership). In the course of delivering adult social care consultancy services, any review of care records or clinical files is undertaken strictly under confidentiality agreements, relying on anonymised or pseudonymised information where possible, in accordance with applicable healthcare and data protection standards.

If you fail to provide personal data: Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract (for example, to provide you with compliance reviews or mock inspections). In this case, we may need to cancel a service you have with us, but we will notify you at the time. 

5. How We Collect Your Personal Data

We use different methods to collect data from and about you, including:

• Direct Interactions: You may give us your Identity and Contact Data by filling in contact forms on our website, scheduling consultations, emailing us, telephoning us, or requesting audit support.
• Automated Technologies: As you interact with our website, we automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this data using cookies and server logs. Please review our Cookie Policy for full details.
• Third Parties or Publicly Available Sources: We may receive personal data about you from analytics providers (such as Google Analytics), public registers (such as Companies House), or official regulatory registers (such as the Care Quality Commission public database).

6. Purposes for Which We Use Your Personal Data

We will only use your personal data when the law allows us to. Below is a structured description of all the ways we plan to use your personal data, along with the lawful bases we rely upon:

• Registering you or your care business as a new client:
  • Type of data: Identity and Contact Data.
  • Lawful basis: Performance of a contract with you.
• Delivering consultancy support, mock CQC inspections, and governance action plans:
  • Type of data: Identity, Contact, and Professional and Care Service Data.
  • Lawful basis: Performance of a contract with you, and legitimate interests (to provide tailored professional compliance advice).
• Managing our professional relationship (including notifying you of changes to our terms or privacy notice):
  • Type of data: Identity, Contact, and Marketing and Communications Data.
  • Lawful basis: Performance of a contract with you, compliance with a legal obligation, and legitimate interests (to keep our records updated).
• Administering and protecting our website and business (troubleshooting, system maintenance, and security):
  • Type of data: Identity, Contact, and Technical Data.
  • Lawful basis: Legitimate interests (for running our business, provision of administration and IT services, and network security), and compliance with a legal obligation.
• Delivering relevant website content and measuring the effectiveness of our resources:
  • Type of data: Identity, Contact, Usage, and Technical Data.
  • Lawful basis: Legitimate interests (to study how clients use our services, develop our business, and inform our marketing strategy).
• Sending regulatory newsletters, insights, and service updates:
  • Type of data: Identity, Contact, and Marketing and Communications Data.
  • Lawful basis: Consent (where specifically requested), or legitimate interests (to keep professional clients informed of industry developments where permitted by electronic marketing regulations).

7. Artificial Intelligence (AI) Processing

We may utilise approved artificial intelligence and secure digital tools to assist with data organisation, administrative drafting, trend analysis, and workflow efficiency. Where data is processed using these systems, it is conducted under strict confidentiality and security protocols. AI tools are used exclusively to assist and support, and never to replace, human professional judgement or executive decision-making. We do not use automated decision-making or profiling that produces legal or significant effects on individuals.

8. Disclosures of Your Personal Data

We do not sell, rent, or trade your personal data. We may share your personal data with the following parties for the purposes set out in Section 6:

• Internal personnel, associate consultants, and contractors bound by strict contractual confidentiality duties.
• Professional advisers acting as processors or joint controllers, including legal counsel, bankers, auditors, and insurers.
• Service providers acting as processors who supply IT, cloud hosting, and secure scheduling systems (such as Cal.eu / Cal.com and web server hosting).
• HM Revenue and Customs, regulators, and other public authorities based in the United Kingdom who require reporting of processing activities in specific statutory circumstances.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or assets. If a change occurs, the new owners may use your personal data in the manner set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not permit our third-party service providers to use your personal data for their own purposes.

9. International Transfers

We process and store your personal data primarily within the United Kingdom. Where third-party software providers process data outside the UK, we ensure that an equivalent level of protection is maintained by verifying that adequate statutory safeguards (such as the UK International Data Transfer Agreement or standard contractual clauses) are in place.

10. Data Security

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed. Access to your personal data is strictly limited to employees, consultants, and contractors who have a legitimate business need to know.

We have procedures to deal with any suspected personal data breach and will notify you and the Information Commissioner's Office (ICO) of a breach where legally required to do so.

11. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including satisfying any legal, regulatory, tax, accounting, or reporting requirements.

For contractual, financial, and consultancy records, we retain data for six years following the end of the professional engagement or financial year, in line with statutory limitation periods and tax obligations. General enquiry correspondence that does not lead to an instruction is reviewed and securely deleted after two years.

12. Your Legal Rights

Under UK data protection laws, you have specific rights in relation to your personal data:

• Request access to your personal data (commonly known as a data subject access request).
• Request correction of inaccurate or incomplete personal data that we hold about you.
• Request erasure of your personal data where there is no good reason for us continuing to process it.
• Object to processing of your personal data where we rely on a legitimate interest and there is something about your situation that makes you want to object.
• Request restriction of processing of your personal data while accuracy or grounds are verified.
• Request the transfer of your personal data to you or to a third party (data portability).
• Withdraw consent at any time where we rely on consent to process your personal data.

No fee usually required: You will not have to pay a fee to access your personal data or to exercise your rights. However, we may charge a reasonable administrative fee if your request is clearly unfounded, repetitive, or excessive.

Time limit to respond: We respond to all legitimate requests within one calendar month. Occasionally it could take longer if your request is particularly complex or you have made multiple requests, in which case we will notify you and keep you updated.

13. Data Protection Complaints Procedure

In accordance with our statutory obligations under the Data (Use and Access) Act, Ethica Consulting Ltd operates a formal data protection complaints procedure:

• Submitting a complaint: If you have a concern or complaint regarding how your personal data has been handled, please submit full details in writing to our Data Protection Officer at dpo@ethica-consulting.co.uk.
• Acknowledgement timeframe: We will formally acknowledge receipt of your data protection complaint within 30 days of receipt.
• Investigation and outcome: We will investigate the matter without undue delay, take appropriate remedial action where required, and provide you with a written outcome explaining our findings.
• Supervisory authority: You have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:
  • Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • Telephone: 0303 123 1113
  • Website: https://ico.org.uk

We would, however, welcome the opportunity to address your concerns directly before you approach the ICO, so please contact us in the first instance.