Privacy notice

1. Who we are

Voltaire Partners Ltd (“Voltaire”, “we”, “us”) is a company registered in England and Wales, company number 17440220, with its registered office at 167‑169 Great Portland Street, 5th Floor, London W1W 5PF.

We are an independent AI consultancy working with professional services firms. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC239824.

For anything in this notice, contact us at privacy@voltaire.partners.

2. What this notice covers — and what it doesn’t

This notice explains how we handle personal data where we decide why and how it is processed— in other words, where we act as a data controller. That mainly means people we deal with in the course of running our business: prospective and current clients, the individuals who work for them, our suppliers and advisers, and visitors to our website.

It does not cover personal data we handle on behalf of our clients.When we build or operate systems for a client, that client’s own systems hold the data, in the client’s own cloud environment, under the client’s own contracts with the underlying vendors. We act as a processor, strictly on that client’s instructions and under a written data processing agreement. If you are an employee, candidate, customer or contact of one of our clients and want to know how your data is handled in those systems, the client is the controller and their privacy notice applies. We will pass on any request we receive to the relevant client.

3. The personal data we process, and why

3.1 Prospective clients and business contacts

What:name, job title, employer, work email address, work telephone number, LinkedIn profile, the content of our correspondence and meetings with you, and notes we make about your organisation’s needs.

Why: to identify organisations that might benefit from our services, to arrange and hold meetings, to prepare and send proposals, and to keep track of our business relationships.

Lawful basis:legitimate interests — specifically, our interest in developing business relationships and marketing our services to organisations. We have considered whether this is fair to you, and we think it is: the data is limited to your professional capacity, it is the kind of contact you would reasonably expect from a business approaching yours, and you can ask us to stop at any time.

3.2 Clients and the people who work for them

What: contact details for the individuals we deal with at client organisations, including signatories to our contracts, day-to-day project contacts, and billing contacts; correspondence and meeting records relating to the engagement; and records of the services we have provided.

Why: to negotiate and perform our contracts, to deliver our services, to invoice, and to keep proper records of our engagements.

Lawful basis:legitimate interests — our interest, and our client’s, in performing the contract between our organisations. Where our contract is directly with you as an individual (for example, a sole trader), the lawful basis is performance of a contract.

3.3 Suppliers and professional advisers

What: contact details and correspondence for the individuals we deal with at our suppliers, insurers, lawyers and accountants.

Why: to obtain and manage the goods and services we need to run the business.

Lawful basis:legitimate interests — our interest in running our business and managing our supplier relationships.

3.4 Financial and accounting records

What: invoices, payment records, bank transaction records and supporting correspondence, which may include the names and contact details of individuals at client and supplier organisations.

Why: to run our accounts, to file company and tax returns, and to meet our statutory record-keeping obligations.

Lawful basis: legal obligation, under the Companies Act 2006, the Value Added Tax Act 1994 and HMRC record-keeping requirements. Where records go beyond what is strictly required by law, our basis is legitimate interests in maintaining accurate business records.

3.5 Website visitors

What: when you visit voltaire.partners, our hosting provider automatically records technical information including your IP address, browser type, the pages you visit and the time of your visit.

Why: to serve the website, to keep it secure and available, and to understand in general terms how it is used.

Lawful basis:legitimate interests — our interest in operating a secure and functional website. Where we use any non-essential cookies or similar technologies, we will ask for your consent first and you can withdraw it at any time.

3.6 Scheduling

What: if you book a meeting with us using our online scheduling link, we receive the name, email address, and any information you enter when booking.

Why: to arrange and hold the meeting.

Lawful basis:legitimate interests — our interest, and yours, in arranging a meeting you have asked for.

3.7 Company officers and shareholders

What: name, date of birth, nationality, residential and service addresses, and shareholding details of our directors, shareholders and persons with significant control.

Why: to meet our statutory filing and register-keeping obligations. Some of this information appears on the public register at Companies House.

Lawful basis: legal obligation.

4. Where we get your data from

Most often, directly from you — when you email us, meet us, book a meeting, or enter into a contract with us.

We also obtain business contact details from other sources, including:

• introductions from mutual contacts, where someone we know puts us in touch with you or passes on your details;
• publicly available professional sources, such as your employer’s website, LinkedIn, and public registers;
• your colleagues, where someone at your organisation gives us your details as the right person to speak to.

Where we obtain your details this way, we will tell you within a month, or at the point we first contact you, whichever is sooner. In practice this usually means our first email to you will point you to this notice.

5. Who we share your data with

We do not sell personal data, and we do not share it for anyone else’s marketing.

We use a small number of service providers who process personal data on our behalf, under written terms that restrict them to acting on our instructions:

We may also disclose personal data to:

• our insurers and legal advisers, where we need advice or need to notify or defend a claim;
• HMRC, Companies House and other authorities, where we are required to do so by law;
• a purchaser or successor, if we sell or reorganise the business, subject to appropriate confidentiality protections.

6. Sending data outside the UK

Several of our service providers are based in, or store data in, the United States and other countries outside the UK. Where personal data is transferred outside the UK, we rely on one of the following safeguards:

• the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it;
• UK adequacy regulations, where the destination country has been approved by the UK government; or
• the ICO’s International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, together with an assessment of the risks involved.

You can ask us for details of the safeguard applying to a particular transfer.

7. How long we keep it

Where we no longer have a reason to keep personal data, we delete it or render it anonymous.

8. Your rights

Under UK data protection law you have the right to:

• be toldwhat personal data we hold about you and how we use it — which is what this notice is for;
• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected, or incomplete data completed;
• ask us to delete your data, where we no longer have a good reason to keep it;
• ask us to restrict how we use your data while a concern is resolved;
• object to our use of your data where we rely on legitimate interests. If you object, we will stop unless we can show compelling grounds that override your interests;
• object to direct marketingat any time. This right is absolute — if you tell us to stop, we will stop, and we will keep a minimal record of your request so we do not contact you again by mistake;
• ask for your data in a portable format, where we process it by automated means on the basis of your consent or a contract with you.

To exercise any of these, email us at privacy@voltaire.partners. We will respond within one month. We will not charge you, unless a request is manifestly unfounded or excessive.

9. Automated decision-making

We do not make decisions about you by solely automated means that produce legal effects or similarly significant effects.

10. Security

We keep personal data in the systems listed in section 5, protected by access controls, multi-factor authentication and managed credentials. We keep the number of systems and suppliers deliberately small. We review access when it is no longer needed.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at privacy@voltaire.partners— we would rather put it right.

You also have the right to complain to the Information Commissioner’s Office:

12. Changes to this notice

We may update this notice from time to time. The current version is always at voltaire.partners/privacy, and the date at the top tells you when it was last changed. Where a change materially affects how we use your data, we will take reasonable steps to tell you.