Privacy Policy

1. Introduction

Optitude OCC Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at optitudeocc.com (the "Site") and when you engage with our career transition, outplacement, and executive coaching services. This policy is written in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and any other applicable UK data protection laws.

Please read this Privacy Policy carefully. By accessing or using our Site or services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Site or use our services.

2. Data Controller

For the purposes of UK GDPR and the DPA 2018, the Data Controller responsible for your personal data is:

3. Information We Collect

3.1 Information You Provide Directly

When you engage with our services or interact with our Site, we may collect the following personal information that you voluntarily provide to us:

• Contact details: your full name, job title, company name, email address, telephone number, and postal address.
• Professional information: your CV or resume, career history, qualifications, professional memberships, current and previous employment details, salary information, and career objectives.
• Service-related information: details of your career transition circumstances, feedback forms, assessment responses, and any other information shared during the course of receiving our services.
• Enquiry information: any details you provide when submitting an enquiry form, requesting a transition plan, or contacting us via email or telephone.
• Payment information: where applicable, payment card details or invoicing information required to process payments for our services. Note that payment card transactions are processed by third-party payment processors and we do not store full card details on our systems.

3.2 Information Collected Automatically

When you visit our Site, certain information is collected automatically through cookies and similar technologies:

• Device and usage data: your IP address, browser type and version, operating system, device type, pages visited, time and date of visits, time spent on pages, referring URLs, and navigation paths through the Site.
• Cookies: we use essential cookies to ensure the Site functions properly, and analytics cookies to understand how visitors interact with our Site. You can manage your cookie preferences through your browser settings. For more detail, please refer to our Cookie Policy below.

3.3 Information from Third Parties

We may receive personal information about you from third-party sources, including your current or former employer (when they engage our outplacement services on your behalf), professional networking platforms, recruitment agencies, or publicly available sources, where we have a lawful basis to process such information.

4. How We Use Your Information

We process your personal data only where we have a lawful basis to do so under UK GDPR. The lawful bases we rely on include: consent, contractual necessity, legitimate interests, legal obligations, and vital interests. We use your information for the following purposes:

• Service delivery: to provide career transition, outplacement, executive positioning, and related coaching services that you or your employer have engaged us to deliver.
• Communication: to respond to your enquiries, provide service updates, share relevant materials, and maintain correspondence with you regarding our services.
• Contract administration: to manage our contractual relationship with you or your sponsoring organisation, including invoicing, payment processing, and service reporting.
• Improvement and development: to analyse Site usage and service feedback to improve our offerings, develop new services, and enhance the user experience.
• Legal and regulatory compliance: to comply with applicable laws, regulations, industry codes of practice, and to respond to lawful requests from public authorities.
• Legitimate business interests: for direct marketing purposes where you have consented, fraud prevention, network security, and business analytics, provided such processing does not override your rights and freedoms.

5. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis to process your personal data. The specific lawful basis depends on the context in which we collected the data and the purpose for which we use it:

• Consent: where you have given us clear, informed consent to process your personal data for specific purposes, such as receiving marketing communications.
• Contractual necessity: where processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract.
• Legitimate interests: where processing is necessary for our legitimate business interests, such as improving our services, preventing fraud, or ensuring network security, and such interests are not overridden by your rights.
• Legal obligation: where processing is necessary to comply with a legal obligation to which we are subject.

Where we rely on consent, you have the right to withdraw your consent at any time. Where we rely on legitimate interests, you may object to our use of your data by contacting us at the details provided in Section 2.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share your information in the following limited circumstances:

• Sponsoring organisations: where your employer or sponsoring organisation has engaged our services on your behalf, we may share aggregate progress reports and service-related information with them as agreed in our service contract.
• Service providers: we engage trusted third-party service providers who process data on our behalf, such as hosting providers, email platforms, analytics tools, and payment processors. All service providers are bound by appropriate data processing agreements and are only permitted to process your data in accordance with our instructions.
• Legal requirements: we may disclose your information if required to do so by law, in response to a valid legal request, court order, or regulatory requirement.
• Business transfers: in the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, your personal data may be transferred as part of such transaction, subject to continued protection under this Privacy Policy.

7. International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA). In the event that your data needs to be transferred outside of the UK or the EEA, we will ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) adopted by the European Commission, or adequacy decisions by the UK Government, to ensure your data receives an equivalent level of protection. We will inform you of any such transfers and the safeguards applied.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Our retention periods are determined by the nature of the data, the purposes for which it is processed, and applicable regulatory requirements. As a general guide:

• Client service data: retained for the duration of the service engagement and for up to 6 years thereafter for professional and regulatory compliance purposes.
• Enquiry data: retained for up to 12 months from the date of your enquiry if no service engagement commences.
• Marketing data: retained only for as long as you remain subscribed to our communications, or until you withdraw consent.
• Website analytics data: retained for up to 26 months in accordance with industry standard practices.

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised unless we are required by law to retain it for longer.

9. Your Rights Under UK GDPR

Under UK GDPR and the DPA 2018, you have the following rights regarding your personal data:

• Right of access: you may request a copy of the personal data we hold about you.
• Right to rectification: you may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to erasure: you may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other lawful basis for processing.
• Right to restrict processing: you may request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: you may request to receive your personal data in a structured, commonly used, machine-readable format, or to have it transferred to another data controller.
• Right to object: you may object to the processing of your personal data based on our legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: you have the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.
• Right to withdraw consent: where we rely on consent as the lawful basis for processing, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at info@optitudeocc.com. We will respond to your request within 30 days, or within one month as required by UK GDPR. We may need to verify your identity before processing your request. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you are dissatisfied with our handling of your personal data.

10. Data Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission (SSL/TLS), secure access controls, regular security assessments, staff training on data protection, and robust backup and disaster recovery procedures. While we strive to protect your personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of your data, but we are committed to maintaining industry-standard protections and will promptly notify you of any data breach that is likely to result in a risk to your rights and freedoms, in accordance with our legal obligations under UK GDPR.

11. Cookies

Our Site uses cookies and similar tracking technologies to enhance your browsing experience and collect information about how you use our Site. Cookies are small text files stored on your device that help us understand which pages are visited most frequently, how visitors navigate the Site, and whether you encounter any error messages. We use the following categories of cookies:

• Essential cookies: required for the basic functionality of the Site, such as maintaining your session and remembering your preferences. These cannot be disabled.
• Analytics cookies: used to collect information about how visitors use our Site, including pages visited, time spent, and navigation patterns. This data is used to improve the performance and content of our Site. We use services such as Google Analytics for this purpose.
• Functionality cookies: allow the Site to remember choices you make, such as language preferences, and provide enhanced, personalised features.

You can manage or disable cookies through your browser settings at any time. Please note that disabling certain cookies may affect the functionality of our Site. For more detailed information about the cookies we use, their purposes, and how to manage them, please contact us.

12. Third-Party Links

Our Site may contain links to third-party websites, including professional networking platforms, industry publications, and partner organisations. These third-party sites are not operated or controlled by us, and we are not responsible for their content, privacy practices, or policies. We encourage you to review the privacy policies of any third-party sites you visit. The inclusion of any link does not imply our endorsement of the linked site or its operators.

13. Children's Privacy

Our services are directed at professionals and organisations and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a person under 18, we will take immediate steps to delete that information from our systems.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or through a prominent notice on our Site. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our Site or services after any changes constitutes your acceptance of the revised Privacy Policy.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact us using the details below:

For data protection complaints, you also have the right to contact the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection matters, at ico.org.uk.