Privacy Policy

1. Who We Are

Jon Lyons Consultancy (“JLC”, “we”, “us”, “our”) provides professional consultancy services including fundraising strategy, face-to-face fundraising, lottery development, human resources, organisational development, recruitment & learning, and procurement & tender management.

We are registered with the Information Commissioner’s Office (ICO) as a data controller under the UK General Data Protection Regulation (UK GDPR), ICO number C1883499.

2. The Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

A. Identity Data

• Name, job title, organisation, and professional background

B. Contact Data

• Email address, phone number, and business address

C. Professional Data

• HR case details (where acting as consultant)
• Recruitment and tender documentation
• Contractual information and agency performance data

D. Financial Data

• Invoice details and payment confirmation information

E. Technical Data (website users)

• IP address, browser type, and usage analytics

We do not intentionally collect special category data unless required as part of HR consultancy services and only where lawful to do so.

3. How We Use Your Data

We process personal data under the following lawful bases set out in UK GDPR:

Contractual Necessity

• Delivering consultancy services and managing client relationships
• Fulfilling contractual obligations

Legitimate Interests

• Business development, service improvement, risk management, and professional networking

Legal Obligation

• Regulatory compliance, ICO registration compliance, and financial record keeping

Consent (where applicable)

• Marketing communications and newsletter updates

You may withdraw consent at any time by contacting us.

4. HR & Sensitive Data Handling

Where JLC provides HR consultancy services, we may process employee data on behalf of client organisations. In such cases, the client organisation remains the Data Controller and JLC acts as a Data Processor. Data Processing Agreements (DPAs) are put in place where required. Sensitive personal data is handled in strict confidence in accordance with Article 9 of the UK GDPR.

5. Data Sharing

We do not sell personal data. We may share data with professional advisers (legal/accounting), secure cloud storage providers, and regulatory bodies if legally required. All third parties are required to respect data security and confidentiality.

6. International Transfers

JLC operates primarily within the United Kingdom. If data is transferred outside the UK, appropriate safeguards — such as UK-approved Standard Contractual Clauses — will be applied.

7. Data Security

We implement appropriate technical and organisational measures including password-protected systems, secure cloud storage, encrypted devices, access limitation controls, and confidentiality agreements. We retain personal data only as long as necessary for contractual, legal, or regulatory purposes.

8. Data Retention

We retain data for the duration of client contracts and for 6 years following completion (for legal and financial compliance). HR case documentation is retained in line with client retention schedules. After applicable periods, data is securely deleted or anonymised.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

To exercise any of these rights, please contact us at jonlyons.consultancy@gmail.com. You also have the right to lodge a complaint with the ICO at www.ico.org.uk.

10. Cookies

Our website may use cookies for analytics, performance monitoring, and security. You can manage cookie preferences through your browser settings.

11. Marketing Communications

We may contact you regarding our consultancy services, sector updates, and industry insights. You may unsubscribe at any time by emailing us directly.

12. Changes to This Policy

We may update this Privacy Policy periodically. The latest version will always be available on our website at jlconsultancy.uk or upon request.