How Keystone Control LTD uses and protects personal information

1. Who we are

Keystone Control LTD is a company registered in England and Wales under company number 17275598. Our registered office is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner’s Office for data protection purposes under reference ZC188291.

For data protection enquiries, contact info@keystonecontrol.co.uk or telephone +44 7864 111494.

2. Information we may collect

We may collect names, business contact details, job titles, company details, enquiry information, operational records, documents supplied for review, correspondence, payment and invoicing information, website form submissions and technical information needed to operate and secure the website.

Please do not provide special category information, criminal offence information or personal information about other people unless it is necessary, lawful and agreed with Keystone Control in advance.

3. How we collect information

We collect information directly from you when you contact us, submit a form, enter into a contract or provide documents for a review. We may also receive information from your employer, authorised representatives, service providers or publicly available business sources where this is appropriate and lawful.

4. Why we use information and our lawful bases

We use personal information to respond to enquiries, provide requested services, manage contracts, communicate with clients, issue invoices, maintain business records, protect our systems, meet legal obligations and improve our services.

• Contract: where processing is necessary to take steps at your request or perform a contract.
• Legitimate interests: where necessary to operate, protect and develop our business, communicate with business contacts, prevent misuse and maintain appropriate records, provided those interests are not overridden by individual rights.
• Legal obligation: where information is needed to comply with tax, accounting, regulatory or legal requirements.
• Consent: where we ask for a genuine choice, including optional use of digital review tools or direct marketing where required.

5. Digital and AI assisted review tools

Keystone Control LTD may use secure digital or AI assisted tools to help organise, classify, summarise or analyse information provided during an enquiry or consultancy assignment. These tools support the review process but do not replace professional judgement. Keystone Control LTD does not rely on solely automated decisions that produce legal or similarly significant effects on individuals.

We apply data minimisation and access controls, and will use anonymised or reduced information where reasonably possible. Clients should avoid supplying unnecessary personal information.

6. Sharing information

We may share information with trusted hosting, email, document storage, accounting, professional advisory or technology providers where they support our business. We may also share information where required by law, to protect legal rights or with a client’s authorised representatives. Providers are expected to use information only for the agreed purpose and to protect it appropriately.

We do not sell personal information.

7. International transfers

Some technology providers may process information outside the United Kingdom. Where this occurs, we will seek to use appropriate safeguards recognised under UK data protection law, such as an adequacy regulation or approved contractual safeguards.

8. Retention

We keep personal information only for as long as needed for the purpose collected, including legal, tax, accounting, contractual and dispute requirements. Enquiry information that does not lead to work will normally be reviewed for deletion within 24 months. Client project and financial records may be kept for up to seven years after the relevant engagement, unless a longer or shorter period is justified.

9. Security

We use proportionate technical and organisational measures designed to protect information against unauthorised access, loss, misuse, alteration or disclosure. Access is limited to those who need it for legitimate business purposes.

10. Your rights

Depending on the circumstances, you may have the right to request access, correction, deletion, restriction, portability or to object to processing. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.

To exercise a right, contact us using the details above. We may need to confirm your identity and may ask for information needed to deal with the request.

11. Complaints

Please contact Keystone Control LTD first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner’s Office. Information about making a complaint is available at ico.org.uk.

12. Website links and updates

Our website may link to third party websites. We are not responsible for their privacy practices. We may update this policy when our services, suppliers or legal requirements change. The current version will be published on this page.