1. Who we are
ClearRock Group Ltd is the controller of personal information covered by this notice. We are registered in England and Wales under company number 17115253. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
For privacy questions or to exercise your rights, email hello@clearrockgroup.co.uk.
2. Information we collect
- Identity and contact details, such as your name, organisation, role, email address, telephone number and billing address.
- Enquiry and correspondence information you choose to give us.
- Contract, order, payment-status and download information. Card details are handled by the selected payment provider and are not stored directly by ClearRock.
- Technical and usage information, including IP address, device, browser, security logs and cookie preferences.
- Professional or case information supplied during consultancy or investigation work. The engagement agreement will explain ClearRock’s role and any additional safeguards.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and preparing proposals | Legitimate interests and steps requested before entering a contract |
| Delivering consultancy, investigations and digital orders | Contract; legitimate interests where the customer is an organisation |
| Billing, tax, accounting and legal records | Legal obligation and legitimate interests |
| Website security, fraud prevention and service improvement | Legitimate interests |
| Optional analytics or marketing cookies | Consent |
4. Sensitive and case information
Do not send detailed health, safeguarding, allegation or employee-case information through the general website form. If this is needed, ClearRock will agree a suitable secure route. During commissioned investigations we may process special-category or criminal-offence information only where a valid legal condition and appropriate safeguards apply. Our role as controller, joint controller or processor depends on the engagement and will be documented.
5. Who we share information with
We may use trusted providers for website hosting, email, secure document storage, accounting, payment processing, EDD commerce functions and professional advice. We may also disclose information where required by law or where necessary to protect legal rights. We do not sell personal information.
6. International transfers
Some technology providers may process information outside the UK. Where this happens, we use an appropriate legal transfer mechanism and assess the safeguards offered by the provider.
7. How long we keep information
- General enquiries: normally up to 24 months after the last meaningful contact.
- Customer, contract, invoice and order records: normally seven years after the relationship or transaction ends.
- Consultancy and investigation files: for the period specified in the engagement terms or retention schedule, taking account of legal and professional requirements.
- Security logs and cookie records: only as long as reasonably needed for their purpose.
8. Your rights
Depending on the circumstances, you may have rights to access, correct, erase or restrict your information, object to processing, receive portable data and withdraw consent. You may also complain to the Information Commissioner’s Office at ico.org.uk. Please contact us first if you are comfortable doing so, so we can try to resolve the concern.
9. Updates
We review this notice when our services, suppliers or legal obligations change. The latest version will always appear on this page.