Abstract digital artwork with purple, blue, and black geometric shapes, lines, and patterns creating a complex, layered composition.

Privacy Policy

4REAL Consulting Limited customer privacy notice

This privacy notice tells you what to expect us to do with your personal information.

Contact details

Telephone

07534055985

Email

davidson@4realco.ai

What information we collect, use, and why

We collect or use the following information to provide and improve products and services for clients:

  • Names and contact details
  • Usage data (including information about how you interact with and use our website, products and services)
  • Information relating to compliments or complaints
  • Records of meetings and decisions
  • Account access information
  • Website user information

We collect or use the following personal information for the operation of client or customer accounts:

  • Names and contact details
  • Addresses
  • Purchase or service history
  • Account information, including registration details
  • Information used for security purposes
  • Marketing preferences
  • Technical data, including information about browser and operating systems

We collect or use the following personal information for information updates or marketing purposes:

  • Names and contact details
  • Profile information
  • Marketing preferences
  • Purchase or account history
  • Website and app user journey information

We collect or use the following personal information for scientific or historical research purposes, for statistical purposes or for archiving in the public interest:

  • Names and contact details
  • Purchase or client account history
  • Website and app user journey information

We collect or use the following personal information to comply with legal requirements:

  • Name
  • Contact information
  • Any other personal information required to comply with legal obligations
  • Safeguarding information

We collect or use the following personal information to protect client welfare:

  • Names and contact information
  • Client account information

We collect or use the following personal information for recruitment purposes:

  • Contact details (eg name, address, telephone number or personal email address)
  • Date of birth
  • National Insurance number
  • Copies of passports or other photo ID
  • Employment history (eg job application, employment references or secondary employment)
  • Education history (eg qualifications)
  • Right to work information
  • Details of any criminal convictions (eg Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks )
  • Security clearance details (eg basic checks and higher security clearance)

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Account information
  • Purchase or service history
  • Relevant information from previous investigations
  • Customer or client accounts and records
  • Correspondence

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Our legitimate interest is to collect and use limited personal information as needed to understand our clients’ needs, deliver, improve, and support our AI consultancy services, and develop effective human-centred AI solutions. The information we process may include professional contact details, information provided by clients about their organisation and workflows, and relevant information about how teams use our services. We use this information only where it is relevant and necessary for the specific service being provided, for example to understand business processes, identify opportunities for responsible AI adoption, provide recommendations, measure outcomes, and improve our products and services. This processing benefits our clients by enabling us to provide more relevant, effective and personalised consultancy, improve the quality and efficiency of our services, and help organisations use AI in ways that support their people and business objectives. Where appropriate, it can also benefit individuals within client organisations by reducing inefficient or repetitive work, improving access to useful AI tools, and supporting better ways of working. We consider the impact on individuals before processing their information and aim to minimise the amount of personal information collected. We do not collect personal information simply because it may be useful in the future. We use information only for specified and legitimate purposes, limit access to those who need it, apply appropriate security measures, and retain it only for as long as necessary. Where personal information is not required, we use anonymised or aggregated information instead. We do not intend to use personal information in ways that would be unexpected, intrusive or unfair to individuals, or to place our commercial interests above their rights and interests. Where the potential impact on individuals is significant, or where another lawful basis is more appropriate, we will not rely on legitimate interests alone. We consider that this processing is necessary and proportionate because it enables us to deliver and continuously improve our services while taking reasonable steps to protect individuals’ privacy and minimise potential risks. The benefits to clients and the individuals they serve are therefore balanced against, and do not override, those individuals\' reasonable expectations, rights, and freedoms.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information to provide and improve products and services for clients:

We need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’)., We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
  • Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for the operation of client or customer accounts are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Our legitimate interest is to collect and use limited personal information necessary to create, manage and operate client or customer accounts and to provide the services associated with those accounts. The personal information we process may include names, professional contact details, account information, correspondence and information necessary to manage the client relationship. We use this information to identify account holders, communicate with clients, provide access to our services, manage account administration, respond to enquiries, maintain accurate records, provide support, and manage the delivery and ongoing operation of our services. This processing is necessary to provide clients with a reliable and secure service. It enables us to administer accounts effectively, communicate important information, understand and respond to client requests, and ensure that the appropriate individuals have access to the services and information relevant to their organisation. We limit the personal information we collect to what is reasonably necessary for these purposes and do not use account information for unrelated purposes without an appropriate lawful basis. We take appropriate measures to protect personal information from unauthorised access, loss or misuse and retain it only for as long as necessary. The processing is proportionate because it is directly connected to the operation of the client relationship and provides clear benefits to both our business and our clients. We consider the reasonable expectations, rights and freedoms of individuals and do not use their information in ways that are unnecessarily intrusive or unfair. Where the impact on an individual is likely to be significant, we will consider whether another lawful basis or additional safeguards are required.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information for the operation of client or customer accounts:

We need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’)., We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
  • Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Our legitimate interest is to use limited personal information, such as names and professional contact details, to communicate relevant information about our AI consultancy, products, services, insights, events and developments that may be of genuine interest to clients and prospective clients. This processing allows us to keep professional contacts informed about developments that may help their organisations understand and adopt AI effectively, including relevant service updates, new capabilities, research, guidance and opportunities to work with us. It also enables us to maintain appropriate professional relationships and communicate information that is relevant to the nature of our services. We only use personal information where there is a reasonable expectation that the communication will be relevant to the individual or their organisation. We do not seek to collect excessive information or use personal information for unrelated marketing purposes. We provide a clear and straightforward way for individuals to opt out of marketing communications at any time and respect those preferences promptly. We consider the impact on individuals and aim to ensure that communications are proportionate, relevant and not intrusive. We do not sell personal information or use it in ways that would be unexpected or unfair. Where applicable, we will obtain consent where this is legally required rather than relying on legitimate interests. We consider this processing necessary to maintain relevant professional communications and develop our services while providing individuals with useful information and control over how their information is used. The benefits are proportionate to the limited impact on individuals because communications are targeted, relevant, infrequent where appropriate, and subject to clear opt-out mechanisms.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information for information updates or marketing purposes:

We need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’)., We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.

Our lawful bases for collecting or using personal information to comply with legal requirements:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Our legitimate interest is to collect and use limited personal information where necessary to comply with applicable legal, regulatory, accounting and reporting requirements arising from the operation of our business. The information may include names, contact details, transaction and account information, contractual records, correspondence and other information required to demonstrate compliance with our legal obligations. We process this information only where it is necessary to meet a specific legal or regulatory requirement, maintain appropriate business records, respond to lawful requests, or establish and protect our legal rights. This processing benefits our clients, individuals and our business by helping us operate lawfully, maintain accurate and transparent records, prevent and address unlawful activity, meet regulatory obligations and respond appropriately to legitimate requests from competent authorities. The processing is necessary because we cannot reasonably comply with applicable legal and regulatory requirements without retaining and using certain relevant information. We minimise the amount of personal information processed, restrict access appropriately, maintain suitable security measures and retain information only for the period required by law or reasonably necessary for the relevant purpose. We consider the rights and freedoms of individuals when carrying out this processing and do not use information collected for legal compliance for unrelated purposes unless another appropriate lawful basis applies. The benefits of processing are proportionate to the limited impact on individuals because the processing is restricted to information that is necessary to fulfil specific legal or regulatory obligations and is subject to appropriate safeguards.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information to comply with legal requirements:

We need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’)., We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
  • Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information to protect client welfare are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Our legitimate interest is to collect and use limited personal information where necessary to protect the welfare, safety and legitimate interests of our clients and the individuals who use or are affected by our services. The information may include relevant contact details, information provided by clients about their circumstances, and other information necessary to identify, assess or respond to a potential welfare or safety concern. We will only process information that is relevant and proportionate to the specific concern and will not collect or use personal information unnecessarily. This processing enables us to identify and respond appropriately to circumstances where a client or individual may be at risk of harm, exploitation, abuse or other significant detriment. It may also allow us to take appropriate safeguarding action, provide relevant support, or escalate a concern to an appropriate person or organisation where necessary. We recognise that welfare-related information can be particularly sensitive. We therefore limit access to those who have a legitimate need to know, apply appropriate security measures, and use the information only for the specific welfare or safeguarding purpose for which it is required. Where a different lawful basis is required, particularly for special category or highly sensitive personal information, we will rely on the appropriate lawful basis and safeguards rather than legitimate interests alone. The processing is necessary and proportionate because protecting individuals from significant harm or detriment can require relevant information to be available to those responsible for their welfare. We balance this interest against individuals\' privacy rights and take steps to minimise the amount of information collected, the number of people who can access it, and the period for which it is retained.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information to protect client welfare:

We need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’)., We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
  • Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for recruitment purposes are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Our legitimate interest is to collect and use limited personal information where necessary to identify, assess and recruit suitable candidates for roles within our AI consultancy and to manage the recruitment process. The information may include candidates’ names, contact details, CVs, employment history, qualifications, skills, experience, interview notes and other information voluntarily provided as part of an application. We use this information to assess suitability for a role, communicate with candidates, arrange interviews, make recruitment decisions and maintain appropriate records of the recruitment process. This processing benefits both our business and prospective candidates by enabling us to identify people whose skills and experience are appropriate for available roles and to make fair, informed and consistent recruitment decisions. It also allows candidates to be considered for opportunities that are relevant to their professional experience. We limit the information collected to what is relevant and reasonably necessary for recruitment and do not use candidate information for unrelated purposes. Access is restricted to individuals involved in the recruitment process, appropriate security measures are applied, and information is retained only for as long as necessary for the relevant recruitment purpose or where there is a legitimate reason to retain it. We consider candidates’ reasonable expectations, privacy and other rights throughout the recruitment process. We do not use intrusive methods to assess candidates or make decisions based on information that is irrelevant to their suitability for a role. Where information is particularly sensitive, or where another lawful basis is required, we will apply the appropriate legal basis and safeguards. We consider this processing necessary and proportionate because recruitment requires us to evaluate relevant information about candidates in order to make appropriate hiring decisions. The benefits of a properly managed recruitment process are balanced against the potential impact on candidates through data minimisation, transparency, appropriate security and limited retention.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information for recruitment purposes:

We need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’)., We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
  • Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Our legitimate interest is to collect and use limited personal information where necessary to receive, investigate and respond to queries, complaints and claims relating to our services, clients, suppliers or business activities. The information may include names, contact details, correspondence, account or service information, details of the query or complaint, and other information provided by the individual that is relevant to resolving the matter. We use this information to understand and investigate issues, communicate with the relevant person, provide appropriate responses or remedies, maintain accurate records, and manage or defend potential legal claims where necessary. This processing benefits individuals by enabling us to respond effectively to their concerns, resolve problems and provide appropriate support or remedies. It also enables us to identify recurring issues and improve our services, while allowing us to protect our legitimate legal and business interests. We limit the information collected and used to what is reasonably necessary to address the specific query, complaint or claim. Access is restricted to people who need the information to deal with the matter, appropriate security measures are applied, and information is retained only for as long as necessary for the relevant purpose or to meet applicable legal or regulatory requirements. We consider the privacy and rights of individuals throughout this process and do not use information provided in a query, complaint or claim for unrelated purposes unless another appropriate lawful basis applies. Where particularly sensitive information is involved, we will apply the appropriate additional safeguards and lawful basis where required. We consider this processing necessary and proportionate because resolving queries, complaints and claims requires us to understand the circumstances and communicate with the relevant individuals. The benefits of enabling individuals to have their concerns properly addressed and allowing us to resolve and manage disputes are balanced against potential privacy impacts through data minimisation, restricted access, appropriate security and limited retention.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information for dealing with queries, complaints or claims:

We need to respond to, or deal with, an emergency event or situation (the ‘emergencies condition’)., We need to protect the physical, mental or emotional well-being of people who need extra support, or to protect them from harm or neglect (the ‘safeguarding condition’).

  • Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
  • Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours. All of your data protection rights may apply, except the right to erasure and the right to portability.

Where we get personal information from

  • Directly from you
  • Publicly available sources

How long we keep information

We keep personal information only for as long as we reasonably need it for the purposes for which it was collected, including to provide our services, manage our business, meet legal and regulatory requirements, resolve queries or complaints, and establish or defend legal claims.

Our usual retention periods are:

Type of informationHow long we keep it
Client and customer account informationFor the duration of the relationship and normally for 6 years afterwards
Client project and consultancy recordsFor the duration of the project and normally for 6 years afterwards
Client-provided information used to deliver our servicesFor as long as necessary to provide the service and in accordance with our contractual arrangements with the client
General enquiries and correspondenceNormally 2 years after the enquiry or correspondence has been resolved
ComplaintsNormally 6 years after the complaint has been resolved
Legal claims and disputesNormally 6 years after the matter has been concluded, or longer where reasonably necessary
Marketing informationUntil you opt out, after which we retain only the minimum information necessary to ensure we respect your preference
Prospective client and professional contact informationNormally 2 years after our last meaningful interaction
Recruitment information for unsuccessful candidatesNormally 6 months after the recruitment process has concluded
Financial and accounting recordsNormally 6 years from the end of the relevant financial year, where required by law
Data protection requests and records of our complianceNormally 6 years after the matter has been closed
Security and access logsNormally 12 months, unless needed for an ongoing security investigation
Data breach and security incident recordsNormally 6 years after the incident has been closed
Consent and communication preference recordsFor as long as necessary to demonstrate compliance and respect your preferences

These periods are not absolute. We may retain information for longer where we have a legal or regulatory obligation to do so, where it is necessary to establish, exercise or defend legal claims, or where there is another lawful and justified reason to retain it.

Where information is no longer required, we will securely delete it, destroy it or anonymise it so that it can no longer be associated with an identifiable individual.

Where we process personal information on behalf of a client, we will generally follow the client's instructions and the retention and deletion requirements set out in our agreement with that client.

We review our retention practices regularly to ensure that we do not keep personal information for longer than necessary.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.