Privacy policy.

Who we are

For the purpose of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is:

Lighthouse Policy Design Ltd
Registered office: 86–90 Paul Street, London, EC2A 4NE.
Registered in England and Wales. Company number 15652494.

Contact for privacy matters: info@lighthousepolicydesign.co.uk

What this policy covers

We process your personal data when you:

• visit this website

• get in touch through the site, by email, or by phone

• create or use an account to access tools and downloads on the site

• work with us as a client or client representative

• take part in research we carry out as part of our work

• apply for a role at Lighthouse

• sign up to receive updates from us

What information we collect

Depending on how you interact with us, we may collect some or all of the following:

• name, email address, phone number, job title, organisation

• the content of messages you send us

• account details if you register to access tools and downloads on the site

• information you share when taking part in user research, such as interview responses or survey answers

• CVs, covering letters and recruitment information if you apply for a role

• technical information about your device when you visit the site, including IP address, browser type, and how you use the site

When we collect it

We collect information when you:

• fill in a contact form or email us

• take part in a meeting, call or workshop

• create or sign into an account on the site

• participate in research we run

• apply for a role

• subscribe to our mailing list

• visit our website

How we use it

We use your information to:

• respond to your enquiries

• deliver work we have been contracted to do

• carry out research and analysis as part of our work

• provide and manage accounts for access to tools and downloads on the site

• manage recruitment

• send relevant updates, if you have opted in

• keep our website working well and secure

• meet our legal obligations

Our lawful basis for processing varies by purpose. Where we process data to deliver a contract, the basis is contractual necessity. Where we process data for recruitment, marketing, or research participation, the basis is your consent. Where we process data to run our business, the basis is our legitimate interest.

Research on behalf of clients

Much of our work involves research with the people who use public services or are affected by policy decisions. When we run research on behalf of a client, the client is the data controller and Lighthouse acts as a data processor on their instructions.

We follow ethical research practice. Participation is always voluntary, consent is informed, and participants can withdraw at any point. We store research data securely, use it only for the purpose we gathered it, and return or delete it at the end of the engagement as agreed with the client.

Who we share it with

We do not sell your information.

We may share information where we are required to do so by law, or to protect Lighthouse’s rights, property or safety. We may also share information with professional advisors, such as lawyers and accountants, where this is necessary for running the business.

Where we store it

We store your information in the UK or the European Economic Area wherever possible. Some of the services we rely on may process data in other regions, including the United States. Where that happens, we only rely on services that provide an adequate level of protection under UK data protection law, either through an adequacy decision or through approved contractual safeguards.

How long we keep it

We keep your information only for as long as we need it. That depends on why we collected it:

• Enquiries: up to 12 months after your last contact

• Contracts and client work: for the duration of the work, plus seven years for financial records

• Accounts: for as long as the account is active, and up to 12 months after it is closed

• Recruitment: up to 12 months after a decision, unless you agree we can keep your details on file

• Research data: for the length of the client engagement, then deleted or returned as agreed

• Marketing: until you unsubscribe

Your rights

Under UK data protection law, you have the right to:

• ask what personal data we hold about you

• ask us to correct information that is wrong or incomplete

• ask us to delete information, in certain circumstances

• ask us to restrict how we use your information

• ask us to transfer your information to another organisation

• object to us using your information in particular ways

• withdraw consent at any time, where consent was the basis for processing

• complain to the Information Commissioner’s Office

How to exercise your rights

To exercise any of these rights, email us at info@lighthousepolicydesign.co.uk . We may need to verify your identity before we respond. We aim to reply within one month.

For information about cookies, see our Terms and Conditions .

Changes to this policy

We may update this policy from time to time. The version on this page is always the current one.

How to complain

If you have a concern about how we have handled your data, please get in touch with us first. If you are not satisfied with our response, you can complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk
0303 123 1113

Contact us

For any questions about this policy or how we handle your information, email info@lighthousepolicydesign.co.uk .

Lighthouse Policy Design Ltd, 86–90 Paul Street, London, EC2A 4NE.