1. Who We Are

Data Controller: Suzanne Tate - The Decision Project

Registered Address: 10a High Street, Chislehurst, Kent, BR7 5AN

Contact email: hello@thedecisionproject.world

Contact phone: +44 (0) 7816997128

We have not appointed a Data Protection Officer, as we are not required to under UK/EU GDPR given the scale and nature of our processing.

2. What Personal Data We Collect

We collect personal data in the following ways:

a) Information you provide directly, such as when you submit an enquiry through our contact/Alliance form:

Name, Organisation, Email address and/or phone number, Project location, estimated budget, and project or enquiry details (for design/development enquiries), Event, institution, topic, and format details (for speaking/research enquiries), Any other information you choose to include in a message to us.

b) Information collected automatically when you browse the site: IP address, Browser type and device information, Pages visited, time spent on the site, and referring website, Cookies and similar tracking technologies (see Section 6)

c) Information from third parties, where relevant — for example, if you are introduced to us via a professional connection, conference, or referral, and that person shares your contact details with us for the purpose of facilitating contact. We do not knowingly collect any special category data (such as health information, racial or ethnic origin, or religious beliefs) through this website, and we ask that you do not include such information in any enquiry you submit to us.

3. Legal Basis for Processing

Under UK and EU GDPR, we rely on the following legal bases, depending on the context:

Purpose and Legal Basis

• Responding to your enquiry - Legitimate interests (to respond to and manage business enquiries), steps taken prior to entering a contract

• Delivering a project or service you have engaged us for - Performance of a contract

• Sending you updates or marketing communications if you have opted in, Consent

• Analysing website traffic to improve the site - Legitimate interests, Consent (for non essential cookies)

• Complying with legal or regulatory obligations - Legal obligations

Where we rely on consent (for example, for marketing emails or non-essential cookies) you may withdraw that consent at any time - see Section 8.

4. How We Use Your Data

We use the personal data we collect to:

• Respond to enquiries submitted via the Alliance page or any contact form

• Assess potential project, consulting, speaking, or research alignment

• Deliver contracted design, consulting, or advisory services

• Send you communications you have explicitly opted into

• Maintain the security and proper functioning of this website

• Comply with our legal and regulatory obligations

• Analyse aggregated, anonymised website usage to improve content and user experience

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

5. Who We Share Your Data With

We share personal data only where necessary, with the following categories of recipients:

• Website hosting and infrastructure providers (e.g. Squarespace, Inc.), who process

• data on our behalf to operate this website

• Email and communication providers, used to receive and respond to enquiries

• Analytics providers (if enabled on this site — e.g. Squarespace Analytics, Google Analytics), used to understand site traffic

• Professional advisors (e.g. accountants, legal counsel), where necessary for business operations

• Regulators or law enforcement, where we are legally required to disclose information

All third-party processors are required to handle your data in accordance with applicable data protection law and under appropriate data processing agreements. International transfers: Some of our service providers (including Squarespace) may process or store data outside the UK/EEA, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or equivalent adequacy mechanisms recognised under UK and EU GDPR.

6. Cookies and Tracking Technologies

This website may use cookies and similar technologies to:

• Enable core website functionality

• Remember your preferences

• Analyse website traffic and usage patterns

Essential cookies are necessary for the website to function and do not require consent.

Non-essential cookies (such as analytics or marketing cookies) will only be set with your consent, which you can give or withdraw via our cookie consent banner. You can also control or delete cookies through your browser settings at any time. Note that disabling certain cookies may affect site functionality. A full list of cookies used on this site is available on request.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, including:

• Enquiry and correspondence data: retained for 3 years from last contact, unless a project or engagement results, in which case project-related data is retained in line with contractual and legal requirements (e.g. accounting and tax records, typically 6 years under UK law).

• Website analytics data: retained in line with the relevant provider's default retention settings, typically 24 months

When personal data is no longer needed, it is securely deleted or anonymised.

8. Your Rights

Under UK and EU GDPR, you have the right to:

• Access the personal data we hold about you

• Rectify inaccurate or incomplete data

• Erase your data ("right to be forgotten"), in certain circumstances

• Restrict processing of your data in certain circumstances

• Object to processing based on legitimate interests, including direct marketing

• Data portability — receive your data in a structured, machine-readable format

• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal

• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us at hello@thedecisionproject.studio. We will respond within one month, as required by law.

UK supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk

EU supervisory authority: You may lodge a complaint with your local Data Protection Authority if you are based in the EU.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including secure hosting infrastructure, access controls, and working only with reputable third-party processors who maintain their own security standards. No method of transmission over the internet or electronic storage is entirely secure, and we cannot guarantee absolute security.

10. Children’s Privacy

This website and our services are not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will indicate when changes were made. We encourage you to review this policy periodically.

12. Contact Us

If you have any question about this Privacy Policy or how we handle your personal data, please contact us via hello@thedecisionproject.world