Privacy Policy

LH Risk Strategy Advisory Ltd, trading as DueTelligence

Version 2.2 · Last updated: 9 October 2026 · Next review: 9 October 2027

1. Who we are and what this policy covers

LH Risk Strategy Advisory Ltd ("we", "us", "our") trades as DueTelligence. We provide independent strategic advice to leaders in safety-critical and high-consequence industries, including technical due diligence, and we operate the DueOS software platform.

This policy explains how we handle personal data when you visit our website, subscribe to our emails, contact us, when you or your organisation engage us, and when we deliver services.

Company details

2. When we are a controller and when we are a processor

This distinction matters, because different obligations apply.

We are a data controller for personal data relating to our website visitors, newsletter subscribers,
people who contact us or make a partnership enquiry, our client contacts, our suppliers, and our own
business records. This policy describes that processing.

We are a data processor for personal data contained in material a client provides to us, or that we
access on a client's systems, in the course of delivering services. Examples include names appearing in
safety documentation, competence records, personnel schedules or operational logs. In those cases the
client is the controller, our processing is governed by our contract with that client and by their
instructions, and their own privacy notice applies to the individuals concerned. If you believe your
personal data is held by one of our clients and processed by us on their behalf, contact that
organisation in the first instance; we will assist them in responding.

3. Personal data we collect

3.1 Website visitors

• Technical and usage data: IP address, approximate location at country or city level, browser and device type, operating system, referring page, pages viewed, and time and duration of visit.
• Any information you choose to submit through an enquiry form or by emailing us.

3.2 Client and prospective client contacts

• Name, job title, employer, work email address, telephone number and postal address.
• Records of our correspondence and meetings with you.
• Information about the engagement, enquiry or tender to which you relate.
• Billing and invoicing details, purchase order references, and payment history. We invoice directly and do not collect or store payment card details.

3.3 Newsletter subscribers

If you subscribe to our emails, we collect your name, email address and a record of your consent (the date, time and wording you agreed to). We use these only to send you our articles and updates. Our lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in every email or by emailing info@duetelligence.com. We keep your details until you unsubscribe, then delete them, keeping only a record of the unsubscribe so we do not contact you again.

3.4 Supplier and adviser contacts

Names, contact details and correspondence relating to our accountants, insurers, legal advisers and
other suppliers.

3.5 Partnership enquiries

If you send an enquiry through our DuePartners page, we collect your name, business email, organisation, website and what you would like to explore, and use them to respond and to consider a referral relationship. Our lawful basis is our legitimate interest in responding to business enquiries.

3.6 Data we ask you not to send us

Please do not send us personal data about other people unless it is necessary — for example, personnel
information required to deliver an engagement. Please do not send us
protectively marked or client-confidential material by unsecured email.

4. Why we process personal data, and our lawful bases

Where we rely on legitimate interests, we have considered whether those interests are overridden by
your rights. You can object to processing based on legitimate interests — see section 9.

We do not carry out automated decision-making that produces legal or similarly significant effects.

Decisions about whether to accept an engagement are made by a person.

5. Who we share personal data with

• Professional advisers — our accountant, solicitors and insurance brokers, where necessary.
• Service providers — our hosting, email, accounting and document storage providers, acting on our instructions under written terms. A current list is available on request.
• Where required by law — including to regulators, HMRC, or in connection with legal proceedings.

We do not sell personal data, and we do not share it for third-party advertising.

6. International transfers

Our website is hosted by Replit on Google Cloud infrastructure in North America. Some of our other service providers, such as email and newsletter providers, may also process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we rely on UK adequacy regulations where they apply (including the UK Extension to the EU-US Data Privacy Framework for certified US organisations), or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures needed.

Client material handled in the course of an engagement is subject to the client's own requirements. Where
a client requires material to remain within a specified jurisdiction or on their own systems, we work to
that requirement and it takes precedence over our default arrangements.

7. How long we keep personal data

Client material processed on a client's behalf is retained, returned or destroyed in accordance with our
contract with that client and their instructions.

8. How we protect personal data

We are a small specialist firm and we describe our measures honestly rather than by reference to
capabilities we do not have.

• Access to client information is limited to the person delivering the engagement.
• Devices are encrypted and protected by strong authentication.
• Multi-factor authentication is enabled on business systems that support it.
• Data in transit is protected using current transport layer encryption.
• Client material is segregated by client. Material from different clients is not commingled.
• Protectively marked and client-confidential material is handled only in accordance with the client's own arrangements, and where required only on client-issued equipment or client premises.
• Third-party services are not used to process client material without the client's prior written agreement. This includes cloud and artificial intelligence services.
• Backups are taken and retention is controlled.

Certification status: we do not currently hold Cyber Essentials, Cyber Essentials Plus, ISO 27001 or
ISO 9001 certification. We operate in accordance with the principles of ISO 27001 for information
security and ISO 9001 for quality management, and our Quality, Security and Technical Review Plan
(LHRSA-QP-01) sets out those arrangements. It is available on request. We will update this section if
our certification position changes.

Insurance: we maintain professional indemnity insurance. Limits and evidence of cover are set out in our Terms and Conditions and are
available on request.

No system is completely secure, and transmission of information over the internet carries inherent risk.
If you need to send us sensitive material, contact us first and we will agree a secure method.

9. Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectification of inaccurate data and completion of incomplete data.
• Erasure of your data in certain circumstances.
• Restriction of processing in certain circumstances.
• Object to processing based on legitimate interests, on grounds relating to your situation, and to object at any time to direct marketing.
• Portability — to receive data you provided to us, in a machine-readable format, where processing is based on consent or contract and carried out by automated means.
• Withdraw consent at any time where we rely on consent. This does not affect processing carried out before withdrawal.
• Complain to the Information Commissioner's Office.

To exercise any of these rights, email us at info@duetelligence.com. We will respond within one month. In complex
cases we may extend this by up to two further months and will tell you if we do.

There is no fee, unless a request is manifestly unfounded or excessive.

Some rights are qualified. We may need to retain information to comply with a legal obligation, to meet
a client's contractual or regulatory requirement, or to establish or defend a legal claim.

10. Cookies

We use a small number of cookies.

Strictly necessary cookies keep the site working and secure — session management and protection
against cross-site request forgery. These do not require consent.

Analytics cookies help us understand how the site is used, so we can improve it. These are only set
if you consent.

You can accept or reject non-essential cookies through the banner shown on your first visit, and change
your choice at any time through the cookie settings link in our footer. You can also block or delete
cookies through your browser settings, though blocking strictly necessary cookies will affect how the
site works.

11. Working in regulated sectors

We work with organisations subject to nuclear, defence and other regulatory regimes. In that context:

• Client material is handled under the client's own security classification and information handling arrangements, which take precedence over our general practice.
• We accept flow-down security, audit and compliance requirements from clients and contracting authorities.
• Clients remain responsible for classifying material correctly before providing it to us, for determining who may access it, and for complying with export control and other sector obligations.
• Security documentation, our Quality, Security and Technical Review Plan, and a data processing agreement are available to clients on request.

12. Other websites

Our website may link to other websites. We are not responsible for their privacy practices, and we
encourage you to read their policies.

13. Children

Our website and services are directed at businesses and are not intended for anyone under 18. We do not
knowingly collect personal data from children. If you believe we hold data about a child, contact us and
we will delete it.

14. Changes to this policy

We may update this policy. The version number and date at the top show when it last changed. Where
changes are significant we will bring them to the attention of clients and subscribers directly. We review
this policy at least annually.

15. Contact and complaints

For any question about this policy or about how we handle personal data:

Email: info@duetelligence.com

Post: LH Risk Strategy Advisory Ltd, 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom

We have not appointed a Data Protection Officer. Data protection enquiries are handled by the Managing
Director at the address above.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone 0303 123 1113 · ico.org.uk

We would appreciate the chance to resolve your concern before you approach the ICO.