Privacy Policy

Carra Hill Investments Ltd (“we,” “our,” or “us”) is committed to protecting and respecting your

privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when

you use our services, visit our website, or engage with us in any capacity.

1. Who We Are Carra Hill Investments Ltd is a UK-based business consultancy providing strategic and

operational advice to businesses. We act as a “data controller” under the UK General Data Protection

Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Information We Collect - Identity and Contact Information: Name, job title, company, email address,

phone number, postal address. - Business Information: Details about your company, services requested, and

project requirements. - Financial Information: Payment details and billing information (where applicable). -

Website Data: IP address, browser type, and usage data through cookies or analytics tools. - Communication

Records: Emails, meeting notes, and other correspondence.

3. How We Use Your Information We use personal data for the following purposes: - To provide consultancy

services and manage our client relationship. - To process payments and maintain financial records. - To

respond to enquiries and provide customer support. - To send updates, insights, and marketing (only where

you have consented or where we have a legitimate interest). - To comply with legal obligations.

4. Legal Bases for Processing We rely on the following lawful bases under UK GDPR: - Contractual

necessity ‒ to deliver our services. - Legal obligation ‒ to comply with tax, accounting, and regulatory

requirements. - Legitimate interests ‒ to improve our services and build client relationships. - Consent ‒

where you have opted in to receive marketing.

5. How We Share Your Information We will never sell your personal data. We may share your information

with: - Professional advisors (e.g., accountants, legal advisors). - Service providers (e.g., IT hosting, payment

processors). - Regulators, government bodies, or law enforcement where legally required.

6. International Data Transfers If we transfer your personal data outside the UK, we will ensure appropriate

safeguards are in place.

7. Data Retention We retain your data only for as long as necessary, typically for 6 years after the end of our

engagement.

8. Your Rights Under the UK GDPR, you have the right to: - Access your personal data. - Request correction

of inaccurate data. - Request deletion of your data (in certain circumstances). - Object to processing based on

legitimate interests. - Withdraw consent for marketing at any time. - Request restriction of processing. -

Request data portability.9. Cookies & Website Tracking Our website may use cookies and analytics to improve user experience. You

can manage or disable cookies in your browser settings.

10. Security We take appropriate technical and organisational measures to protect your data.

11. Complaints If you have concerns about how we use your data, please contact us first. If you are not

satisfied, you have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk

12. Updates to This Policy We may update this Privacy Policy from time to time. The latest version will

always be available on our website.