1. Who We Are
Fourpoint Business Consultancy Limited ("Fourpoint", "we", "us" or "our") provides business support, financial compliance, governance, operational, identity verification and Right to Work checking services to businesses, charities, organisations and individuals.
We are registered in England and Wales and act as the data controller for the personal information described in this Privacy Notice.
Contact Details
Fourpoint Business Consultancy Limited
Queensgate House
48 Queen Street
Exeter
EX4 3SR
Email: contactus@fourpointconsult.com
Telephone: +44 7761 129610
Company Registration Number: 16325684
VAT Registration Number: GB489307646
2. What This Privacy Notice Covers
This Privacy Notice explains:
- what personal information we collect;
- how we collect it;
- how we use it;
- who we share it with;
- how long we keep it;
- how we protect it; and
- your rights under UK data protection law.
This notice applies when you:
- visit our website;
- book appointments with us;
- purchase services;
- request director identity verification;
- request Right to Work checks;
- engage us for consultancy or compliance support;
- submit enquiries; or
- otherwise communicate with us.
3. Personal Information We Collect
The information we collect depends on the services you use.
Contact Information
This may include:
- name;
- business name;
- job title;
- postal address;
- email address;
- telephone number.
Service and Client Information
This may include:
- details of enquiries and service requests;
- appointment information;
- records of communications;
- project and engagement records;
- documents provided during consultancy or compliance work.
Payment and Financial Information
This may include:
- billing information;
- invoice details;
- payment confirmations;
- transaction records.
Payment card information is generally processed by our payment providers and is not stored by us.
Website Information
When you visit our website we may collect:
- IP address;
- browser information;
- device information;
- cookie identifiers;
- website usage information;
- pages viewed and interactions with our website.
Identity Verification Information
Where you request director verification, identity verification or compliance checks, we may process:
- full name;
- date of birth;
- residential address;
- photographic identification;
- proof of address;
- identity verification results;
- nationality information;
- supporting documentation necessary to complete the requested service.
Where checks are requested through our online verification request forms, we may initially collect information about the types of identification documents available to you. In most cases, copies of identity documents are not uploaded through our website and are instead provided directly to the relevant verification provider through secure verification processes.
Right to Work Information
Where you request Right to Work services, we may process:
- information about the type of documents available to evidence a right to work;
- passports and identity documents;
- visa and immigration documentation;
- nationality information;
- eligibility to work information;
- verification outcomes.
Where a Right to Work check is requested through our website, we may collect information about the type of documentation available to support the check. Identity documents and supporting evidence are typically submitted directly through the relevant verification platform rather than through our website.
4. Special Category Data
Some services may require us to process information that is classified as special category data under UK GDPR.
Depending on the circumstances, this may include:
- biometric information contained within identity documents;
- information revealing racial or ethnic origin visible within official documents;
- health information provided as supporting evidence;
- other sensitive information supplied during a verification, compliance or legal process.
We will only process special category data when we have:
- a lawful basis under Article 6 UK GDPR; and
- an appropriate condition for processing under Article 9 UK GDPR and, where applicable, the Data Protection Act 2018.
We apply additional safeguards to sensitive information and limit access to those who need it to perform their role.
Right to Work checks. When we carry out a Right to Work check, the report includes biometric data (a facial match to your identity document), which is special category data. We process it on behalf of the organisation that requested the check, which is the data controller. We send the report securely to that organisation, which must keep it for your employment or engagement period plus two years. We keep our copy for 90 days from sending it, then securely delete it, keeping only a record of the reference, date and recipient. Other records (requests, payments, correspondence) are kept for 6 years for legal and accounting purposes, then deleted.
5. How We Collect Personal Information
We collect information:
Directly from You
When you:
- complete forms;
- purchase services;
- book appointments;
- request verification services;
- communicate with us; or
- subscribe to updates.
Automatically
Through cookies and similar technologies when you use our website.
From Third Parties
Where appropriate, we may receive information from:
- employers;
- recruitment agencies;
- authorised representatives;
- identity verification providers;
- government bodies;
- publicly available sources; or
- regulatory organisations.
6. How We Use Personal Information
We may use personal information to:
Provide Services
Including:
- consultancy services;
- governance and compliance support;
- director identity verification;
- Right to Work checks; and
- business administration support.
Manage Our Relationship With You
Including:
- responding to enquiries;
- providing customer support;
- arranging appointments; and
- delivering purchased services.
Process Payments and Maintain Records
Including:
- invoicing;
- bookkeeping;
- financial administration; and
- regulatory record-keeping.
Meet Legal and Regulatory Obligations
Including:
- Companies House requirements;
- employment and immigration legislation;
- fraud prevention; and
- tax and accounting obligations.
Improve Our Services
Including:
- website administration;
- service development;
- business planning; and
- analytics and performance monitoring.
Marketing
Where permitted by law, we may send information about our services.
You can unsubscribe from marketing communications at any time.
7. Lawful Bases for Processing
Our lawful basis for using personal information may include:
Contract
Where processing is necessary to provide services you have requested.
Legal Obligation
Where processing is necessary to comply with legal or regulatory requirements.
Legitimate Interests
Where processing is necessary for the effective operation, protection and improvement of our business and services.
Consent
Where we ask for and rely upon your consent.
You may withdraw consent at any time.
8. Website, Shopify and Ecommerce Processing
Our website and online store are hosted by Shopify.
When you browse our website, submit forms, book services or purchase products or services through our website, personal information may be collected and processed through Shopify's platform to enable website functionality, security, transaction processing and store management.
Shopify may process information relating to:
- your device;
- browser information;
- IP address;
- website activity;
- transactions and purchases; and
- security and fraud prevention.
This information helps support:
- operation of our website;
- processing of transactions;
- website security;
- fraud detection; and
- analytics and performance monitoring.
For further information about how Shopify processes personal information, please refer to Shopify's privacy information.
9. Who We Share Information With
We only share personal information where necessary and lawful.
This may include:
| Provider |
Purpose |
| Shopify |
Website hosting, ecommerce functionality, website performance, transactions and security |
| Microsoft 365 |
Email, document storage and business communications |
| Microsoft Bookings |
Appointment scheduling |
| Lovable |
Client enquiry and workflow management applications |
| Vouchsafe |
Identity verification, director verification and Right to Work checking services |
| Xero |
Accounting, invoicing and financial record keeping |
| Payment providers |
Payment processing and transaction management |
| Professional advisors |
Legal, regulatory and accounting advice |
We may also disclose information:
- where required by law;
- to regulatory bodies;
- to law enforcement agencies;
- in connection with legal proceedings; or
- to protect our legal rights or those of others.
10. Automated Verification Tools
Certain identity verification services may utilise automated technology supplied by specialist verification providers.
These tools help verify identity information, detect fraud and support compliance obligations.
We do not make decisions that have legal or similarly significant effects based solely on automated processing.
11. International Transfers
Some of our service providers may process personal information outside the United Kingdom.
This includes certain services operated by Shopify and other cloud-based providers.
Where personal information is transferred outside the UK, we will ensure appropriate safeguards are in place, including:
- adequacy regulations;
- the UK International Data Transfer Agreement (IDTA);
- the UK Addendum to Standard Contractual Clauses; or
- other recognised transfer mechanisms.
12. How Long We Keep Personal Information
We only keep personal information for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, regulatory, accounting and reporting requirements.
Our retention periods typically include:
| Record Type |
Typical Retention Period |
| General enquiries |
Up to 12 months |
| Client engagement records |
Six years after the end of the engagement |
| Accounting and financial records |
Six years plus the current financial year |
| Marketing preferences |
Until consent is withdrawn or no longer required |
| Identity verification and compliance records |
Typically up to six years, or longer where required by applicable legal, regulatory or contractual obligations |
Records may be retained for longer where necessary to:
- establish, exercise or defend legal claims;
- comply with legal obligations;
- respond to regulatory requirements; or
- resolve disputes.
When personal information is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with our data retention procedures.
13. Keeping Information Secure
We take appropriate technical and organisational measures to protect personal information from:
- loss;
- misuse;
- unauthorised access;
- disclosure;
- alteration; and
- destruction.
Measures may include:
- secure cloud storage;
- access controls;
- encryption where appropriate;
- staff training;
- supplier due diligence; and
- security monitoring.
14. Cookies
Our website uses cookies and similar technologies to:
- ensure website functionality;
- remember preferences;
- analyse website usage;
- improve performance; and
- enhance security.
You can control cookies through your browser settings and any cookie preferences tools provided on our website.
15. Children's Personal Information
Our services are intended primarily for adults, businesses, charities and organisations.
We do not knowingly collect personal information directly from children through our website or services unless this is necessary for the provision of a requested service and permitted by law.
In limited circumstances, we may process information relating to young people where this is necessary to provide verification, employment-related or compliance services requested by a parent, guardian, employer or other authorised person.
If we become aware that personal information has been provided by a child in circumstances where it should not have been collected, we will take reasonable steps to delete that information or otherwise comply with our legal obligations.
If you believe that a child has provided personal information to us inappropriately, please contact us using the details provided in this Privacy Notice.
16. Your Rights
Under UK data protection law, you may have the right to:
- access your personal information;
- correct inaccurate information;
- request deletion of information;
- restrict processing;
- object to processing;
- withdraw consent;
- request transfer of information; and
- lodge a complaint.
To exercise your rights, please contact us using the details in this notice.
17. Complaints
If you have concerns about how we collect, use or protect your personal information, we encourage you to contact us first so that we can investigate and try to resolve the matter.
You may submit a data protection complaint by contacting us using the details below:
Email: contactus@fourpointconsult.com
Telephone: +44 7761 129610
Post:
Fourpoint Business Consultancy Limited
Room 19, Queensgate House
48 Queen Street
Exeter
EX4 3SR
We will handle data protection complaints in accordance with applicable data protection legislation and our internal complaints procedures.
If you are dissatisfied with our response, or believe that we have not handled your personal information in accordance with the law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Information about how to make a complaint to the ICO can be found on the ICO website.
18. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes to our services, business practices or legal requirements.
The latest version will always be available on our website and will show the date on which it was last updated.
