Privacy Statement

1. Introduction

Hattan Limited, trading as Hattan Consulting, is committed to protecting and respecting your privacy.

This Privacy Statement explains how we collect, use, store, share and protect personal data in connection with our website, enquiries, client and business relationships, and the operation of Hattan Consulting.

Hattan is a UK business with a particular focus on supporting organisations operating between the United Kingdom and the United States. As a result, our work may involve individuals, clients, partners, professional advisers and service providers in both countries.

We process personal data in accordance with applicable data protection and privacy laws, including the UK General Data Protection Regulation and the Data Protection Act 2018, together with relevant United States privacy laws where those laws apply.

We aim to handle personal data lawfully, fairly, transparently and proportionately.

2. Who We Are

Hattan Consulting is a trading name of Hattan Limited.

Hattan Limited is a private limited company registered in England and Wales under company number 17397737.

For the purposes of UK data protection law, Hattan Limited is the data controller for personal data collected through this website and through our direct business activities, except where another organisation is responsible for determining how particular personal data is processed.

Questions about this Privacy Statement or the way we handle personal data can be sent to: privacy@hattanconsulting.com

3. The UK and US Context

Hattan is established in the United Kingdom, but the nature of our work means that personal data may be handled in a cross-border context.

Our clients and business contacts may be based in the United Kingdom, the United States or elsewhere.

Our work may involve communication with US-based businesses, professional advisers, strategic partners and service providers.

Some technology providers used to operate our business and website may also process information in the United States or other countries.

The legal framework that applies to a particular individual or processing activity can therefore depend on factors including where the individual is located, where the information is processed, the nature of our relationship with them and whether a particular privacy law applies to Hattan.

The sections below explain our approach to both UK and US privacy rights.

4. Personal Data We May Collect

We may collect and process the following categories of personal data.

5. Sensitive Personal Data

We do not normally seek to collect special category or highly sensitive personal data through this website.

Please do not provide sensitive information through general website forms or enquiries unless it is genuinely necessary and appropriate to do so.

If sensitive personal data is provided to us in the course of a legitimate business engagement, we will only process it where there is an appropriate legal basis and, where required, an additional legal condition for doing so.

6. How We Collect Personal Data

We may collect personal data:

• directly from you
• when you contact us
• when you submit a website enquiry
• during meetings, calls or correspondence
• during the establishment or management of a business relationship
• from organisations you work for or represent
• through introductions from professional or business contacts
• through our website and analytics technologies
• from publicly available professional or business sources where appropriate

Where we receive information about you from another source, we will handle that information in accordance with applicable data protection requirements.

7. How We Use Personal Data

We may use personal data to:

• respond to enquiries
• communicate with prospective clients and business contacts
• understand the nature of a proposed engagement
• provide information about Hattan and our services
• establish and manage client relationships
• provide consultancy and operational support
• manage relationships with partners, advisers and service providers
• arrange meetings and business communications
• administer contracts and commercial relationships
• maintain appropriate business records
• operate, secure and maintain our website
• understand how our website is used
• improve our website, services and user experience
• protect our systems and business from misuse or security threats
• manage financial, accounting and administrative matters
• establish, exercise or defend legal claims
• comply with legal, regulatory, tax or other obligations
• respond to valid requests from courts, regulators or public authorities

We do not sell personal data.

We do not use website analytics for advertising, remarketing or personalised advertising.

8. Lawful Bases Under UK Data Protection Law

Where UK data protection law applies, we rely on one or more lawful bases depending on the purpose for which the information is being processed.

9. Website Analytics

We use analytics to understand how people use our website and to improve its content, structure, performance and user experience.

We currently use Vercel Web Analytics and Google Analytics 4.

Vercel Web Analytics provides aggregated website statistics and operates without analytics cookies.

Google Analytics 4 is only activated where a visitor chooses to accept analytics cookies. If a visitor rejects analytics cookies, Google Analytics is not activated and Google Analytics cookies are not placed on their device.

Where Google Analytics is activated, it may process information relating to website usage, interactions, browser and device information, session information and approximate geographic location.

We do not use Google Analytics for advertising, remarketing, personalised advertising or behavioural advertising. We do not sell analytics data.

Further information is available in our Cookie Policy.

10. Sharing Personal Data

We do not sell personal data.

We may share personal data where reasonably necessary with organisations that help us operate our business or provide our services. These may include:

• website hosting and infrastructure providers
• analytics providers
• cloud and technology providers
• email and communication providers
• customer and business relationship systems
• professional advisers (accountants, legal advisers, insurers)
• banking and payment providers
• contractors or consultants supporting our work
• strategic or specialist partners where their involvement is relevant to a client engagement
• regulators, courts, law enforcement agencies or other public authorities where required by law

Where another organisation processes personal data on our behalf, we take appropriate steps to ensure that the relationship is governed by suitable contractual and data protection arrangements.

11. International Data Transfers

Because Hattan operates in a UK and US business environment and uses internationally operated technology services, personal data may be transferred to, stored in or accessed from countries outside the United Kingdom. This includes the United States.

A transfer outside the United Kingdom does not mean that the protections applying to personal data are disregarded. Where UK data protection law requires safeguards for an international transfer, we use an appropriate lawful transfer mechanism according to the circumstances.

For transfers to eligible organisations in the United States, this may include reliance on the UK Extension to the EU-US Data Privacy Framework where the recipient participates in the framework and the transfer is covered by its certification.

Where an applicable adequacy arrangement is not available, appropriate contractual safeguards may be used. Depending on the circumstances, these may include the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any assessment required under UK data protection law.

Other lawful transfer mechanisms or exceptions may be used where appropriate. You may contact us if you would like further information about the safeguards used for a particular international transfer involving your personal data.

12. Data Retention

We retain personal data only for as long as it is reasonably necessary for the purpose for which it was collected and for any related legal, regulatory, accounting or business requirements.

The appropriate retention period depends on factors including the nature of the information, the reason it was collected, the duration of the business relationship, accounting and tax requirements, and the need to establish or defend legal claims.

When information is no longer reasonably required, we take appropriate steps to delete it, anonymise it or otherwise remove it from active use.

13. Data Security

We take reasonable and appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, misuse, alteration, inappropriate disclosure or destruction.

Access to personal data is limited to people who have a legitimate business reason to access it. People who handle personal data on our behalf are expected to maintain appropriate confidentiality and security.

No internet-based system can be guaranteed to be completely secure. We therefore maintain safeguards proportionate to the nature of the information and the risks involved.

14. Your Rights in the United Kingdom

Where UK data protection law applies, you may have rights in relation to your personal data, including the right to be informed, request access, correction, deletion, restriction of processing, and data portability.

These rights are not absolute and may depend on the circumstances and the lawful basis for processing. Where we rely on legitimate interests, you have the right to object to processing in appropriate circumstances.

To exercise a privacy right, contact: privacy@hattanconsulting.com

15. Complaints in the United Kingdom

If you have concerns about how we use your personal data, we would encourage you to contact us first so that we have an opportunity to address them. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

16. United States Privacy

Privacy law in the United States operates differently from the UK framework. There is no single comprehensive US privacy law equivalent to the UK GDPR that governs every organisation and every individual in the same way.

Privacy obligations and individual rights may instead arise under federal laws, state privacy laws, sector-specific rules and other legal requirements. A growing number of US states have adopted comprehensive consumer privacy legislation.

Whether a particular state privacy law applies to Hattan depends on factors that can include the state in which the individual resides, the nature of the information, the purpose for which it is processed, and the nature and scale of the organisation's activities. We therefore assess US privacy requests according to the law that applies to the individual and the particular circumstances.

17. Rights of Individuals in the United States

Where an applicable US state privacy law provides these rights, individuals may be entitled to request access, correction, or deletion of personal data, as well as information about collection purposes and categories of third parties to whom data has been disclosed.

The availability and scope of these rights varies between states and are subject to statutory exceptions and thresholds. We will consider requests in accordance with the privacy law that applies to the individual and to Hattan.

To make a US privacy request, contact: privacy@hattanconsulting.com

18. California Privacy

Where the California Consumer Privacy Act (CCPA), as amended, applies, California residents may have specific rights relating to access, correction, deletion and information about collection and disclosure. Hattan does not sell personal data and does not use personal data collected through this website for targeted or behavioural advertising.

Whether particular California rights apply depends on the scope, thresholds and exemptions contained in the relevant legislation. Nothing in this Privacy Statement is intended to suggest that Hattan is subject to a particular statutory requirement where the legislation does not apply.

19. US State Privacy Requests

If you are based in the United States and believe that a state privacy law gives you a particular right in relation to personal data held by Hattan, you may contact us at privacy@hattanconsulting.com. Please include sufficient information for us to identify you and understand the nature of your relationship with Hattan.

20. Automated Decision-Making and Profiling

We do not use personal data collected through this website to make solely automated decisions that produce legal or similarly significant effects on individuals. We do not use website analytics for behavioural advertising or automated profiling for advertising purposes.

21. Children

Hattan Consulting provides business consultancy services and this website is directed at businesses and professionals. Our services are not directed at children. We do not knowingly seek to collect personal data from children through this website.

22. Third-Party Websites

Our website may contain links to websites or services operated by third parties. We do not control how independent third parties collect, use or protect personal data. The presence of a link on the Hattan website does not make Hattan responsible for the privacy practices of the external organisation.

23. Changes to this Privacy Statement

We may update this Privacy Statement if our services, use of personal data, technology or applicable laws change. The version published on this website will apply from the time it is made available.

24. Contact

Questions about this Privacy Statement, the way we process personal data or a privacy rights request can be sent to: privacy@hattanconsulting.com

Use of this website is also subject to our Legal terms.