Privacy

Privacy Notice

Last updated: 14 April 2026

This privacy notice tells you what to expect us to do with your personal information when you contact us or engage us for services.

We are the controller of your personal data. This means we decide how and why your personal information is used.

Contact details

Legal name
Cairn Dubh (Holdings) Limited
Registered office
23 Balmore Place
Glasgow
G22 6LN
Scotland

What information we collect, use, and why

Responding to enquiries

When you submit our contact form or email us, we collect:

  • – Name
  • – Email address
  • – Organisation name (if provided)
  • – Organisation type (if provided)
  • – Area of interest (if selected)
  • – The content of your message or correspondence

We use this information only to respond to your enquiry and to follow up as appropriate.

Providing services

When we enter into an engagement with you, we may collect and use:

  • – Names and contact details of relevant individuals
  • – Details about your organisation
  • – Records of meetings, discussions, and decisions
  • – Correspondence and documents provided in connection with the engagement
  • – Invoicing and payment information

We use this information to carry out the engagement and to fulfil our contractual and professional obligations.

Queries, complaints, or claims

If you raise a query, complaint, or legal claim, we may collect and use:

  • – Names and contact details
  • – Correspondence relating to the matter

Lawful bases and your data protection rights

Under UK GDPR, we must have a lawful basis for processing personal information. Our basis varies depending on the purpose.

Responding to enquiries

We process enquiry data on the basis of legitimate interests. We have a genuine interest in communicating with people who have chosen to contact us, and responding to an enquiry is what any person submitting one would reasonably expect. You have the right of access, rectification, erasure, restriction, objection, and data portability in relation to this processing.

Providing services

Where we have entered into an engagement, we process personal data on the basis of contract — we need it to carry out the work you have asked us to do. You have the right of access, rectification, erasure, restriction, and data portability in relation to this processing. The right to object does not apply to processing that is necessary to perform a contract.

Queries, complaints, or claims

We process data relating to complaints and legal claims on the basis of legitimate interests — specifically, our interest in handling such matters appropriately and defending claims if necessary. You have the right of access, rectification, erasure, restriction, objection, and data portability in relation to this processing.

To exercise any of these rights, please contact us using the details above. We will respond within one month and there is no charge for making a request.

Where we get personal information from

Directly from you — through the contact form on this website, by email, or in the course of an engagement.

How long we keep information

Where an enquiry does not lead to an engagement, we delete the associated personal data within 12 months of the enquiry date.

Records relating to a client engagement are retained for 6 years after the engagement concludes. This reflects the prescription period for professional liability claims under Scots law.

Correspondence relating to a query, complaint, or legal claim is retained for 3 years after the matter is resolved.

Who we share your information with

This website is hosted and delivered by Cloudflare, Inc. via Cloudflare Pages. Cloudflare processes technical request data — including IP addresses and request headers — for the purposes of content delivery, caching, and security. Cloudflare may set strictly necessary security cookies in connection with this. You can read Cloudflare's privacy policy at cloudflare.com/privacypolicy.

Our contact form is provided by Tally (Tally Solutions BV), which processes form submissions as a data processor on our behalf. Tally stores data on servers within the European Economic Area. You can read Tally's privacy policy at tally.so/privacy.

We do not sell, rent, or otherwise share your personal data with any other third party, except where required to do so by law.

Cookies

This site uses a small number of cookies, set by Cloudflare for security purposes and by Tally when you use the contact form. Neither we nor our processors use cookies for advertising or tracking. Full details, including how to manage or refuse cookies, are set out in our cookie notice.

How to complain

If you have concerns about how we use your personal information, please contact us in the first instance using the details at the top of this notice. We will do our best to resolve the matter promptly.

If you remain unhappy after raising a complaint with us, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113

ico.org.uk/make-a-complaint

Changes to this notice

We may update this notice when our practices change or to reflect changes in data protection law. The version date at the top of this page will always show when the notice was last amended. Material changes will be noted below.