1. Introduction

McKean Procurement Consultancy is committed to safeguarding your personal data in accordance with the UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), and the Data (Use and Access) Act 2025. This policy outlines how I collect, process, and protect your information when you visit www.mckeanprocurementconsultancy.com or engage my consultancy services.

2. The Controller

The Data Controller responsible for your personal information is Daniel McKean trading as McKean Procurement Consultancy.

• 2.1 Correspondence Email: dmckean@mckeanprocurementconsultancy.com

3. Lawful Basis for Processing

All data processing is conducted under the following legal frameworks:

• 3.1 Contractual Necessity: Processing required to fulfil consultancy agreements.

• 3.2 Legal Obligation: Processing required for compliance with UK statutory tax laws and HMRC reporting.

• 3.3 Legitimate Interests: Processing required for professional B2B outreach and maintaining website security.

• 3.4 Consent: Processing based on your explicit permission (e.g. analytical cookies).

4. Data Collection Categories & Sources

• 4.1 Directly Collected: Data provided via contact forms, email correspondence, or during service delivery.

• 4.2 Third-Party Sources: Professional contact information obtained from sales intelligence platforms (e.g. Apollo.io), professional social media networks (e.g. LinkedIn), or other publicly available professional sources. Individuals may opt out of professional correspondence at any time by replying “Unsubscribe” or by contacting me directly.

• 4.3 Automated Data: Technical data (including IP addresses) transmitted automatically via the website infrastructure and analytics tools.

5. Data Storage & Service Providers

I utilise Tier-1 service providers contractually bound to UK GDPR-compliant standards. All data remains within secure cloud environments:

• 5.1 Professional Infrastructure: Google Workspace (including Drive, Sheets, and Gmail) is utilised for all client files, correspondence, and project documentation.

• 5.2 Data Analysis & Visualisation: I utilise industry-standard tools (e.g. Google Looker, Power BI, or Google Sheets) for spend analysis and procurement dashboarding.

• 5.3 Financial Management: I utilise industry-standard cloud accounting software and professional accountancy services to manage invoicing and statutory UK tax reporting.

• 5.4 Employment & Contract Management: For specific engagements (e.g., inside IR35), I utilise third-party Umbrella Companies (e.g. PayStream). These entities act as the Employer of Record and process data for contract execution, background screening, timesheet management, statutory tax compliance (PAYE/NICs), and the provision of professional indemnity and public liability insurance.

• 5.5 Sales Intelligence & CRM: I utilise Apollo.io (and similar industry-standard platforms) for the secure storage and management of professional contact data.

• 5.6 Artificial Intelligence (AI) Processing: I utilise AI tools (e.g. Google Gemini, Gamma Tech, or Claude Pro) to assist in drafting procurement specifications, strategic frameworks, reports, and professional correspondence. While used for commercial output, these tools may process personal identifiers contained within source documents.

• 5.7 AI Governance & Human-in-the-Loop: I utilise “Pro/Enterprise” tiers to ensure data is not used for model training. All AI-assisted outputs are subject to comprehensive human review and professional validation before delivery.

• 5.8 Website Analytics & Media: I utilise Google Analytics and YouTube to manage website performance and host video content.

• 5.9 Communication & Video Conferencing: I utilise Google Meet, Microsoft Teams, and Calendly for meeting coordination and project delivery.

• 5.10 Zero-Local-Data Policy: Sensitive client files and financial records are processed within secure cloud perimeters and are not stored on local physical hardware.

6. Flexible Service Delivery & International Safeguards

I provide services via a flexible delivery model, which may be conducted from within the UK or remotely from international jurisdictions.

• 6.1 Encryption: All remote access is conducted via a secure Virtual Private Network (VPN).

• 6.2 Identity Management: Access requires Multi-Factor Authentication (MFA).

• 6.3 International Transfers: Where data is accessed from outside the UK, I ensure appropriate safeguards (typically IDTAs or SCCs) are in place to ensure data remains protected to UK standards.

7. External Links & Third-Party Content

• 7.1 My website contains links to other sites (e.g. LinkedIn). Informational documents (such as PDFs) may open in a new browser window for your convenience. Once you leave my website, I do not have control over that destination site or the privacy practices of third parties.

• 7.2 Interacting with embedded third-party content (e.g. YouTube videos) may allow those providers to collect data, governed by their respective privacy policies.

8. Data Retention & Erasure

• 8.1 Personal data is retained only for the duration necessary for processing. In accordance with UK HMRC requirements, financial and tax records are retained for 6 years.

9. Security & Data Breaches

• 9.1 I implement appropriate technical and organisational measures to secure your data. Significant data breaches will be reported to the Information Commissioner’s Office (ICO) within 72 hours.

10. Your Rights

• 10.1 Under the UK GDPR, you possess the rights of Access, Rectification, Erasure, and Objection. To exercise these rights, please contact the email in Section 2. You may also lodge a complaint with the ICO (www.ico.org.uk).

11. Statutory & Contractual Requirements

• 11.1 The provision of certain personal data is a contractual and legal requirement. Failure to provide such data may render me unable to enter into a contract or provide consultancy services to you.

• 11.2 I may update this policy periodically to reflect changes in legislation.

Effective Date: 10th February 2026