Privacy and Cookie Policy
Introduction
1. Introduction
At Kumi we are committed to respecting your privacy and protecting your personal data. This policy explains how we collect and use personal data that we obtain through our website and other means, such as email, in person or from other third-party sources.
We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Where we process personal data of individuals in the European Economic Area (including France, Italy and Germany), we also comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679). We do not sell or rent your personal data. We only share it with the categories of recipient described in section 6 below.
2. Who we are (Data Controller)
Kumi Consulting Ltd is the data controller for personal data collected through this website and our business activities in the UK.
| Contact | Details |
| Registered office | 7 Bell Yard, London, WC2A 2JR |
| Companies House no. | 9363271 |
| Privacy Lead | privacy@kumi.consulting |
| General enquiries | info@kumi.consulting |
| Data Protection Officer | We are not required to appoint a statutory DPO. Data protection queries are handled by our Privacy Lead at the address above. |
3. Information we collect
3.1 From you directly
You may provide us with personal data when you are introduced to us, when we meet you in person, or when we are in contact by phone, email or via our website or otherwise. The categories of personal data you provide may include:
- First and last name
- Job title and company name
- Email address
- Mailing address
- Telephone number
- Professional background information you choose to share with us (e.g. CV, biography, areas of expertise)
- Correspondence, meeting records and notes generated when we interact with you
- Any other identifier that permits Kumi to make contact with you.
3.2 From third parties and public sources
We collect most of this personal data from you directly. However, we may also collect information about you from other sources such as:
- Publicly accessible sources
- Information you have made public on websites associated with you or your company or on social media platforms such as LinkedIn
- A third party, e.g. a person who has introduced you to us or other professionals you may have worked with or you may engage
- Business-information providers and sanctions/PEP screening services used for client due diligence
- Our clients or partners, where they provide your details in connection with a project we are delivering
3.3 From your use of our website
When you visit our website (kumi.consulting), we may collect, store and use information about your visit and the device you use to access the site. This may include your IP address, browser and device type, referring pages, pages visited, approximate location derived from your IP address and information collected through cookies and similar technologies.
You can browse much of our website without directly identifying yourself. However, where you have previously interacted with us, registered for an event, downloaded content, subscribed to communications, provided your details to us or otherwise engaged with Kumi, we may associate information about your interactions with our website, emails, events and content with your existing contact record.
We use this information to administer and secure our website, understand how our website and content are used, improve our services and user experience, measure the effectiveness of our marketing and business development activities and help us better manage our relationships with clients, prospects and other stakeholders.
Details of the cookies and similar technologies we use, and how to control them, are set out in our separate Cookie Notice.
4. Why we collect your data and our lawful basis
We only process personal data where we have a lawful basis under UK GDPR (and EU GDPR where applicable). The table below sets out our processing purposes, the lawful basis we rely on for each, and where relevant the specific legitimate interest pursued.
| Purpose | Lawful basis | Specific interest / notes |
| Delivering advisory and consulting services to our clients | Performance of a contract; legitimate interests (where you are a contact at a client organisation) | Running our business and meeting client obligations |
| Client and supplier records; keeping contact information up to date | Legitimate interests; legal obligation (record-keeping) | Efficient administration of ongoing relationships |
| Marketing, sales and business development activities | Legitimate interests; consent where required (e.g. individual subscribers, PECR) | Promoting our services to relevant professional audiences. You can opt out at any time via the unsubscribe link or by emailing info@kumi.consulting |
| Client due diligence, sanctions and conflicts checks | Legitimate interests; legal obligation | Preventing financial crime and managing conflicts |
| Recruitment | Legitimate interests; consent (where you submit an application); pre-contractual steps | Assessing candidates for roles at Kumi |
| IT security, monitoring and back-ups | Legitimate interests (network and information security) | Protecting our systems and your data. Recognised legitimate interest under DUAA 2025. |
| Compliance with legal, tax and regulatory obligations | Legal obligation | E.g. HMRC record-keeping, responding to lawful requests from regulators |
| Handling enquiries, feedback and complaints | Legitimate interests; legal obligation (Data Protection Act 2018 s.164A complaints handling) | Responding to you and improving our service |
5. Use of AI tools
We use approved AI tools and AI enabled functionality to support our work including research, analysis, administration, communications and service delivery. Where these tools process personal data, we do so in line with our internal AI Use Policy, which is aligned with the EU AI Act, the ICO’s guidance on AI and the OECD AI Principles. Human oversight remains central to our decision making process and we do not make decisions about you that produce legal or similarly significant effects based solely on automated processing. If this changes, we will update this policy.
6. Who we share your data with
We share personal data only with the categories of recipient below, and only to the extent necessary for the purposes described in section 4:
- Cloud, technology and communications providers that support our business operations, including email, collaboration, CRM, marketing, webinar, analytics and hosting platforms
- Professional advisers, including our accountants, auditors, lawyers and HR advisers
- Independent consultants, associates and sub-contractors engaged to support the delivery of our services, under written confidentiality and data protection obligations.
- Sanctions, PEP and due-diligence screening providers
- Regulators, tax authorities, law enforcement and courts where we are required by law to disclose
- Other organisations or individuals where necessary in connection with a corporate transaction, restructuring, merger or acquisition
7. International transfers of your data
Kumi Consulting Ltd is a UK-based organisation that works with clients, contacts and partners internationally. Some authorised employees may access personal data when working outside the UK, and some of our service providers may process personal data outside the UK or European Economic Area (EEA). Where personal data is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place in accordance with applicable data protection laws.
Where personal data is transferred outside the UK or EEA, we rely on one or more of the following safeguards:
- Transfers between the UK and EEA countries are supported by applicable adequacy decisions issued by the UK Government and the European Commission, as relevant.
- Transfers to the United States and other third countries by our service providers (for example cloud, communications, CRM, marketing, analytics and webinar platforms) are protected by approved transfer mechanisms, which may include the UK-US Data Bridge, the EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement (IDTA), or other legally recognised safeguards.
Where required, we undertake appropriate due diligence and implement contractual, technical and organisational measures to protect personal data transferred internationally.
8. How long we keep your data
We keep personal data only for as long as necessary for the purpose for which it was collected, or for as long as we are required to by law. Typical retention periods are:
| Category of data | Retention period |
| Client and contract records (including invoices) | 7 years after the end of the engagement (to satisfy tax, audit and limitation-period requirements) |
| Business development / marketing contacts | Up to 3 years from last meaningful engagement, then deleted or anonymised |
| Website analytics and cookie data | As set out in our Cookie Notice (typically two years or less) |
| Unsuccessful recruitment candidates | 12 months from the decision, unless you consent to us keeping your details for longer |
| Correspondence and general enquiries | Up to 3 years from last contact |
| Records required by law (e.g. AML, tax) | For the period required by the relevant legislation (typically 5–7 years) |
9. Your rights
Under data protection law, you have the following rights in relation to your personal data. Some of these rights only apply in certain circumstances.
- The right to be informed about how we use your personal data (this policy)
- The right of access to a copy of the personal data we hold about you
- The right to rectification of inaccurate or incomplete data
- The right to erasure (the ‘right to be forgotten’)
- The right to restrict processing
- The right to data portability
- The right to object to processing based on legitimate interests, and to object to direct marketing at any time
- The right to withdraw consent, where our processing is based on consent
- Rights in relation to automated decision-making and profiling (we do not currently carry out such processing)
To exercise any of these rights, please email privacy@kumi.consulting or write to us at the address in section 2. We will respond within ten working days, and will carry out a reasonable and proportionate search for the personal data we hold about you.
10. How to complain
If you have a concern about how we are handling your personal data, please contact us first at privacy@kumi.consulting. We will:
- acknowledge your complaint within ten working days;
- investigate it and take appropriate steps to respond; and
- inform you of the outcome without undue delay.
You also have the right to complain to a supervisory authority:
- In the UK: the Information Commissioner’s Office (soon to be renamed the Information Commission) – ico.org.uk/make-a-complaint
- In France: the Commission nationale de l’informatique et des libertés (CNIL) – cnil.fr
- In Italy: the Garante per la protezione dei dati personali – garanteprivacy.it
- In Germany: your competent Land data protection authority, or the BfDI
- Elsewhere in the EEA: your local supervisory authority
11. Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse. These include access controls, encryption in transit and at rest for our core systems, multi-factor authentication, staff training and a documented information security policy. We hold Cyber Essentials status and review our controls regularly.
12. Changes to this policy
We keep this policy under review and will update it from time to time. The latest version will always be on our website. This policy was last updated on 22 September 2026.
13. Contact us
To have your information removed or rectified, or if you have any questions about our privacy policy or your information, please contact us:
By email: privacy@kumi.consulting (data protection matters) or info@kumi.consulting (general enquiries)
By post: Kumi Consulting Ltd, 7 Bell Yard, London WC2A 2JR, United Kingdom
Cookie Policy
1. About this notice
This Cookie Notice explains how Kumi Consulting Ltd (“Kumi”, “we”, “us”) uses cookies and similar technologies on our website at kumi.consulting. It sits alongside our Privacy policy, which explains how we handle personal data more generally.
We use cookies and similar technologies that are strictly necessary for our website to function, together with analytics and marketing technologies that help us understand how our website is used, measure the effectiveness of our marketing activities and improve our communications. Any non-essential cookies or similar technologies will only be used in accordance with applicable consent requirements.
2. What are cookies and similar technologies?
Cookies are small text files that a website places on your device when you visit. They allow the site to recognise your device, remember your preferences and collect information about how you use the site.
The rules also cover other “storage and access technologies” that perform similar functions, including:
- Tracking pixels and web beacons
- Local and session storage in your browser
- Device fingerprinting
- Scripts and tags loaded from third parties
Where we refer to “cookies” in this notice, we mean cookies and any of these similar technologies.
3. Legal basis and your choices
Our use of cookies is governed by:
- the Privacy and Electronic Communications Regulations 2003 (PECR), as updated by the Data (Use and Access) Act 2025, for visitors in the UK; and
- the EU ePrivacy Directive (2002/58/EC) as transposed in each Member State (in particular, the French Loi Informatique et Libertés and Italian Privacy Code), together with the EU GDPR, for visitors in the EEA.
Under these rules:
- Strictly necessary cookies do not require your consent.
- Statistical cookies used only to improve our website may, under the DUAA 2025, be set without prior consent in the UK, provided you are informed and can opt out. In the EEA, we treat these as requiring consent unless they meet the very narrow “CNIL exemption” for aggregated, first-party analytics.
- All other cookies (including advertising, cross-site tracking, social media plug-ins) require your prior, freely given, specific, informed and unambiguous consent before they are set.
Our cookie banner is designed to comply with the strictest standard, so that visitors from EEA countries receive the same protections as UK visitors.
4. Cookies we use
The tables below list the cookies and similar technologies we use, grouped by the service that sets them, together with their consent category, what they do, and how long they last.
Wistia
Category: Statistics, Marketing
Usage: We use Wistia for video display.
Sharing data: For more information, please read the Wistia Privacy Statement.
| Category | Cookie Name | Expiration | Function |
| Statistics | wistia-video-progress-* | persistent | Store if the user has seen embedded content |
| Marketing | wistia | persistent | Store performed actions on the website |
Google reCAPTCHA
Category: Functional, Marketing
Usage: We use Google reCAPTCHA for spam prevention.
Sharing data: For more information, please read the Google reCAPTCHA Privacy Statement.
| Category | Cookie Name | Expiration | Function |
| Functional | _grecaptcha | 6 months | Provide spam protection |
| Marketing | rc::c | session | Read and filter requests from bots |
| Marketing | rc::b | session | Read and filter requests from bots |
| Marketing | rc::a | persistent | Read and filter requests from bots |
WordPress
Category: Functional
Usage: We use WordPress for website development.
Sharing data: This data is not shared with third parties.
| Category | Cookie Name | Expiration | Function |
| Functional | wpEmojiSettingsSupports | session | Store browser details |
Google Analytics
Category: Statistics
Usage: We use Google Analytics for website statistics.
Sharing data: For more information, please read the Google Analytics Privacy Statement.
| Category | Cookie Name | Expiration | Function |
| Statistics | _ga | 2 years | Store and count pageviews |
| Statistics | _ga_* | 1 year | Store and count pageviews |
Complianz
Category: Functional
Usage: We use Complianz for cookie consent management.
Sharing data: This data is not shared with third parties. For more information, please read the Complianz Privacy Statement.
| Category | Cookie Name | Expiration | Function |
| Functional | cmplz_functional | 365 days | Store cookie consent preferences |
| Functional | cmplz_statistics | 365 days | Store cookie consent preferences |
| Functional | cmplz_preferences | 365 days | Store cookie consent preferences |
| Functional | cmplz_marketing | 365 days | Store cookie consent preferences |
| Functional | cmplz_consented_services | 365 days | Store cookie consent preferences |
| Functional | cmplz_policy_id | 365 days | Store accepted cookie policy ID |
| Functional | cmplz_saved_services | 365 days | Store cookie consent preferences |
| Functional | cmplz_id | 365 days | Store cookie consent preferences |
| Functional | cmplz_banner-status | 365 days | Store if the cookie banner has been dismissed |
| Functional | cmplz_saved_categories | 365 days | Store cookie consent preferences |
| Functional | cmplz_user_data | 365 days | Read to determine which cookie banner to show |
| Functional | cmplz_cookie_data | 365 days | Store information about cookies that have been detected on the site |
Vimeo
Category: Statistics
Usage: We use Vimeo for video display.
Sharing data: For more information, please read the Vimeo Privacy Statement.
| Category | Cookie Name | Expiration | Function |
| Statistics | __utmt_player | 10 minutes | Store and track audience reach |
| Statistics | vuid | 2 years | Store the user’s usage history |
Google Adsense
Category: Marketing, Statistics
Usage: We may use Google Adsense for showing advertisements.
Sharing data: For more information, please read the Google Adsense Privacy Statement.
| Category | Cookie Name | Expiration | Function |
| Marketing | _gcl_au | persistent | Store and track conversions |
| Marketing | google_adsense_settings | persistent | Provide ad delivery or retargeting |
| Statistics | _gcl_ls | — | Store and track interaction |
HubSpot
Category: Marketing, Functional, Preferences
Usage: We use HubSpot for marketing automation (automated email marketing).
Sharing data: For more information, please read the HubSpot Privacy Statement.
| Category | Cookie Name | Expiration | Function |
| Marketing | hubspotutk | 13 months | Store and track a visitor’s identity |
| Marketing | __hstc | 13 months | Store time of visit |
| Functional | __hssc | 30 minutes | Store anonymized statistics |
| Functional | __hs_cookie_cat_pref | 6 months | Store cookie consent preferences |
| Functional | *_key | 2 weeks | Store logged in users |
| Functional | hs_ab_test | session | Store ID’s of experiments and sessions for A/B testing |
| Functional | __hs_do_not_track | 6 months | Store ‘do not track’ signals |
| Preferences | messagesUtk | 13 months | Store browser details |
| Preferences | __hsmem | 1 week | Store logged in users |
| Preferences | hs-messages-is-open | 30 minutes | Store if a message has been shown |
Category: Functional, Marketing, Statistics, Preferences
Usage: We use LinkedIn for display of recent social posts and/or social share buttons.
Sharing data: For more information, please read the LinkedIn Privacy Statement.
| Category | Cookie Name | Expiration | Function |
| Functional | sdsc | session | Provide load balancing functionality |
| Functional | li_gc | 6 months | Store cookie consent preferences |
| Functional | BizographicsOptOut | 10 years | Store privacy preferences |
| Marketing | lms_ads | 30 days | Store and track visits across websites |
| Marketing | _guid | 90 days | Store and track a visitor’s identity |
| Marketing | li-oatml | 1 month | Provide ad delivery or retargeting |
| Marketing | li_sugr | 90 days | Store and track a visitor’s identity |
| Marketing | UserMatchHistory | 30 days | Provide ad delivery or retargeting |
| Statistics | lms_analytics | 30 days | Store and track a visitor’s identity |
| Statistics | AnalyticsSyncHistory | 30 days | Store and track visits across websites |
| Preferences | li_alerts | 1 year | Store if a message has been shown |
| Preferences | bcookie | 1 year | Store browser details |
| Preferences | lidc | 1 day | Provide load balancing functionality |
| Preferences | bscookie | 1 year | Store logged in users |
5. Third parties that may set cookies
We name the specific third parties that may set cookies on our site, in line with CNIL and Garante expectations that visitors know exactly who is processing their data:
- Wistia – We use Wistia for video display.
- Google reCAPTCHA – We use Google reCAPTCHA for spam prevention.
- WordPress – We use WordPress for website development.
- Google Analytics – We use Google Analytics for website statistics.
- Complianz – We use Complianz for cookie consent management.
- Vimeo – We use Vimeo for video display.
- Google Adsense – We use Google Adsense for showing advertisements.
- HubSpot – We use HubSpot for marketing automation (automated email marketing).
- LinkedIn – We use LinkedIn for display of recent social posts and/or social share buttons.
Each of these providers has its own privacy and cookie information, and you can find it via their websites.
6. Managing your cookie preferences
You are in control of what non-essential cookies are set on your device. We use the Complianz privacy suite to manage cookie consent across our website. You can manage your preferences through the following methods:
- Our cookie banner: When you first visit our site (or after you clear your browser cookies), you will see a consent banner generated by Complianz. This banner provides options to “Accept”, “Deny”, or “Manage preferences” to choose your settings category by category. No non-essential cookies are deployed until you have explicitly made a choice.
- Changing your mind at any time: You can review, adjust, or withdraw your consent at any time by clicking the “Manage Cookie Consent” link located permanently in the footer of every page. Withdrawing consent is designed to be just as straightforward as providing it.
- Browser settings: Most internet browsers allow you to block or delete cookies entirely. Comprehensive guidance is available directly on the official support pages for Google Chrome, Apple Safari, Mozilla Firefox, and Microsoft Edge. Please note that restricting strictly necessary cookies may prevent certain functional elements of our website from working properly.
- Global Privacy Control (GPC) / Do Not Track: If your browser is configured to send a recognized opt-out signal, such as Global Privacy Control, our Complianz integration is set to automatically detect this signal and treat it as a formal refusal of all non-essential cookies.
7. How this relates to your personal data
Some of the information collected through cookies (for example, IP address, device identifiers, browsing behaviour) is personal data under the UK GDPR and EU GDPR. Where that is the case, our Privacy Policy explains how we handle it, including:
- the lawful basis on which we rely (consent for non-essential cookies; legitimate interests for security and, in the UK, statistical purposes);
- the categories of recipient with whom we share it (see section 5);
- international transfers (Google Analytics data may be processed in the United States under the EU–US Data Privacy Framework and the UK–US Data Bridge);
- how long we keep it; and
- your rights, including the right to access, rectify, erase, restrict, object and complain.
8. Changes to this notice
We review this Cookie Notice regularly, and at least once a year, to make sure it accurately describes the cookies used on our website. Where we make significant changes, we will let you know via our website or by asking for renewed consent in the cookie banner.
9. Contact and complaints
If you have any questions about our use of cookies, please contact us:
- By email: privacy@kumi.consulting
- By post: Kumi Consulting Ltd, 7 Bell Yard, London WC2A 2JR, United Kingdom
You also have the right to complain to a supervisory authority:
- UK – Information Commissioner’s Office (soon to be renamed the Information Commission): ico.org.uk
- France – Commission nationale de l’informatique et des libertés (CNIL): cnil.fr
- Italy – Garante per la protezione dei dati personali: garanteprivacy.it
- Germany – your competent Land data protection authority, or the BfDI