Privacy Policy

---

Last Updated: 05 January 2026

At Lion Oak Advisory, we are committed to protecting and respecting your privacy. This policy explains how we collect, use, and protect your personal data when you visit our website or contact us regarding our professional services.

1. Who We Are

Lion Oak Advisory provides high-end consultancy services in technical projects. For the purposes of the UK General Data Protection Regulation (UK GDPR), we act as the "Controller" for the personal data collected via this website. When delivering services to our clients, we typically act as the "Processor".

2. The Data We Collect

We may collect and process the following information:

• Identity      & Contact Data: Name, job title, company name, email address, and      telephone numbers.
• Technical      Data: User IDs, IP addresses, and audit logs collected for security      and system management.
• Professional      Data: Details regarding your role, internal team structures, or      project requirements.

3. Prospective Associates and Network Members

If you apply to join the Lion Oak associate network, we collect additional information to assess your suitability for our high-end professional services:

• Expertise      & Vetting: Professional CVs, certifications, and details of      previous technical projects.
• Security      Clearances: Information regarding staff clearance levels (e.g., BPSS,      SC) to ensure compliance with client requirements.
• Confidentiality:     All associates are required to sign confidentiality agreements and receive      training on data protection and cybersecurity best practices.

4. How We Use Your Data

We process your personal data to:

• Deliver      agreed consultancy services and deliverables.
• Communicate      with stakeholders and manage project resources.
• Comply      with legal and regulatory obligations.

Lawful Basis: We process this data based on our Legitimate Interests in managing business inquiries, or to take steps to enter into a Contract with you.

5. Technical and Organisational Measures (TOMs)

We implement robust security measures to protect your data, including:

• Access      Control: Access is restricted to authorised personnel using      Multi-Factor Authentication (MFA) and strong password policies.
• Device      Security: All laptops and mobile devices used to access data are fully      encrypted and kept up to date with security patches.
• Encryption:     Data in transit is encrypted using TLS 1.2 or higher, and secure VPNs are      used for transmissions over public networks.
• Government      Standards: We handle data in accordance with the Government Security      Classification Policy (GSCP).

6. Sharing Your Data (Sub-processors)

We may share your data with trusted sub-processors, such as cloud storage and productivity providers (e.g., Microsoft 365, Google Workspace) hosted within the UK or EEA. We ensure written agreements are in place that impose data protection obligations no less onerous than our own.

7. Data Retention

We retain personal data for the duration of our agreement and for a subsequent period (typically 6 years) for archival, audit, and legal purposes, or until the data is deleted or returned in accordance with our agreements.

8. Your Legal Rights

Under the UK GDPR and the Data Protection Act 2018, you have the right to request access to, correction of, or erasure of your personal data. You may also object to or restrict the processing of your data.

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).