Privacy

Waterfall Works respects your privacy and is committed to handling personal information fairly, lawfully, transparently and securely.

This privacy notice explains what personal information we collect and use, why we use it, the lawful basis for doing so, where it comes from, who we may share it with, how long we keep it and the rights you have.

1. Who we are

Waterfall Works is a trading name of Caporetto Contracting Ltd.

Caporetto Contracting Ltd is registered in England and Wales under company number 09406101.

Registered office: 4th Floor, 18 St. Cross Street, London, England, EC1N 8UN

For the personal information covered by this notice, Caporetto Contracting Ltd is the data controller, unless we specifically explain otherwise.

For privacy enquiries, to exercise your data protection rights, or to make a complaint about our use of your personal information, contact:

privacy@waterfallworks.co.uk

You may also write to us at our registered office above.

2. Who this notice applies to

This notice may apply to:

• visitors to our website;
• people who contact Waterfall Works, including through our online booking tool;
• prospective clients and their representatives;
• clients and people working for client organisations;
• suppliers, contractors and professional advisers;
• prospective suppliers and business partners;
• professional and business contacts;
• people we contact in connection with legitimate business-development activity; and
• other individuals whose personal information we process in connection with running Waterfall Works.

Waterfall Works provides business-to-business services. Our website and services are not directed at children.

3. Personal information we may collect

The information we collect depends on how you interact with us. It may include:

Contact and professional information

• name;
• business email address;
• telephone number;
• employer or organisation;
• job title;
• professional role;
• business address; and
• other professional contact details.

Booking and scheduling information

When you use our online booking tool to arrange an introductory call, we (and our scheduling provider, Calendly — see section 10) collect your name, email address, the date and time you select, and any information you choose to add in the booking notes.

Website contact form information

When you send us a message using the contact form on our Get in Touch page, we (and our form-processing provider, Formspree — see section 10) collect your name, email address, and any company name, company website or message content you choose to provide.

Enquiry and correspondence information

This may include:

• emails and other correspondence;
• information you provide when describing your organisation, situation or requirements;
• meeting notes;
• information supplied when discussing a potential engagement;
• proposals, quotations and related correspondence; and
• documents or other materials you choose to send us.

Client and engagement information

Where Waterfall Works is engaged to provide services, we may process information including:

• names and contact details of people involved in the engagement;
• organisational structures and responsibilities;
• information about roles, teams and working arrangements;
• meeting and interview notes;
• information about business processes and activities;
• operational documentation;
• correspondence;
• project and implementation information; and
• other information reasonably necessary to provide the agreed services.

The exact information involved will depend on the nature of the engagement.

Supplier and business-administration information

This may include:

• supplier and professional-adviser details;
• contractual information;
• invoices;
• payment and transaction records;
• business correspondence; and
• information required for accounting, insurance, legal or regulatory purposes.

Website and technical information

When you access our website, our hosting and technical infrastructure may process information such as:

• IP address;
• browser type;
• device and operating-system information;
• date and time of access;
• pages or files requested;
• referring information;
• server requests; and
• technical, diagnostic or security logs.

We do not use this information to create advertising profiles about website visitors.

Website analytics information

Once you've accepted our cookie banner, we use Google Analytics to understand how visitors use this site — which pages are viewed, roughly how many visitors we get, general device/browser information and traffic sources. We have not enabled Google's advertising or cross-site remarketing features; this is usage measurement, not ad targeting.

4. Where we obtain personal information

We may obtain personal information:

Directly from you

For example when you:

• contact us;
• email us;
• book an introductory call through our website;
• speak with us by telephone or video call;
• attend a meeting;
• provide documents or information;
• request a proposal;
• engage Waterfall Works; or
• otherwise communicate with us.

From your organisation or other people involved in an engagement

For example, a client may provide the names and business contact details of employees, advisers, suppliers or other people we need to speak with in order to perform our work.

From publicly available business and professional sources

Where appropriate, we may obtain business contact information from sources such as:

• company websites;
• professional networking platforms;
• public business directories;
• Companies House;
• professional publications; and
• other legitimate publicly available sources.

We may use this information for purposes including researching organisations, identifying relevant business contacts and conducting proportionate business-to-business marketing.

From referrals and professional contacts

Another business contact, adviser, client or professional connection may introduce or refer you to us.

5. How we use personal information and our lawful bases

UK data protection law requires us to have a lawful basis for using personal information. The lawful basis depends on why the information is being used.

Responding to enquiries and arranging calls

We may use personal information to:

• respond to enquiries;
• understand the situation you are asking us about;
• communicate with you;
• arrange and manage meetings, including calls booked through our online scheduling tool;
• assess whether Waterfall Works can help;
• prepare proposals or quotations; and
• take steps towards a potential engagement.

Where you are entering into a contract with us personally, the lawful basis may be taking steps at your request before entering into a contract.

Where you are acting for a company or other organisation, we generally rely on our legitimate interests in responding to business enquiries, developing client relationships and operating our business.

Providing Waterfall Works services

We may use personal information to:

• understand an organisation and its operations;
• conduct interviews and meetings;
• analyse business processes, workload, capacity, roles or working arrangements;
• perform agreed analysis;
• design recommendations or solutions;
• support implementation;
• communicate with people involved;
• manage deliverables; and
• administer the engagement.

Where the client contracts with us personally, the lawful basis may be performance of a contract.

Where the client is an organisation, we generally rely on our legitimate interests in delivering and administering the services the organisation has engaged us to provide.

Where required, we may also process information to comply with a legal obligation.

Managing client and business relationships

We may use personal information to:

• maintain client and professional relationships;
• communicate about an engagement;
• manage contracts;
• maintain appropriate business records;
• deal with queries or disputes; and
• follow up on work previously undertaken.

Our lawful basis is generally our legitimate interests in managing our business and professional relationships, or performance of a contract where applicable.

Accounting, taxation and business administration

We may process personal information for:

• invoicing;
• payment administration;
• accounting and bookkeeping;
• tax;
• company records;
• insurance;
• auditing;
• professional advice; and
• other legal or regulatory requirements.

Our lawful basis is generally compliance with a legal obligation and, where applicable, our legitimate interests in properly administering and protecting the business.

Establishing, exercising or defending legal rights

We may process and retain relevant information where necessary to:

• obtain legal advice;
• resolve disputes;
• recover debts;
• make or defend legal claims;
• enforce contractual rights; or
• respond to regulatory or legal proceedings.

Our lawful basis is generally our legitimate interests in protecting our legal and commercial interests.

Website operation and security

Technical information may be processed in order to:

• serve and operate the website;
• maintain availability;
• diagnose faults;
• protect the website and infrastructure;
• investigate suspicious activity;
• prevent abuse; and
• maintain technical and security records.

Our lawful basis is our legitimate interests in maintaining a secure, reliable and properly functioning website and IT environment.

Data protection requests and complaints

We may use personal information in order to:

• verify and respond to requests concerning data protection rights;
• investigate complaints;
• communicate with complainants;
• maintain records of how requests or complaints were handled; and
• demonstrate compliance with our legal duties.

Our lawful basis is principally compliance with our legal obligations, together with our legitimate interests where appropriate in resolving disputes and maintaining evidence of compliance.

6. Our legitimate interests

Where we rely on legitimate interests, those interests may include:

• operating and developing Waterfall Works;
• responding to prospective clients;
• providing our services;
• communicating with people at client organisations;
• managing professional and commercial relationships;
• developing new business;
• protecting our business, systems and information;
• preventing misuse, fraud or security incidents;
• maintaining appropriate records;
• obtaining professional advice; and
• establishing, exercising or defending legal rights.

Before relying on legitimate interests, we consider whether the use of personal information is necessary and proportionate and whether your interests, rights and freedoms override our interests.

7. Business-to-business marketing

Waterfall Works may undertake proportionate business-to-business marketing, including contacting organisations and relevant professional contacts where we reasonably believe our services may be relevant.

Business contact information may have been provided directly to us or obtained from legitimate publicly available professional or business sources.

Where we use personal information for direct marketing and the law permits us to do so without consent, our lawful basis under UK data protection law is generally our legitimate interests in promoting and developing Waterfall Works.

We will comply with the Privacy and Electronic Communications Regulations where they apply. In particular:

• electronic marketing to corporate subscribers may be sent without prior consent where permitted by law;
• where the recipient is treated as an individual subscriber, including certain sole traders and partnerships, we will only send electronic marketing where we have the consent or other legal permission required by law;
• we will identify ourselves in marketing communications; and
• we will provide an appropriate way to opt out.

You may object to the use of your personal information for direct marketing at any time.

If you opt out or object, we may retain limited information on a suppression list so that we can respect your request and avoid contacting you again for that purpose.

8. Special category and criminal offence information

Waterfall Works does not ordinarily seek special category personal information or criminal offence information. Special category information includes information revealing or concerning matters such as:

• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs;
• trade union membership;
• genetic information;
• biometric information used for identification;
• health;
• sex life; and
• sexual orientation.

If this type of information becomes genuinely necessary in connection with an engagement, we will only process it where the required lawful basis and additional legal condition apply.

Criminal offence information will only be processed where permitted by law and subject to any additional safeguards required.

Please do not send sensitive personal information to Waterfall Works unless it is genuinely necessary.

9. Where Waterfall Works acts as a processor for a client

In some consulting engagements, a client may give Waterfall Works access to personal information which the client controls.

For example, information about the client's employees, customers or other individuals may appear in operational records or systems relevant to an engagement.

Where the client determines the purposes and means of processing that information and Waterfall Works processes it only on the client's documented instructions, the client will normally be the data controller and Waterfall Works will act as a data processor. In those circumstances:

• the client's privacy information is principally responsible for explaining the use of that information to affected individuals;
• our processing will be governed by appropriate contractual data-processing provisions; and
• we will only process the information as permitted by our agreement with the client and applicable law.

Waterfall Works may still act separately as a data controller for information used for our own legitimate purposes, such as engagement administration, correspondence, invoicing, legal compliance and our own business records.

10. Who we share personal information with

We do not sell personal information. Where reasonably necessary, we may share personal information with or allow it to be processed by:

• website, hosting and IT providers;
• our online scheduling provider;
• our website contact-form provider;
• email and communications providers;
• cloud and document-storage providers;
• professional advisers;
• accountants;
• insurers;
• solicitors;
• contractors or specialist suppliers working with us where appropriate;
• client organisations where necessary in connection with an engagement;
• regulators, public bodies, law-enforcement agencies or courts where required or permitted by law; and
• another organisation in connection with a genuine sale, restructuring, merger or transfer of all or part of our business, subject to appropriate safeguards.

Our principal providers currently relevant to this website, our booking tool and email communications are:

Calendly

Calendly, Inc. provides the online scheduling tool used on our Get in Touch page. When you book an introductory call, the name, email address, chosen time and any notes you provide are processed by Calendly in order to schedule, confirm and manage the meeting. Calendly's own privacy notice explains how Calendly separately uses information in connection with operating its own platform.

Formspree

Formspree, Inc. processes submissions from the contact form on our Get in Touch page. When you send us a message, your name, email address, and any company name, company website or message content you provide are transmitted to us via Formspree's infrastructure. Formspree's own privacy notice explains how it separately uses information in connection with operating its own platform.

Google Analytics

Google LLC provides the Google Analytics service we use to understand how visitors use this website, once you've accepted our cookie banner. Google's own privacy policy explains how Google separately uses information in connection with operating its own platform.

Hostinger

Hostinger provides hosting and associated infrastructure for the Waterfall Works website. Technical information such as IP addresses and server requests may therefore be processed through Hostinger's infrastructure in order to deliver, maintain and secure the website.

Namecheap

Namecheap provides Waterfall Works' domain/DNS services and business email service. Personal information contained in emails sent to or received from Waterfall Works may therefore be processed through Namecheap's email infrastructure.

Where service providers process personal information on our behalf, we expect them to do so subject to appropriate contractual, confidentiality and security requirements.

11. International transfers

Some of the technology providers we use, or their sub-processors, may process personal information outside the United Kingdom.

In particular, Calendly, Inc. and Google LLC are United States companies, and their data-processing arrangements may involve processing personal information in the United States. Namecheap's data-processing arrangements similarly allow customer data to be processed in the United States. Hostinger and its sub-processors may also process information outside the United Kingdom depending on the services and infrastructure involved.

Where our use of a service involves a restricted transfer of personal information outside the United Kingdom, we take steps to ensure an appropriate lawful transfer mechanism applies. Depending on the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved Standard Contractual Clauses; or
• another lawful transfer mechanism recognised under UK data protection law.

You can contact privacy@waterfallworks.co.uk if you would like further information about the safeguards relevant to a particular transfer.

12. How long we keep personal information

We do not keep personal information for longer than reasonably necessary for the purposes for which it was collected. Retention depends on the type of information and why we hold it.

Enquiries and bookings that do not become client engagements

We will normally retain enquiry correspondence, booking information and related information for up to 24 months after the last meaningful contact. We may retain it for longer where reasonably necessary because of a dispute, legal issue or other legitimate reason.

Client engagements and commercial relationships

We will normally retain contracts, engagement records, significant correspondence and other relevant commercial records for up to six years after the engagement or business relationship ends. This allows us to maintain appropriate business records and deal with contractual, insurance, legal or claims matters that may arise.

Financial, company and tax information

We retain accounting, transaction, company and tax records for the periods required by applicable law.

Marketing information

Business-development and marketing information is retained only while it remains reasonably relevant and lawful to use. Where someone objects to or opts out of direct marketing, we may retain the minimum information necessary on a suppression list for as long as reasonably necessary to ensure that the opt-out continues to be respected.

Website and technical information

Website and infrastructure logs are retained for as long as reasonably necessary for website operation, security, diagnostics, abuse prevention and troubleshooting, taking account of the relevant hosting and infrastructure arrangements. Information may be retained for longer if it is required in connection with a security incident or legal matter.

Data protection requests and complaints

Records relating to data protection requests or complaints will normally be retained for up to three years after the matter has been closed, unless a longer period is reasonably necessary because of ongoing legal, regulatory or dispute-related circumstances.

Legal claims

Where information is relevant to an actual or reasonably anticipated legal claim, dispute or regulatory matter, we may retain it for as long as reasonably necessary to deal with that matter.

13. Cookies and similar technologies

We do not set advertising or behavioural-tracking cookies, and we do not use browser storage to build cross-site profiles of visitors. We do use Google Analytics, and our booking tool sets its own cookies once loaded — both described below.

Neither loads until you've chosen to accept them — a banner on first visit lets you accept or decline before anything non-essential is set. If you accept, Google Analytics runs across the site and, separately, our booking tool's cookies are set once you actually load the calendar on our Get in Touch page (provided by Calendly, including a Stripe fraud-prevention cookie Calendly's own infrastructure loads). If you decline, neither loads — you can still book by emailing us directly. Our website's own technical infrastructure may also process information necessary for website operation, security and network management.

For the full, verified list of cookies we've identified on this site and what each one is for, see our Cookie Policy.

If we introduce advertising or other non-essential technologies beyond what's described here in future, we will review the applicable requirements, update our privacy information and introduce consent controls where legally required before using them.

14. Automated decision-making and profiling

We do not use personal information collected through the Waterfall Works website to make decisions about individuals based solely on automated processing which produce legal or similarly significant effects.

We do not currently undertake behavioural profiling of website visitors for advertising purposes.

15. How we protect personal information

We use proportionate technical and organisational measures designed to protect personal information from:

• unauthorised access;
• unauthorised disclosure;
• accidental loss;
• misuse;
• alteration; and
• destruction.

These measures may include appropriate access controls, secure service providers, software and system security measures, appropriate authentication, minimisation of the information we hold, and contractual safeguards with providers where appropriate.

Access to personal information is limited to people and service providers who reasonably require it for legitimate purposes.

Although no internet or electronic information system can be guaranteed to be completely secure, we take reasonable measures appropriate to the nature of the information and the risks involved.

16. If you do not provide information

You do not have to provide personal information simply to browse the Waterfall Works website.

However, where you ask us to provide services, book a call or enter into an engagement, some information may be necessary for us to:

• understand your request;
• communicate with you;
• arrange and confirm a call;
• prepare a proposal;
• enter into or perform a contract;
• provide the agreed service; or
• comply with legal obligations.

If necessary information is not provided, we may be unable to proceed with a request, booking or engagement.

17. Your data protection rights

Depending on the circumstances and the lawful basis on which we process your personal information, you may have the following rights.

Right of access

You may ask us for confirmation of whether we process your personal information and request a copy of relevant personal information we hold about you.

Right to rectification

You may ask us to correct information that is inaccurate or complete information that is incomplete.

Right to erasure

In certain circumstances, you may ask us to delete your personal information. This right does not apply in every situation, including where we are legally required or otherwise permitted to retain the information.

Right to restrict processing

In certain circumstances, you may ask us to restrict how we use your personal information.

Right to object

You may have the right to object to processing based on legitimate interests, depending on the circumstances.

Right to data portability

In certain circumstances, where the legal requirements are met, you may have the right to receive personal information you provided to us in a structured, commonly used and machine-readable format or ask us to transmit it to another organisation.

Right to withdraw consent

Where we rely on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights concerning automated decision-making

Where applicable, you may have rights in relation to certain decisions made solely by automated means. Waterfall Works does not currently carry out solely automated decision-making of this kind through its website.

We may need to ask you for information reasonably necessary to verify your identity before acting on a rights request. To exercise your rights, contact:

privacy@waterfallworks.co.uk

18. Your right to object

You have the right to object, on grounds relating to your particular situation, to certain processing of your personal information where we rely on legitimate interests.

If you object, we will consider your circumstances and stop the processing unless there are compelling legitimate grounds which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Direct marketing

You have an absolute right to object at any time to the use of your personal information for direct marketing.

If you tell us that you do not want your personal information used for direct marketing, we will stop using it for that purpose. We may retain limited information on a suppression list solely so that we can continue to respect your objection.

Contact privacy@waterfallworks.co.uk to exercise this right.

19. Data protection complaints

If you have concerns about how Waterfall Works has collected, used, disclosed or otherwise handled your personal information, you can make a data protection complaint directly to us. Please contact:

privacy@waterfallworks.co.uk

or write to:

Caporetto Contracting Ltd trading as Waterfall Works
4th Floor
18 St. Cross Street
London
England
EC1N 8UN

When we receive a data protection complaint, we will:

• provide an appropriate route for the complaint to be raised;
• acknowledge receipt within 30 days, unless we are able to investigate and provide an outcome within that period;
• take appropriate steps to investigate the complaint without undue delay;
• make appropriate enquiries;
• keep you informed where appropriate; and
• tell you the outcome without undue delay.

You also have the right to complain to the UK's independent data protection regulator, the Information Commissioner's Office (ICO). You do not have to complete our complaints procedure before approaching the ICO.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

20. Changes to this privacy notice

We may update this privacy notice from time to time, including when:

• our services change;
• the way we use personal information changes;
• we introduce new systems or service providers;
• our marketing activities change; or
• applicable law or regulatory guidance changes.

The latest version will be published on the Waterfall Works website. Where a change materially affects how we use existing personal information, we will take reasonable steps to bring the change to the attention of affected individuals where required.

The date shown at the top of this notice indicates when it was last updated.