Privacy Policy

ROZEN.MINT CONSULTING LTD – Privacy Policy

Version 1.0 | Last updated November 2025
Registered Office: Rozen, 82A James Carter Road, Mildenhall, IP28 7DE
Company Number: 16898301
Contact Email: [[email protected]](mailto:[email protected])

1. Plain-English Summary

We respect your privacy and handle all personal data lawfully, fairly, and transparently.
We collect only the information needed to deliver our relocation and business-expansion consultancy services, manage your enquiries, and meet our legal obligations.
We do not sell personal data. We keep data secure through encryption, access controls, and good practice.
You can contact us at any time to access, correct, or delete your information, or to ask questions about how we process it.

2. Table of Contents

  1. Who We Are
  2. What Data We Collect
  3. How We Use Your Data
  4. Lawful Bases for Processing
  5. Sharing Your Data
  6. International Transfers
  7. Security Measures
  8. Data Breaches
  9. Retention Periods
  10. Your Rights
  11. Cookies and Analytics
  12. Marketing Communications
  13. Children’s Data
  14. AI and Automation
  15. Updates to This Policy
  16. Contact Information
  17. Disclaimer and Jurisdiction

3. Who We Are

ROZEN.MINT Consulting Ltd (“we”, “our”, “us”) is a private limited company registered in England and Wales.
We provide relocation and business-expansion consultancy services, including strategic advice, informational packages, and coordination with trusted third-party partners such as legal, logistics, and immigration specialists.
All services are delivered digitally through our website (https://rozenmint.co.uk), email (Google Workspace / Gmail), video calls, and secure online forms.
Preset digital packages (Basic and Advanced) are purchased through WooCommerce checkout with Stripe payment processing, while bespoke engagements are arranged individually by email.

Alternative Payment Arrangements

We may, where appropriate and subject to mutual agreement, accept alternative methods of payment (such as direct bank transfer or approved digital-currency gateways). These options are considered on an individual basis and handled transparently in accordance with UK financial, tax, and anti-money-laundering requirements.

4. What Data We Collect

We collect and process only the personal data necessary to deliver our consultancy services, operate our website, and comply with our legal obligations. The categories of data we may collect include:

Identification and contact information: your name, email address, phone number, business name, and correspondence address.

Business and service details: information you provide about your company, relocation goals, or project requirements.

Payment information: handled securely through third-party providers such as Stripe or WooCommerce. We do not store or have access to full card details.

Technical and usage information: limited details such as your IP address (anonymised where possible), browser type, device, and operating system, together with aggregated information about how you interact with our own website (for example, which of our pages are visited and how long visitors stay).
This data is collected using privacy-compliant analytics tools, including Google Analytics 4, configured with IP anonymisation and other privacy safeguards.
The information helps us understand how visitors use our website, diagnose technical issues, and improve content and usability.
We do not use analytics or cookies to track your activity on other websites, nor do we create profiles of individual visitors.

Special-category data (occasionally): where necessary and voluntarily supplied (for example, limited health or family information relevant to relocation or visa planning). Such information is processed only with your explicit consent.

Recruitment data (if applicable): CVs, qualifications, and references provided when applying for roles with us.

5. How We Use Your Data

We use personal data only for legitimate business purposes, including:

  • Providing consultancy services and fulfilling contracts.
  • Communicating with you about projects, billing, or support.
  • Maintaining records for legal and financial compliance.
  • Improving our services through internal analysis.
  • Managing enquiries and customer relationships.
  • Conducting optional B2B marketing (e.g. informational updates to existing clients).
  • Screening and hiring staff (where applicable).

We never use personal data for automated decision-making that produces legal or significant effects.

6. Lawful Bases for Processing

We process personal data only where a valid lawful basis applies under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The lawful bases on which we rely are as follows:

Performance of a Contract – Processing is necessary to enter into or perform our contractual obligations with you, including providing consultancy services, managing communications, delivering agreed deliverables, and administering payments.

Compliance with a Legal Obligation – Processing is required to satisfy obligations imposed by law, such as record-keeping, accounting, taxation, and regulatory compliance under UK legislation.

Legitimate Interests – We may process personal data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Legitimate interests include:

  • Maintaining and improving our services and website;
  • Safeguarding the security and integrity of our systems;
  • Preventing fraud or misuse; and
  • Promoting our services to existing or prospective business clients in a proportionate and professional manner.
Whenever this basis is relied upon, we conduct a legitimate-interests assessment to ensure fairness and transparency.

Consent – In limited circumstances, we process personal data based on your freely given, specific, informed, and unambiguous consent. Examples include optional marketing communications or the handling of any special-category information you choose to provide. You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Vital Interests or Legal Claims (exceptional cases) – Where necessary, we may process data to protect an individual’s vital interests or to establish, exercise, or defend legal claims.

Where we rely on more than one lawful basis for different processing activities, we identify and document each accordingly. We do not rely on consent where another lawful basis is more appropriate.

7. Sharing Your Data

We share data only when necessary and only with trusted parties who meet our standards:

  • Google Workspace / Gmail / Google Drive: email and cloud storage.
  • Web hosting provider: secure UK or EEA-based servers.
  • WooCommerce & Stripe: for payment processing (independent controllers).
  • Professional partners under written confidentiality agreements.
  • Regulators or authorities where required by law.

All third parties are bound by data-processing agreements or equivalent protections.

8. International Transfers

Some data may be processed outside the UK (for example by Google or Stripe servers).
Where this occurs, we use approved safeguards such as:

  • The UK International Data Transfer Agreement (IDTA);
  • Standard Contractual Clauses (SCCs);
  • Adequacy decisions, including the UK-US Data Bridge for certified entities.

You may request a copy of the relevant safeguards by emailing us.

9. Security Measures

We implement technical and organisational measures to protect your data, including:

  • TLS encryption for data in transit.
  • Encryption of files at rest where practicable.
  • Role-based access controls and two-factor authentication.
  • Regular system updates and back-ups.
  • Staff training and confidentiality undertakings.
  • Periodic internal security reviews and breach-response procedures.

While no system can guarantee absolute security, we take all reasonable steps to safeguard information and review controls regularly.

10. Data Breaches

If we become aware of a personal-data breach likely to pose a risk to individuals’ rights or freedoms, we will:

  1. Record and investigate the incident immediately.
  2. Notify the Information Commissioner’s Office within 72 hours (where required).
  3. Inform affected individuals without undue delay if the breach is likely to cause harm.
  4. Work with partners to mitigate impact and prevent recurrence.

You should also notify us promptly if you believe data we have shared with you has been compromised.

11. Retention Periods

We retain personal data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including legal, regulatory, accounting, or reporting obligations, or to establish, exercise, or defend legal claims.

Unless otherwise required:

  • Client and project records: up to 6 years after engagement.
  • Financial and accounting records: minimum 6 years (HMRC).
  • General enquiries: up to 2 years.
  • Recruitment data: up to 6 months unless extended by consent.

At the end of the retention period, data will be securely deleted, destroyed, or anonymised unless continued retention is required by law.

12. Your Rights

Under UK data-protection law you have the right to:

  • Access your data.
  • Rectify inaccurate or incomplete data.
  • Erase your data.
  • Restrict or object to processing.
  • Portability (transfer your data).
  • Withdraw consent at any time.
  • Object to direct marketing.
  • Complain to the ICO.

To exercise any right, contact us by email. We will respond within one month.

13. Cookies and Analytics

Our website uses only essential cookies necessary for basic operation, security, and accessibility.

We may in future use limited analytics cookies (e.g., Google Analytics 4 with IP anonymisation) to understand website usage and improve performance. These collect only aggregated, non-identifying information about page visits.

Analytics cookies operate only with your explicit consent under PECR. A consent banner will appear if analytics are enabled.

We do not use advertising cookies or tracking technologies, and we never sell or share cookie data.

14. Marketing Communications

We only send business-to-business marketing communications where lawful under PECR. This may include contacting relevant professionals or organisations about our services. Recipients can opt out at any time.

15. Children’s Data

We do not knowingly collect or process data from individuals under 18. Our services are for adults and business clients only.

16. AI and Automation

We do not use automated decision-making that produces legal or significant effects. Where AI tools are used for routine tasks (e.g., spam filtering or drafting administrative communications), they operate under human supervision and do not profile individuals.

17. Updates to This Policy

Version 1.0 — November 2025.
We may update this Policy periodically. All updates will appear on this page with a new version number and date. Material changes will be notified to current clients by email.

18. Contact Information

Data Protection Contact
ROZEN.MINT Consulting Ltd
Email: [[email protected]](mailto:[email protected])

If you remain concerned, you may contact the Information Commissioner’s Office at https://ico.org.uk or 0303 123 1113.

19. Disclaimer and Jurisdiction

This Privacy Policy does not create contractual rights beyond those required by law.
It is governed by the laws of England and Wales, and any dispute is subject to the exclusive jurisdiction of the English and Welsh courts.

Scalability Note: Equivalent protections apply under EU GDPR for clients located within the EEA.

(End of Policy)