Privacy Policy

1 Introduction

Ivy Mason Limited is committed to protecting the privacy and security of personal data processed in connection with its sustainability auditing and consultancy services. This policy explains how personal data is collected, used, and safeguarded, in accordance with the Data Protection Act 2018 and the Applied GDPR.

2 Definitions

‘Applied GDPR’ means the GDPR as amended and applied to the Isle of Man under the Data Protection Act 2018, implemented by the Data Protection (Application of GDPR) Order 2018 and the GDPR and LED Implementing Regulations 2018.

‘Consultancy and audit services’ refers to the services provided by Ivy Mason Limited as agreed with the client and subject to the terms of the relevant contract.

‘ESG’ means Environmental, Social and Governance.

‘Personal data’ and ‘data subject’ have the meanings defined in the Applied GDPR.

‘Ivy Mason’ means Ivy Mason Limited; a limited company registered in the Isle of Man under company number 138195C. The registered address of Ivy Mason is 34 St. Germans Place, Peel, Isle of Man, IM5 1BZ.

3 Contact Information

For enquiries regarding privacy and data protection contact either:

Naomi Atkins n.atkins@ivy-mason.im 07624 478198

Ailsa Harrop a.harrop@ivy-mason.im 07624 304208

4 What Data We Collect

We may collect and process the following categories of personal data:

1. Identification information (names, job titles, company details)
2. Contact details (email address, phone number)
3. Employment information (role, department)
4. Environmental and financial audit data relevant to carbon accounting, ESG auditing and compliance

5 How We Collect Data

Personal data is provided directly by clients or generated through the provision of consultancy and audit services.

6 Why We Use Your Data

We process personal data for the following purposes:

• Delivering sustainability consultancy services
• Conducting carbon accounting and ESG audits and producing the relevant reports
• Communicating with clients regarding services and updates
• Meeting legal and regulatory requirements

7 Lawful Basis for Processing

Ivy Mason processes personal data on the following legal bases:

• Performance of a contract (providing requested services)
• Compliance with legal obligations
• Legitimate interests in delivering and improving consultancy services

8 Data Sharing and Transfers

We only share personal data:

• With authorized sub-processors for consultancy delivery (under strict contracts)
• If required by law or regulation
• As instructed or agreed by clients

If personal data is transferred outside the Isle of Man, UK or EEA, Ivy Mason ensures appropriate safeguards are in place to protect privacy rights.

9 Data Retention

Personal data is retained for as long as necessary to fulfil service provision, comply with legal obligations, or as directed by the client. On request, personal data will be securely deleted or returned.

Unless otherwise requested by the client or data subject, audit and carbon accounting data (including any personal data included therein) will be retained for a rolling two years following the completion of an audit or other service to ensure continuity and the ability to monitor year-on-year progress.

10 Data subject rights

Individuals have the right to:

1. Access their personal data
2. Request rectification or erasure
3. Restrict or object to processing
4. Data portability, where applicable
5. Lodge complaints with the Isle of Man Information Commissioner

To exercise these rights, please contact Ivy Mason using the contact details above.

11 Security Measures

We employ appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of all personal data.

12 Changes to This Policy

We may update this policy from time to time. Changes will be posted on our website or notified to clients directly.

13 Confidential non-personal data

In the course of providing our services, clients may share commercially sensitive or otherwise confidential information with us. This information may not constitute personal data under applicable data protection laws, but we treat it with the same high standards of security and confidentiality. Such information is handled in accordance with our contractual obligations. If any such data is provided prior to a contract being made, our policy is as follows:

Ivy Mason will not use or disclose to any person, any confidential information about the business or affairs of the other party, any of its business contacts, or about any other confidential matters which may come to their knowledge. For the purposes of this clause, confidential information means any information or matter which is not in the public domain.

Ivy Mason may share information with sub-contractors for the purpose of generating a quote for the services to be subcontracted. Ivy Mason will ensure that sub-contractors have suitable privacy policies in place that the information will only be used for that purpose and not shared with any other party.

However, the above does not apply to:

• Any use or disclosure authorised by either party.
• Any use or disclosure required by law. 
• Any information which is already in, or comes into, the public domain otherwise than through unauthorised disclosure by either party.