Scandic Management Ltd ("Scandic Management", "we", "us", "our") is a business and financial advisory consultancy based in London, United Kingdom. This policy explains how we collect, use and protect personal data when you visit scandicmanagement.com or otherwise interact with us, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data controller: Scandic Management Ltd, a company registered in England and Wales under company number 09399244, registered office at Wallace Court, 300-308 Old Marylebone Road, London, NW1 5RH. Contact: our contact page.
When you submit our contact form, we collect: your name, email address, phone number (optional), and any message or details about your enquiry that you choose to provide.
If you use our PEPs & Sanctions Screening tool, we collect your email address to sign you in via a one-time passcode (no password is ever created or stored), the IP address your request came from, and the name(s) you submit to be screened against public sanctions lists. We do not require an account or password for any part of this site outside that tool.
We do not knowingly collect any special category data (e.g. health data) through the website itself.
We use the information you submit to: respond to your enquiry; discuss and, where instructed, deliver our advisory services to you; maintain records of business correspondence as required for our own regulatory and accounting obligations; operate the passwordless sign-in and abuse-prevention (rate limiting and blocking) for the PEPs & Sanctions Screening tool; and run the screening and scoring you request through that tool. We do not use your data for automated decision-making that produces legal or similarly significant effects on you, and we do not sell your data to third parties.
We rely on the following lawful bases under UK GDPR Article 6: legitimate interests (responding to enquiries you have voluntarily raised with us), contract (where processing is necessary to provide advisory services you have engaged us for), and legal obligation (where we must retain records for accounting, tax or regulatory purposes).
We use a small number of trusted third-party service providers to operate this website and respond to enquiries, including: Microsoft (Microsoft 365) for business email hosting, Cloudflare for website hosting, security, and data storage, Resend for sending one-time sign-in codes, and Web3Forms for processing contact form submissions. These providers act as data processors on our behalf and are contractually/by policy required to protect your data. If you use the PEPs & Sanctions Screening tool, the name(s) you submit are checked against publicly available sanctions data published by the UK Office of Financial Sanctions Implementation, the European Union, and the U.S. Office of Foreign Assets Control; we query this public data, we do not send your data to those bodies. We do not share your data with any other third party for their own marketing purposes.
Some of our service providers (Microsoft, Cloudflare, and Web3Forms) may process data outside the UK, including in the United States. Where this occurs, we rely on those providers' own UK GDPR-compliant safeguards, such as the UK International Data Transfer Addendum or an applicable UK adequacy regulation.
We retain enquiry and correspondence data for as long as necessary to handle your enquiry and for a reasonable period afterwards for record-keeping purposes, and in any event no longer than 6 years, in line with standard UK accounting and business record-keeping requirements.
For the PEPs & Sanctions Screening tool: one-time sign-in codes expire within 10 minutes and are then deleted. The name(s) and other details you submit for screening are used to calculate your result and are then discarded; we do not retain them. We keep only the final score and the date it was produced, linked to your email address, so you can see your history if you sign in again. Sign-in activity (email, IP address, and timestamp) is kept for up to 90 days to help us detect and prevent abuse of the tool.
Under UK GDPR you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure; restrict or object to processing; and request data portability. To exercise any of these rights, contact us via our contact page. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.
This site does not use cookies for tracking or advertising. If you sign in to the PEPs & Sanctions Screening tool, we set one strictly necessary cookie to keep you signed in (expires after 12 hours, or when you sign out). This cookie is required for the tool to function and is not used for analytics or advertising, so no cookie consent banner is required for it. If analytics, reCAPTCHA, or other non-essential cookie-based tools are added in future, this policy and a cookie consent banner will be updated accordingly.
Our website and services are intended for businesses and professionals. We do not knowingly collect personal data from children.
We may update this policy from time to time. The "Last updated" date above will reflect the most recent revision.
Questions about this policy or how we handle your data can be sent via our contact page.