Privacy Policy

Effective Date: 9 September 2026 Last Updated: 9 September 2026

GARI Governance Consultancy Services ("GARI", "we", "our" or "us") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how GARI collects, uses, stores, protects and otherwise processes personal data when you visit our website, communicate with us, register for our programmes, use our online learning services, engage our consultancy services or otherwise interact with us.

Where the General Data Protection Regulation (EU) 2016/679 ("GDPR") applies to our processing of personal data, GARI will process that data in accordance with the GDPR and other applicable data protection requirements.

We aim to process personal data in a lawful, fair and transparent manner and in accordance with the principles of data minimisation, purpose limitation, accuracy, storage limitation, integrity, confidentiality and accountability.

1. WHO WE ARE

GARI Governance Consultancy Services is a governance, leadership, learning, technology and development consultancy organisation.

For purposes of applicable data protection law, GARI may act as the data controller for personal data that we determine the purposes and means of processing.

Where GARI processes personal data solely on behalf of another organisation and in accordance with that organisation's instructions, GARI may instead act as a data processor.

This distinction will depend on the nature of the particular service or engagement.

Contact details

GARI Governance Consultancy Services

Email: info@gariconsultants.com

Website: https://gariconsultants.com/

2. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal data collected or processed through:

• The GARI website;
• Website contact and enquiry forms;
• Email communications;
• Programme registration;
• Training and professional development programmes;
• Online courses;
• GARI's online learning platform;
• Client and participant administration;
• Events and workshops;
• Other services provided by GARI; and
• Other interactions in which this Privacy Policy is presented or referenced.

This Privacy Policy does not necessarily apply to third-party websites, applications or platforms that GARI does not control.

3. WHAT IS PERSONAL DATA?

For purposes of the GDPR, personal data means information relating to an identified or identifiable individual.

Depending on how you interact with GARI, personal data may include:

• Name;
• Email address;
• Telephone number;
• Postal or physical address;
• Organisation;
• Job title or professional role;
• Country or general location;
• Account details;
• Course registration information;
• Learning activity;
• Assessment and completion information;
• Certificates issued;
• Information contained in enquiries or correspondence;
• Technical information relating to use of our website;
• IP address;
• Device information;
• Browser information;
• Website usage information; and
• Other information that identifies or can reasonably be associated with you.

4. PERSONAL DATA WE COLLECT

4.1 Information you provide directly

We may collect personal data when you:

• Complete a contact form;
• Send us an email;
• Request information;
• Register for a programme;
• Register for an online course;
• Create an account;
• Participate in training;
• Engage GARI for consultancy services;
• Attend a GARI event;
• Subscribe to communications;
• Provide feedback; or
• Otherwise communicate with us.

The information collected will depend on the nature of your interaction with GARI.

4.2 Learning and programme information

If you participate in a GARI programme or course, we may process information such as:

• Programme or course registered for;
• Registration date;
• Course progress;
• Attendance;
• Assessment results;
• Assignments;
• Completion status;
• Certificate information;
• Communications concerning your participation; and
• Information necessary to administer your learning account.

We will only collect and use information that is reasonably necessary for the administration and delivery of the relevant programme.

4.3 Information collected automatically

When you visit our website, certain technical information may be collected automatically.

Depending on the technologies implemented, this may include:

• IP address;
• Browser type;
• Operating system;
• Device type;
• Device identifiers;
• Pages visited;
• Time and date of access;
• Referring website;
• Website interaction information; and
• Other technical information required to operate, secure and improve the Website.

5. SPECIAL CATEGORIES OF PERSONAL DATA

GARI does not generally require special categories of personal data for ordinary website use.

Special categories of personal data under the GDPR include information concerning matters such as:

• Health;
• Biometric data used for identification;
• Genetic data;
• Racial or ethnic origin;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership; and
• Sex life or sexual orientation.

You should not submit sensitive personal information through a general website contact form unless it is specifically requested and appropriate safeguards are in place.

Where GARI is required to process special categories of personal data for a specific programme, service or legal purpose, we will identify and rely on an appropriate lawful basis and additional condition for processing under applicable data protection law.

6. WHY WE PROCESS YOUR PERSONAL DATA

We may process personal data for the following purposes:

Providing our services

To:

• Respond to enquiries;
• Provide consultancy services;
• Deliver training;
• Administer programmes;
• Provide online learning;
• Manage user accounts;
• Provide participant support; and
• Deliver services requested by you or your organisation.

Administration

To:

• Manage registrations;
• Maintain participant records;
• Process payments where applicable;
• Issue certificates;
• Manage contracts;
• Maintain business records; and
• Communicate with clients and participants.

Website operation

To:

• Operate the website;
• Maintain website security;
• Diagnose technical problems;
• Improve functionality; and
• Understand how users interact with our website.

Communication

To:

• Respond to enquiries;
• Send service-related communications;
• Communicate programme information;
• Send administrative notifications; and
• Where permitted, send relevant marketing communications.

Business improvement

To:

• Evaluate our programmes;
• Improve our courses;
• Develop new services;
• Understand participant needs;
• Analyse website usage; and
• Improve our overall user experience.

Legal and compliance purposes

To:

• Comply with applicable legal obligations;
• Establish, exercise or defend legal claims;
• Prevent fraud;
• Protect our systems and users; and
• Respond to lawful requests from competent authorities.

7. LEGAL BASES FOR PROCESSING

Where the GDPR applies, GARI will process personal data only where an appropriate legal basis exists.

Depending on the circumstances, the legal basis may include:

7.1 Consent

We may process personal data where you have given valid consent.

For example, this may apply to certain marketing communications or non-essential cookies.

You may withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7.2 Performance of a contract

We may process personal data where it is necessary to enter into or perform a contract with you.

This may include:

• Programme registration;
• Course administration;
• Consultancy engagements;
• Account administration; and
• Provision of requested services.

7.3 Legal obligation

We may process personal data where necessary to comply with a legal obligation to which GARI is subject.

7.4 Legitimate interests

We may process personal data where it is necessary for GARI's legitimate interests, provided that those interests are not overridden by your rights and freedoms.

Examples may include:

• Website security;
• Fraud prevention;
• Service improvement;
• Business administration;
• Network and information security;
• Managing business relationships; and
• Establishing or defending legal claims.

Where we rely on legitimate interests, we will consider the impact on individuals and apply appropriate safeguards.

7.5 Vital interests

In limited circumstances, personal data may be processed where necessary to protect someone's vital interests.

7.6 Public interest or official authority

Where applicable, personal data may be processed where necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

8. MARKETING COMMUNICATIONS

GARI may send information about:

• Courses;
• Training programmes;
• Events;
• Publications;
• Governance and leadership resources;
• New services; and
• Other GARI activities.

Where GDPR consent is required, we will obtain appropriate consent before sending marketing communications.

You may withdraw your consent or unsubscribe from marketing communications at any time.

Every marketing email should provide a clear and simple way to unsubscribe.

You may also contact GARI directly to request that marketing communications stop.

9. COOKIES

The GARI website may use cookies and similar technologies.

Cookies may be used for purposes such as:

• Essential website functionality;
• Security;
• Remembering preferences;
• Analytics;
• Website performance;
• Understanding visitor behaviour; and
• Other functionality.

Where consent is required, non-essential cookies will only be placed after the appropriate consent has been obtained.

You may manage cookie preferences through our cookie consent mechanism, where available, or through your browser settings.

Disabling certain cookies may affect website functionality.

10. ANALYTICS

GARI may use analytics tools to understand how visitors use our website.

Analytics information may include:

• Pages visited;
• Time spent on pages;
• General location;
• Device type;
• Browser;
• Referring source; and
• Interaction with website features.

Where analytics technologies involve personal data and require consent under applicable law, GARI will obtain the appropriate consent.

11. ONLINE LEARNING PLATFORM

GARI provides online learning services through an external learning management platform.

When you register for or use the GARI learning platform, personal data may be processed by GARI and by the technology provider operating the platform.

This may include:

• Name;
• Email address;
• Organisation;
• Account details;
• Course registration;
• Course progress;
• Assessment information;
• Completion information; and
• Certificate information.

The relevant learning platform provider may also have its own privacy policy and terms.

Before publication of this Privacy Policy, GARI should identify the actual learning platform provider and provide a link to its privacy policy where appropriate.

12. THIRD-PARTY SERVICE PROVIDERS

GARI may use third-party providers to support our operations.

These may include providers of:

• Website hosting;
• Learning management systems;
• Cloud services;
• Email;
• Analytics;
• Website security;
• Payment processing;
• Customer relationship management;
• IT support;
• Communications; and
• Other business services.

Where these providers process personal data on GARI's behalf, GARI will seek to ensure that appropriate contractual and organisational safeguards are in place.

Where required under the GDPR, appropriate data processing agreements will be established with processors.

13. WHO WE SHARE PERSONAL DATA WITH

GARI does not sell personal data.

We may disclose personal data to:

Service providers

Providers that support GARI's website, learning platform, communications, IT, security, analytics and other operations.

Professional advisers

Where necessary, personal data may be shared with:

• Lawyers;
• Accountants;
• Auditors;
• Consultants; and
• Other professional advisers.

Business partners

Where necessary for delivering a service or programme and where there is an appropriate legal basis.

Authorities

Where disclosure is required by law or necessary to respond to a lawful request.

Corporate transactions

Where necessary in connection with a merger, acquisition, restructuring, sale of assets or similar business transaction.

We will seek to ensure that disclosures are limited to what is reasonably necessary for the relevant purpose.

14. INTERNATIONAL TRANSFERS

GARI may use service providers located outside the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, GARI will use an appropriate transfer mechanism recognised under the GDPR.

Depending on the circumstances, this may include:

• An adequacy decision;
• European Commission Standard Contractual Clauses ("SCCs");
• Another lawful transfer mechanism recognised under applicable data protection law.

The European Commission recognises adequacy decisions and other safeguards, including Standard Contractual Clauses, as mechanisms for protecting personal data transferred outside the EEA.

Where SCCs are used, GARI will implement the appropriate module and supplementary safeguards where required.

15. DATA RETENTION

GARI will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including where necessary to:

• Provide services;
• Maintain learning records;
• Manage contractual relationships;
• Meet legal obligations;
• Resolve disputes;
• Establish or defend legal claims; or
• Maintain appropriate business records.

Retention periods will depend on:

• The nature of the information;
• The purpose for processing;
• Legal requirements;
• Contractual requirements;
• The risk associated with retaining the information.

Where specific retention periods apply, GARI should maintain an internal data retention schedule.

When personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable requirements.

16. DATA SECURITY

GARI takes appropriate technical and organisational measures to protect personal data against:

• Unauthorised access;
• Unauthorised disclosure;
• Accidental loss;
• Destruction;
• Alteration;
• Unlawful processing; and
• Other security risks.

Measures may include:

• Access controls;
• Password protection;
• User authentication;
• Secure hosting;
• Encryption where appropriate;
• Backups;
• Security monitoring;
• Staff confidentiality obligations;
• Access restrictions; and
• Appropriate policies and procedures.

No electronic transmission or storage system can be guaranteed to be completely secure.

17. DATA BREACHES

Where a personal data breach occurs, GARI will assess the breach and take appropriate steps in accordance with applicable data protection law.

Where required by the GDPR, GARI will notify the competent supervisory authority within the applicable statutory timeframe and notify affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

18. YOUR DATA PROTECTION RIGHTS

Where the GDPR applies, you may have the following rights.

Right to be informed

You have the right to receive clear information about how your personal data is processed.

Right of access

You may request confirmation as to whether we process your personal data and, where applicable, request access to that information.

Right to rectification

You may request correction of inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, you may request that your personal data be deleted.

This right is not absolute and certain information may need to be retained where there is a lawful basis to do so.

Right to restriction of processing

In certain circumstances, you may request that we restrict the processing of your personal data.

Right to data portability

Where applicable, you may request personal data that you have provided to us in a structured, commonly used and machine-readable format and request its transmission to another controller.

Right to object

You may object to certain processing, including processing based on legitimate interests.

You have an absolute right to object to direct marketing.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Rights relating to automated decision-making

Where applicable, you may have rights relating to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

GARI should update this section if automated decision-making or profiling is actually used.

19. HOW TO EXERCISE YOUR RIGHTS

To exercise your privacy rights, please contact:

GARI Governance Consultancy Services

Email: [info@gariconsultants.com]

Subject: GDPR Data Subject Request

Please provide sufficient information to allow us to understand your request.

We may request additional information to verify your identity before processing certain requests.

This is intended to protect your personal data from unauthorised disclosure.

20. RESPONSE TO DATA SUBJECT REQUESTS

Where the GDPR applies, GARI will generally respond to valid data subject requests without undue delay and, in principle, within one month of receiving the request.

Where a request is complex or numerous, the applicable period may be extended where permitted by the GDPR.

Where an extension is necessary, GARI will communicate the applicable reason and timing.

21. RIGHT TO LODGE A COMPLAINT

If you believe that GARI has not processed your personal data in accordance with applicable data protection law, you are encouraged to contact us first so that we can investigate and attempt to resolve your concern.

Where the GDPR applies, you also have the right to lodge a complaint with a competent EU/EEA data protection supervisory authority, particularly in the country where you live, work or believe an infringement occurred.

A list of European data protection authorities is available through the European Data Protection Board.

22. DATA RECEIVED FROM OTHER SOURCES

In some circumstances, GARI may receive personal data from another organisation rather than directly from you.

For example, an organisation may register its employees or representatives for a GARI programme.

Where this occurs, GARI will process the information in accordance with applicable data protection requirements and provide the required privacy information where applicable.

Where required, information about the source of the personal data will also be provided.

23. CHILDREN'S DATA

GARI's services are primarily designed for adults, professionals, organisations and institutions.

Where a GARI programme is specifically intended for children or minors, GARI will implement appropriate safeguards and obtain any consent required by applicable law.

We do not knowingly collect children's personal data through the general website for purposes unrelated to an authorised programme.

24. THIRD-PARTY WEBSITES

The GARI website may contain links to third-party websites and platforms.

GARI does not control the privacy practices of those third parties.

We recommend that you review the privacy policies of third-party websites before submitting personal data to them.

25. SOCIAL MEDIA

GARI may maintain profiles or pages on social media platforms.

Interactions with those platforms may involve processing of personal data by the relevant social media provider.

Such platforms operate under their own terms and privacy policies.

GARI is not responsible for the privacy practices of those platforms.

26. PROFESSIONAL AND CLIENT INFORMATION

Where GARI provides consultancy or professional services to an organisation, personal data may be processed as part of the engagement.

The parties may enter into additional contractual arrangements addressing:

• Confidentiality;
• Data processing;
• Security;
• Data retention;
• International transfers;
• Sub-processors; and
• Other privacy requirements.

Where GARI acts as a processor on behalf of a client, the applicable data processing agreement and client's instructions will govern the processing to the extent required by law.

27. AUTOMATED DECISION-MAKING AND PROFILING

GARI does not currently intend to make decisions producing legal or similarly significant effects based solely on automated processing or profiling through the Website.

If this changes, GARI will provide appropriate information about:

• The existence of automated decision-making;
• The logic involved;
• The significance and envisaged consequences; and
• Applicable rights.

28. ACCURACY OF PERSONAL DATA

GARI seeks to maintain accurate and up-to-date personal data.

You should notify us if information you have provided changes or is inaccurate.

You may request correction of inaccurate or incomplete personal data in accordance with your applicable rights.

29. DATA MINIMISATION

GARI aims to collect only the personal data reasonably necessary for the relevant purpose.

We will seek to avoid collecting information that is unnecessary for the service, programme or activity concerned.

30. PRIVACY BY DESIGN AND DEFAULT

Where appropriate, GARI will seek to incorporate data protection considerations into the design and operation of our systems, services and processes.

This may include:

• Limiting data collection;
• Restricting access;
• Applying appropriate security controls;
• Retaining data only as long as necessary;
• Using privacy-friendly settings where appropriate.

31. CHANGES TO THIS PRIVACY POLICY

GARI may update this Privacy Policy from time to time.

Changes may be made to reflect:

• Changes in our services;
• Changes in technology;
• Changes in data processing activities;
• Changes in legal or regulatory requirements;
• Changes to our service providers.

The updated policy will be published on this page with a revised "Last Updated" date.

Where required, GARI will provide additional notice of material changes.

32. CONTACT US

If you have questions about this Privacy Policy or how GARI processes personal data, please contact us.

GARI Governance Consultancy Services

Email: info@gariconsultants.com

Privacy enquiries:

Website: https://gariconsultants.com/

Address:

Telephone:

33. GOVERNING DATA PROTECTION FRAMEWORK

Where applicable to GARI's processing activities, this Privacy Policy is intended to reflect the requirements and principles of the General Data Protection Regulation (EU) 2016/679 (GDPR).

The GDPR establishes principles including lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

Where personal data is transferred outside the EEA, GARI will use an appropriate mechanism under the GDPR's international transfer framework where the GDPR applies.

This Privacy Policy does not create rights beyond those provided by applicable law.

34. EFFECTIVE DATE

Effective Date: 9 September 2026

Last Updated: 9 September 2026