Privacy Policy

Last updated: May 2026

Caroline Johnson Project Consultancy Ltd is committed to protecting the privacy of those we work with. This policy explains how we collect, use and protect personal data in the course of our consultancy work.

01 — Who We Are

Caroline Johnson Project Consultancy Ltd is a project leadership and advisory consultancy working with cultural organisations, heritage bodies and publicly funded environments.

Company number: 17130476 Registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ ICO Registration Number: ZC151064 Email: caroline@carolinejohnsonprojects.co.uk

02 — What Personal Data We Collect

In the course of our work we may collect and process the following types of personal data: names, job titles and professional contact details of clients, partners and stakeholders; business correspondence and email communications; information provided in the course of project delivery; contact details of individuals included in project documentation or funding applications; and supplier and contractor contact information.

We do not collect sensitive personal data unless specifically required for a project and with appropriate consent.

03 — How We Use Your Personal Data

We use personal data for delivering contracted services, business administration, professional communication and compliance with legal obligations. Our lawful basis is primarily legitimate interests and contractual necessity.

04 — How We Store and Protect Your Data

Personal data is stored securely using Microsoft 365 cloud services within the UK and European Economic Area. Access is restricted to Caroline Johnson in her capacity as sole director. We do not sell, rent or share personal data with third parties except where required to deliver contracted services or by law.

05 — How Long We Keep Your Data

Client and project records are retained for 7 years following completion. General correspondence is retained for up to 3 years. Enquiries that did not result in a contract are deleted within 12 months.

06 — Your Rights

Under UK GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. To exercise any of these rights please contact caroline@carolinejohnsonprojects.co.uk. We will respond within 30 days.

07 — Complaints

If you have concerns about how we handle your personal data please contact us in the first instance. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

08 — Changes to This Policy

This policy may be updated from time to time. The most recent version will always be available at carolinejohnsonprojects.co.uk and will show the date last updated.