Privacy Policy

Privacy Policy

Last Updated: May 27, 2025

This Privacy Policy describes how Coltrane Ltd ("we," "us," or "our") collects, uses, processes, stores, and protects your data in connection with our import and export agency and consultancy services. We are committed to protecting the privacy and security of your data in accordance with the UK General Data Protection Regulation1 (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

By using our services or visiting our website, you agree to the collection and use of information in accordance with this policy.

1. About Us

Coltrane Ltd is an import and export agency and consultancy registered in England and Wales. Our registered office is 128 City Road London EC1V 2NX.

For UK GDPR, Coltrane Ltd is the data controllerresponsible for your data.

2. What Your Data Do We Collect?

We may collect and process several types of data, which can include, but are not limited to:

• Contact Information: Names, job titles, company names, email addresses, phone numbers, and postal addresses.
• Business Information: Company registration details, VAT numbers, EORI numbers, business financial information (e.g., for trade finance applications).
• Transaction Data: Details about products or services you have purchased from us or supplied to us, shipment details, customs declarations, invoices, and payment records.
• Communications Data: Records of your interactions with us, including emails, phone  calls, and meeting notes.
• Website Usage Data: Information about how you use our website (e.g., IP address, browser type, pages visited, time spent). For details, please refer to our separate [Link to Cookie Policy].
• Due Diligence Information: Data collected for identity verification,  anti-money laundering (AML), and other regulatory compliance checks.
• UKEF-Specific Data: Information required for applications to UK Export Finance schemes, which may include sensitive financial details, project specifics, and other relevant commercial data.

3. How We Collect Your Data

We collect your data through various channels:

• Direct  Interactions: When you contact us via our website forms, email, phone, in-person meetings, or during networking events.
• Service Delivery: As part of providing our import/export agency and consultancy services, including contract negotiation, logistics management, and trade finance advisory.
• Third Parties: From partners (e.g., logistics providers, freight forwarders, financial institutions, credit insurers, customs brokers, UKEF officials) with whom we collaborate to deliver services.
• Publicly Available Sources: From public registers (e.g., Companies House, professional networking sites, or trade directories, where permissible.

4. How We Use Your Data (Purpose and Legal Basis)

We use your data for the following purposes, relying on specific legal bases as required by UK GDPR:

Purpose of Processing

Legal Basis for Processing (UK GDPR)

To provide our services:  including managing import/export operations, logistics, customs clearance,   and consultancy.

Contract: Necessary for the performance   of a contract with you or to take steps at your request before entering into a contract.

To facilitate trade finance and UKEF applications: Assisting with eligibility, documentation, and liaison with finance providers.

Contract: Necessary for the performance of a contract with you.

Legitimate Interests: To assist our clients in securing necessary trade finance and support their export growth.

To manage our business relationship: Including client onboarding,

communication, billing, and record-keeping.

Contract: Necessary for the performance   of a contract with you.

Legal   Obligation: To comply with accounting and legal requirements.

For legal and regulatory compliance: Such as anti-money laundering (AML) checks, sanctions screening, customs regulations, and tax obligations.

Legal Obligation: Necessary to comply with a legal or regulatory obligation.

To improve our services: Analysing usage patterns and feedback to enhance our service offerings.

Legitimate Interests: To develop and improve our services for the benefit of our clients.

For marketing and communication: To send you updates, newsletters, or information about our   services that may be of interest to you (where you have consented or where legitimate interest applies).

Consent: Where you have explicitly   opted-in to receive marketing communications.

Legitimate   Interests: To market our services to existing clients or those with whom we have a clear business relationship, where such marketing is proportionate and expected.

To protect our legitimate interests: Including preventing fraud, ensuring network and information security, and handling legal claims.

Legitimate Interests: To protect our business, assets, and reputation, and to ensure the security of our systems and data.

5. How We Share Your Data

We may share your data with the following categories of recipients, where necessary for the purposes outlined above:

• Service Providers: Third-party logistics providers, freight forwarders, customs brokers, warehouses, IT service providers, legal and financial advisors, and debt collection agencies.
• Financial Institutions & Insurers: Banks, credit insurers, and UK Export Finance (UKEF) during the course of trade finance and insurance applications.
• Government & Regulatory Bodies: HMRC, customs authorities, other government departments, and regulatory bodies (e.g., ICO) when legally required or for specific compliance purposes.
• Partner  Agencies: Other consultancies or agents involved in collaborative projects, under strict confidentiality agreements.
• Professional Advisors: Accountants, lawyers, auditors.

We ensure that all third parties respect the security of your data and treat it in accordance with the law. We do not allow our third-party service  providers to use your data for their own purposes and only permit them to process your data for specified purposes and in accordance with our instructions.

6. International Data Transfers

As an international trade agency, it may be necessary to transfer your data outside the UK and European Economic Area (EEA) to countries that do not have equivalent data protection laws, for example, to customs authorities or logistics partners in destination countries.

Where such transfers occur, we take appropriate safeguards to ensure your data is protected, such as:

• Transferring data to countries deemed to provide an adequate level of protection by the UK government.
• Using standard contractual clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).
• Implementing Binding Corporate Rules (BCRs), if applicable.
• Obtaining your explicit consent where no other safeguard is available and the transfer is necessary for a specific purpose.

7. Data Security

We have implemented appropriate technical and organisational security measures to prevent your data from being accidentally lost, used, or accessed in an unauthorised way, altered or disclosed. These measures include:

• Access controls to our systems and premises.
• Encryption of sensitive data where appropriate.
• Regular security assessments and penetration testing.
• Employee  training on data protection and security.
• Secure shredding of physical documents containing personal data.

We have procedures in place to deal with any suspected your data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data Retention

We will only retain your data for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your data, the purposes for which we process your data and whether we can achieve those purposes through other means, and the applicable legal requirements.

For example, we typically retain records related to contracts and financial transactions for a minimum of 6 years plus the current year, to comply with tax and accounting laws. Data used for marketing purposes will be retained until you unsubscribe or withdraw consent, or for a reasonable period if there has been no engagement.

9. Your Legal Rights (Data Subject Rights)

Under UK GDPR, you have the following rights about your data:

• Right to be informed: To be informed about how your data is collected and used (which this Privacy Policy aims to do).
• Right of access: To request a copy of your data we hold about you.
• Right to rectification: To request that inaccurate or incomplete data we hold about you is corrected.
• Right  to erasure (the 'right to be forgotten'): To request that we delete or remove your data where there is no compelling reason for its continued processing.
• Right to restrict processing: To 'block' or suppress the processing of your data in certain circumstances.
• Right to data portability: To obtain and reuse your data for your purposes  across different services.
• Right to object: To object to the processing of your data in certain circumstances, particularly where we are relying on legitimate interestsas the legal basis.
• Rights concerning automated decision-making and profiling: To object to decisions made solely based on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

To exercise any of these rights, please contact us using the details provided below. We may need to request specific information from you to help us confirm your identity and ensure your right to access your data (or to exercise any of your other rights).

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this Privacy Policy periodically for any changes.

11. Contact Information & Complaints

If you have any questions about this Privacy Policy, our data practices, or if you wish to exercise any of your legal rights, please contact us at:

Data Protection Point of Contact: The Data Protection Lead Email: privacy@coltrane.ltd

Postal Address: 128 CITY RD EC1V 2NX UK

You also have the right to lodge a complaint with the Information Commissioner's16 Office (ICO), the UK supervisory17authority for data protection issues. You can find more information on their website: www.ico.org.uk

Version 0001 27/05/2025