Privacy & Data Protection Policy
Comprehensive disclosure of data processing principles, lawful grounds, technical safeguards, and data subject rights under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
1. Data Controller Identification
This Privacy Policy governs the processing of personal data by Mtengwa Strategic Advisory ("MSA", "the Practice", "we", "us"), an independent strategic technology and cybersecurity advisory firm operating under the laws of England and Wales.
2. Principles of Data Processing
In accordance with Article 5 of the UK GDPR, Mtengwa Strategic Advisory adheres strictly to the fundamental principles of data protection:
- Lawfulness, Fairness & Transparency: Data is processed exclusively on validated lawful bases and with transparent notice.
- Purpose Limitation: Collected solely for professional advisory scoping, contract performance, or statutory accounting. Never repurposed.
- Data Minimisation: We request and store only the minimal technical and professional identifiers necessary to execute advisory mandates.
- Zero Data Monetisation: We do not sell, rent, broker, license, or exchange client data with third-party data brokers or marketing networks under any circumstances.
- Zero Ad-Network Telemetry: We deploy zero behavioural advertising pixels, zero cross-site remarketing tags, and zero third-party commercial analytics.
- Integrity & Confidentiality: All electronic records are guarded by high-assurance cryptographic controls and hardware-backed key authentication.
3. Data Categories, Purposes & Lawful Bases
The table below outlines the specific categories of data processed by Mtengwa Strategic Advisory and the corresponding lawful basis under Article 6(1) of the UK GDPR:
| Processing Category | Data Elements | Lawful Ground (UK GDPR) |
|---|---|---|
| Executive Briefing Intake | Full name, professional email, company name, organizational title, telephone, scoping requirements. | Art. 6(1)(b) — Steps prior to entering a contract |
| Active Advisory Mandates | Architecture blueprints, governance charters, technical risk evaluations, SOW milestones, deliverables. | Art. 6(1)(b) — Performance of advisory contract |
| Direct Messaging & Switchboard | Phone numbers, WhatsApp message timestamps, voicemail audio transcripts, Signal session metadata. | Art. 6(1)(f) — Legitimate interest in professional communications |
| Accounting & Billing | Invoices, payment receipts, VAT numbers, corporate billing addresses, bank transfer references. | Art. 6(1)(c) — Legal obligation under UK tax & company law |
| Server Telemetry & Security Logs | IP addresses, HTTP user-agents, request timestamps, firewall dropped packet records. | Art. 6(1)(f) — Legitimate interest in infrastructure defense |
4. Retention Horizons & Cryptographic Erasure
Personal data is retained solely for the period required to fulfill the purposes for which it was captured, or to satisfy statutory accounting, legal dispute, and professional indemnity requirements:
- Non-Engaged Enquiries: Prospective intake correspondence that does not lead to an active retainer is securely purged after 180 days.
- Client Advisory Workpapers: Retained for 7 years from engagement conclusion pursuant to UK Limitation Act 1980 statutory dispute defense and professional indemnity requirements.
- Invoicing & Tax Records: Retained for 7 years in compliance with HMRC statutory accounting mandates.
- Digital Forensics & Incident Records: Quarantined evidentiary images are wiped using NIST SP 800-88 Rev 1 sanitization standards immediately following formal sign-off or handover.
5. Data Subject Statutory Rights
Under Chapter III of the UK GDPR, you hold unequivocal statutory rights regarding your personal information:
You may request a copy of all personal data held concerning you without fee within one calendar month.
You may demand the destruction of your data where no overriding statutory or contractual obligation applies.
You may require prompt correction of inaccurate or incomplete corporate or professional records.
You may object to processing conducted on legitimate interest grounds or request suspension pending verification.
6. Regulatory Oversight & Complaints
While we encourage clients and correspondents to resolve queries directly with our Principal Advisor, you have the statutory right to lodge a complaint with the UK supervisory authority:
