Privacy notice
Who we are. RBM Global Ltd (company number 14068407, registered office 1 Pretoria Villas, 44 Main Road, Colden Common, Winchester, Hampshire SO21 1RR) is a defence and security consultancy. We are the controller of the personal data described in this notice, and we are registered with the Information Commission under registration reference ZC247249. Contact: info@rbmglobal.co.uk. Where we process personal data on a client’s behalf in delivering services, the client is the controller and our Data Processing Addendum applies.
What we collect and why
| Who | What | Why | Lawful basis | Kept for |
|---|---|---|---|---|
| Clients and prospects | Name, role, employer, business contact details, correspondence, meeting notes, contract details | To respond to enquiries, propose and deliver services, manage contracts, invoice, and keep in touch about services relevant to your organisation | Contract; legitimate interests (running, developing and protecting our business and its relationships) | Duration of the relationship plus six years |
| Associates and candidates | Name, contact details, CV, qualifications, licences, vetting results, insurance, emergency contact, bank details, invoices | To assess suitability, engage you, pay you, and comply with law; providing this information is a contractual requirement and we cannot engage you without it | Contract; legal obligation; legitimate interests (verifying suitability and protecting clients) | Duration of the relationship plus six years; vetting results 12 months if not engaged |
| Associates — health, fitness to deploy and emergency contacts | Fitness-to-deploy confirmation and any condition, medication or limitation you disclose; vaccination status; emergency contact name and details | To meet our health and safety and duty-of-care obligations to you and others on a deployment, plan medical support, and reach someone if you are in difficulty | Legal obligation and legitimate interests (Articles 6(1)(c) and (f)); Article 9(2)(b) with paragraph 1 of Schedule 1 to the Data Protection Act 2018 under our appropriate policy document; vital interests in an emergency | 12 months after the deployment; emergency contacts deleted at the end of the engagement |
| Suppliers | Business contact and payment details | To buy goods and services and pay for them | Contract; legal obligation | Six years after last transaction |
| Website visitors | Aggregated, cookie-free analytics (page views, country, device type); anything you send us by email or through this page | To understand use of the site and answer enquiries | Legitimate interests | Analytics: aggregate only; enquiries: 12 months |
Information we obtain from others
We may receive personal data about you from people other than you: your employer or client organisation (staff lists, contact details, roles), referees and vetting providers (for associates), your emergency contact (their details, from you), and public sources such as Companies House and professional networks. Where we do, we will tell you within a month or at first contact, unless you already have the information.
Who we share it with
Our IT and AI providers listed in the sub-processor register below (all under business terms that prohibit training on our data), our accountant, insurers and professional advisers, our associates where needed to deliver services to you, medical and security assistance providers for duty of care, and authorities where the law requires. We use AI-assisted tools to draft and analyse documents; they do not make decisions about you. We do not make solely automated decisions with legal or similarly significant effects; if we ever did, the safeguards in Article 22C UK GDPR would apply. We do not sell personal data.
Where it goes
Some providers process data outside the UK. We transfer personal data only to countries or organisations covered by regulations under Article 45A UK GDPR (including the UK Extension to the EU–US Data Privacy Framework), or under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses (Article 46), after assessing that the data protection test is met. You can ask us for a copy of the safeguards. During overseas deployments, data is held only on encrypted devices we control.
Your rights
You can ask us for a copy of your personal data, to correct or delete it, to restrict or object to processing, and to receive it in a portable format, and you can withdraw consent where consent is the basis. Write to info@rbmglobal.co.uk.
Sub-processor and AI provider register
Providers that may process personal data on our behalf. We give clients at least 30 days’ notice before adding a provider. Any AI tool we use must pass our approval checks and be on this register; consumer or free-tier AI accounts are never used for client or personal data.
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google (Workspace) | Email, documents, storage, calendar | EU / US | UK Extension to the EU–US Data Privacy Framework |
| Slack (Salesforce) | Internal messaging | US | Data Privacy Framework; Binding Corporate Rules |
| Backblaze | Encrypted backup | US / EU | Data Privacy Framework; Standard Contractual Clauses |
| HubSpot | Client relationship records (AI model training disabled) | US | Data Privacy Framework; UK Addendum |
| Anthropic (Claude) — business terms | Document drafting and analysis assistance; no training on our content | US | Standard Contractual Clauses with UK Addendum; transfer risk assessment held by RBM |
Register last reviewed 14 September 2026.
Complaints about your personal data
If you are unhappy with how we have handled your personal data, tell us. Use the form below, email info@rbmglobal.co.uk with “Data protection complaint” in the subject line, or write to RBM Global Ltd, 1 Pretoria Villas, 44 Main Road, Colden Common, Winchester SO21 1RR. We will acknowledge your complaint within five working days (and always within 30 days), look into it, and tell you the outcome and what we have done, normally within 30 days. You can also complain to the Information Commission at ico.org.uk or on 0303 123 1113; the Commission may ask you to raise it with us first.
Changes
This notice was last updated on 14 September 2026. We will publish any change on this page.