Privacy Policy

Last Updated on 28th September 2026


Who we are
Derwent Capital Management Limited, trading as DCM ("DCM", "we", "us"), company number 09126361, registered office C/O Brian Paul Limited, 159a Chase Side, Enfield, England, EN2 0PW, provides regulatory compliance and financial crime risk management advisory and delivery services. We are registered with the Information Commissioner's Office under number ZA822839. We are the controller of the personal data described in this policy, which means we decide how and why it is used.

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.
‍

What this policy covers
This policy applies to personal data we collect about:
- Visitors to www.dcmoperations.com.
- Clients, prospective clients and their staff, and other business contacts.
- Consultants, associates and other professionals who join or apply to join our consultant network.
​
It does not cover our employees, who receive a separate notice.When we handle personal data on a client's behalf during an engagement, for example when reviewing customer files, we do so under the engagement terms, usually as the client's processor. The client's own privacy notice applies to that data, not this one.


Personal data we collect
Website visitors and enquiries. Your name, email address, phone number, company, job title and the content of your message when you use our contact form or email us. We also collect technical data such as IP address, browser, device and pages viewed, using cookies (see below).

Clients, prospects and business contacts: Your name, business contact details, job title and employer, your professional online profile (for example LinkedIn), notes of our meetings and correspondence, and for clients, billing and payment details.

Consultant network members: Your name and contact details, location, CV and employment history, skills and experience, availability, rate expectations, references and details of your company or tax status if you contract through one. When we engage you, we also collect right to work and identity documents and bank details. Where a client requires it for a specific project, we may also collect vetting information such as DBS, credit or passport checks.


How we collect it
Most of it comes from you, by form, email, phone or in person. We also collect it from your professional profiles such as LinkedIn, from referrals by clients or other consultants, from references you ask us to contact, from public sources such as Companies House, from screening and vetting providers where you have agreed to a check, and from our website through cookies.If we collect your details from a third party, we will tell you within a month and explain what we hold and why.
‍

How and why we use it

Where we rely on legitimate interests, we have weighed them against your rights. You can ask us for details of that assessment. Where a client requires it for a specific project, we may ask you to complete a criminal record check (such as a DBS check) and we may receive or keep the result. This is called criminal offence data, and the law gives it extra protection. We only ask for it when the client's onboarding requirements make it necessary, and we tell you before we do.

Our lawful basis is our legitimate interests in meeting our clients' onboarding requirements. Because this is criminal offence data, we also rely on your explicit consent / the Schedule 1 condition for preventing or detecting unlawful acts under the Data Protection Act 2018. Where we rely on a Schedule 1 condition, we keep an appropriate policy document setting out how we protect this data. We limit access to these results to the people who need them, we do not share them with a client without your agreement unless the law requires it, and we delete them 3 months after the check is complete unless a client or the law requires us to keep them longer. If you decline a check, we will explain how that affects the projects you can be considered for.


Marketing
We may email you about our services and insights. If you are a business contact at a company, we rely on legitimate interests. If you are a sole trader, or we are writing to a personal email address, we will only do so with your consent. You can opt out at any time using the link in our emails or by writing to [frank.tasker@dcmoperations.com​]. We never sell personal date.


Who we share it with
We share personal data with:

1. Clients, where needed to deliver an engagement. For consultants, we share your profile only with your agreement.
‍
2. Service providers who help us run the business: Our CRM/ ERP Sales & Consultant management platform, payment and accounting providers, background check providers.
‍
3. Professional advisers, auditors, insurers, and the recipient of any sale or investment in our business, under confidentiality obligations.
‍
4. Regulators, courts, HMRC and law enforcement, where required.


International Transfers
Some of our providers, including Airtable and Webflow, are based in the United States, and some consultants and clients work outside the UK. Where personal data leaves the UK, we rely on UK adequacy regulations, the UK Extension to the EU US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum. Contact us if you want a copy of the safeguards.
‍

How long we keep it

Cookies
We use a small number of cookies to make the site work and, with your consent, to understand how it is used. Our Cookie Policy lists them.


Your rights
You have the right to access your personal data, correct it, have it erased, restrict or object to its use, receive it in a portable format, and withdraw consent at any time. You can object to direct marketing at any time. We do not make decisions based solely on automated processing that significantly affect you. To use any of these rights, you can contact us here and tell us what you would like us to do and giving enough detail to identify you.


Keeping your data secure
We use appropriate technical and organisational measures to protect personal data, limit access to those with a business need, and have procedures for handling suspected breaches. We will tell you and the ICO where the law requires it.

How to complain
Please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.


Changes to this policy
We may update this policy. We will change the date at the top and, for significant changes, tell you directly.
‍

Contact us
You can contact us here.