Who we are

At colganbauer, we understand the importance of protecting the privacy of our website visitors and clients. This Privacy Policy explains how we collect, use, share and protect personal information across our teams in the United Kingdom, Australia and India.

colganbauer operates through the following entities, each of which is responsible (as “controller”, “APP entity” or “Data Fiduciary”, depending on local law) for the personal information it handles:

Where we say “colganbauer”, “we”, “us” or “our” in this policy, we mean the relevant entity above. If you are unsure which entity holds your information, contact us at contact@colganbauer.com and we will tell you.

This policy applies to visitors to colganbauer.com, people who contact us, and the people we work with at our clients, prospects and partners. It does not cover our own staff, who receive a separate notice.

Information we collect and how we use it

When you visit our website or contact us, we may collect personal information such as your name, email address, phone number, employer and job title. We may also collect technical information such as your IP address, device and browser type, and the pages you visit, through cookies and Google Analytics (see our Cookie Policy).

We use your personal information to:

• provide the services you or your organisation request from us;
• respond to enquiries and communicate with you;
• send you updates about our work, where you have agreed or where the law allows (you can opt out at any time using the link in each message or by emailing us);
• improve our website and services; and
• meet our legal, regulatory and accounting obligations.

We do not sell your personal information. We share it only where this is necessary to provide our services, with service providers who act on our instructions (such as hosting, email, analytics and CRM providers), between colganbauer entities as described below, to comply with the law, or to protect our rights and the rights of others.

Our team locations and international transfers

Our team works across the United Kingdom, Australia and India, so your personal information may be accessed by, or transferred to, colleagues in any of these countries. Our service providers may also store or process information in other countries, including the United States and the European Economic Area.

Data protection laws differ between countries. Wherever your information is handled, we protect it to the standard set out in this policy, and we put the following safeguards in place:

• Transfers from the UK to Australia or India (neither of which currently has UK “adequacy” status) are made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Transfers to the United States may also rely on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified.
• Transfers from Australia are made only after we have taken reasonable steps, including binding contractual terms, to ensure the overseas recipient handles your information consistently with the Australian Privacy Principles, as required by APP 8. We remain accountable for how that recipient handles your information.
• Transfers from India are made in line with the Digital Personal Data Protection Act, 2023, which permits transfers outside India except to countries the Indian Government restricts by notification.
• Between colganbauer entities, transfers are covered by an intra-group data sharing agreement.

Access is limited to team members who need the information to do their work, and all team members are bound by confidentiality obligations. You can ask us for more detail on these safeguards, or a copy of the relevant transfer terms, using the contact details below.

Your rights by location

Wherever you are, you can ask to access, correct or delete your personal information, and to stop receiving marketing. The rules below add to this depending on where you are.

United Kingdom

Under the UK GDPR and the Data Protection Act 2018, we process your information on these legal bases: performing a contract with you or your organisation; our legitimate interests in running and growing our business, where these are not outweighed by your rights; your consent (for example, analytics cookies and some marketing), which you can withdraw at any time; and compliance with legal obligations.

You also have the right to restrict or object to our processing, to data portability, and not to be subject to decisions based solely on automated processing. You can complain to the Information Commissioner’s Office, although we would welcome the chance to address your concerns first.

Australia

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You can deal with us anonymously or under a pseudonym where this is practicable. We will respond to access and correction requests within 30 days.

If you have a complaint, contact us first, and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner.

India

Under the Digital Personal Data Protection Act, 2023, we process your digital personal data with your consent, which you can withdraw at any time as easily as you gave it, or for other legitimate uses the Act permits. You have the right to information about the data we process and who we share it with, to correction, completion, updating and erasure, to grievance redressal, and to nominate another person to exercise your rights if you die or become incapacitated.

Grievances can be raised with our grievance contact: Prashant Raju, contact@colganbauer.com. If we do not resolve your grievance, you can complain to the Data Protection Board of India once the relevant provisions are in force.

Security and retention

We take reasonable measures to protect your personal information from unauthorised access, disclosure, loss or misuse, using industry-standard security technologies and procedures. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulator as each country’s law requires.

We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires. When we no longer need it, we securely delete or anonymise it.

Links to third-party websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these websites, and we encourage you to review their privacy policies before providing any personal information.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and updating the effective date below.

Contact us

If you have any questions, requests or concerns about this Privacy Policy, contact us at contact@colganbauer.com, or write to the relevant entity at the address above.

Effective date: 8th October, 2026