Privacy policy.

Last updated: May 2026

1. Introduction

D2D Associates is the trading name of D2D Associates Limited, registered in England and Wales under company number 12507599, with its registered office at 71-75 Shelton Street, London WC2H 9JQ. In this policy, “we”, “us” and “our” refer to D2D Associates Limited.

We are committed to protecting your privacy and processing your personal information in compliance with relevant data protection laws, including the General Data Protection Regulation (GDPR). For any questions or concerns, you can contact us at davidd@d2dassociates.co.uk.

We gather and process your personal information in accordance with this privacy notice and in compliance with the relevant data protection regulation and laws. This notice provides you with the necessary information regarding your right and our obligations and explains how, why and when we process your personal data.

Depending on the services we provide, we may act as either data controller or data processor. We act as controller where we decide how and why personal data is used, including for client administration, legal compliance, billing and business management. We may act as processor where we process personal data on your behalf as part of the services we provide.

We may use approved technology tools, including artificial intelligence tools, to support our work. These tools assist our team but do not replace our professional judgement or responsibility for the services we provide.

We can be contacted at davidd@d2dassociates.co.uk or at the above address if you have any queries about your data.

Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

2. Information We May Collect and Process from You

We collect and process personal data for legitimate purposes, such as delivering products and services, processing financial transactions, and fulfilling legal obligations.

The table below sets out the ways we use your personal data and the lawful basis we rely on for each.

3. Payroll Processing

We process personal data to fulfil payroll obligations, including employment payments and deductions.

Types of data processed:

• Identity, contact details, bank information, salary, and employment data.

Legal basis:

• Performance of a contract: Payroll processing as required under employment contracts.
• Compliance with legal obligations: Including HMRC filings.
• Legitimate interest: Use of third party payroll services for efficiency.

We will not use AI tools to make final payroll, employment or payment decisions without human review. Where AI tools assist with payroll related work, they will be used only to support checking, drafting, summarising or administrative tasks, subject to appropriate confidentiality and security controls.

4. Financial Management and Strategic Advice

We process data to fulfil the following obligations:

Bookkeeping, Management Accounting, Cash Flow, and Year end Accounts: We process personal data to prepare financial reports, manage cash flow, and fulfil statutory reporting obligations (e.g., tax filings).

Strategic Advice and Consultancy: When providing professional advice, we may process personal and business data to offer tailored strategic recommendations for business operations, financial health, and compliance.

Types of data processed:

• Identity, contact information, financial records, and business strategy documents.

Legal basis:

• Performance of a contract: Providing strategic advice and consultancy services.
• Legitimate interest: Offering services that support business success and compliance.

We may use approved AI tools to assist with financial analysis, report drafting, data review, research, forecasting, meeting summaries and preparation of advice. Any AI-generated output will be reviewed by our team before being used as part of our work for you.

5. Non Disclosure Agreements (NDAs)

We enter into NDAs to protect confidential business information and personal data shared during our relationship.

Types of data covered:

• Any personal or business information classified as confidential, including financial data and business strategies.

Legal basis:

• Performance of a contract: Compliance with NDA terms.
• Legitimate interest: Ensuring confidentiality.

Where information is subject to an NDA or confidentiality restriction, we will only use that information with AI tools where we consider the relevant safeguards to be appropriate, where the use is consistent with the NDA, or where you have given permission.

6. Use of Third Party Software and Subcontractors

We may use third party software and approved artificial intelligence tools (e.g., cloud platforms, accounting software) to perform work efficiently. This may include cloud platforms, accounting software, payroll software, document tools, Claude, ChatGPT and AI meeting notetakers.. We ensure that third party providers adhere to GDPR standards and protect personal data.

AI tools may be used to assist with research, drafting, analysis, document review, meeting notes, summaries, data processing and quality checks. AI tools support our work but do not replace our professional judgement. We remain responsible for the final work provided to you.

Third Party Processors: When we use third party service providers to process personal data (e.g., accounting software, payroll providers), we ensure they are bound by data protection agreements and strict confidentiality terms.

Types of data processed:

• Identity, contact information, financial details, transaction records, and technical data (e.g., system logs).

Legal basis:

• Performance of a contract: Using third party software or subcontractors to fulfill contractual obligations.
• Legitimate interest: Enhancing efficiency and service quality through third party tools.
• Data Sharing: We may share data with third party software providers or subcontractors for operational purposes (e.g., payroll processing, accounting, or strategic advice). These third parties are contractually required to handle data securely and adhere to GDPR.

7. This Website

Our website is hosted by a third party hosting provider, which serves the site and protects it from malicious traffic. To do that it processes technical data such as your IP address and browser type, and may set strictly necessary security cookies. That provider may process this data outside the United Kingdom, under its own standard contractual clauses and privacy policy. Our cookie policy names the provider we currently use.

We measure basic visitor numbers using a privacy friendly analytics tool that counts page views without cookies and without identifying individual visitors.

Our online diary is provided by Microsoft Bookings. If you open our booking page, or book a call, Microsoft processes the details you enter and sets its own cookies, under its own privacy policy.

We do not use Google Analytics, advertising pixels or any cross-site tracking. Our cookie policy sets out every cookie the site uses.

If you ask us to email you our tips sheet, we use the name, business and email address you give us to send it and to follow up once. We do not add you to a mailing list, we do not pass your details to anyone else, and you can tell us to stop at any time by replying or emailing davidd@d2dassociates.co.uk. We keep the record for two years and then delete it.

Legal basis: consent, which you give by ticking the box on the form, and which you can withdraw at any time.

Legal basis:

• Legitimate interest: keeping the website secure, available and understanding how it is used.
• Performance of a contract, or steps before entering one: handling a booking you make with us.

8. Data Breach Notification

In the event of a data breach involving your personal data, we will take the following steps:

• Notify the ICO: We will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, if it poses a risk to your rights and freedoms.
• Notify Affected Individuals: If the breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.
• Security Measures: We will implement immediate measures to limit damage, such as isolating affected systems and initiating recovery protocols.

Types of data potentially affected:

• Identity, contact, financial, and technical information.

Legal basis:

• Compliance with legal obligations: Adhering to data breach notification laws.
• Legitimate interest: Protecting personal data and maintaining transparency.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting obligations.

• Payroll and Financial Data: Retained for 6 years in compliance with tax and statutory regulations.
• Strategic Advice: Retained for the duration of our business relationship and as required for legal and financial audits.
• NDA Related Data: Retained for the duration of the NDA and any additional time necessary to resolve disputes or comply with legal obligations.

10. Data Security

We use strict security measures to protect your personal data, including:

• Access Control: Restricted access to personal data based on job role and necessity.
• Third Party Security: We ensure that third party service providers, such as subcontractors and software providers, comply with stringent data protection standards.

11. Your Rights

You have several rights concerning your personal data, including:

• Right of Access: You can request a copy of your data.
• Right to Rectification: You can correct any inaccuracies in your data.
• Right to Erasure: You can request the deletion of your data when no longer needed.
• Right to Restrict Processing: You can limit how your data is processed in certain circumstances.
• Right to Data Portability: You can request your data in a structured, machine readable format.
• Right to Object: You can object to the processing of your data, particularly for direct marketing.

If you feel that a situation has arisen or may arise and you wish to learn more about these rights or to exercise those rights, please contact us on davidd@d2dassociates.co.uk. Please note that this will not include processing where it is necessary to fulfil a contract or where a legal obligation for us to process the information exists.

12. Changes to the Policy

We may update this privacy policy periodically. Updates will be posted on our website, and, where appropriate, you will be notified by email. Please review this policy regularly to stay informed of any changes.

13. Contact Information

For any queries regarding this policy or to exercise your rights, contact David Dring at davidd@d2dassociates.co.uk