Privacy Policy

At a glance

1. About this notice

This Privacy Notice explains how De Havilands Limited ("De Havilands", "we", "us" or "our") collects and uses personal information when you visit dehavilands.com, contact us, request or download a resource, book a call, complete a quiz or assessment, or otherwise interact with us in a business capacity.

It also explains the choices and rights available to you. The notice applies to information about identifiable people. Information about a company is not usually personal information by itself, but it may become personal information when it identifies or is linked to an employee, director, sole trader, partner or other individual.

2. Who we are

De Havilands Limited is a Microsoft Excel consultancy incorporated in Mauritius. We provide Excel development, business-critical spreadsheet risk assessment and consulting services, primarily to financial-services organisations in the United Kingdom and United States. We are the controller responsible for deciding why and how the personal information described in this notice is used.

3. The information we collect

3.1 Website and device information

When you use our website, we may receive your IP address, device and browser type, operating system, approximate location derived from IP address, pages viewed, referring page, date and time, session identifiers, cookie choices, and technical or security logs. We collect optional analytics or advertising information only as described in our Cookie Notice and, where required, after you have consented.

3.2 When you request a downloadable resource

If you request a downloadable resource, such as a PDF guide, spreadsheet model or tool, presentation or other digital material, we may collect your name, business email address, organisation, job title or role, the resource requested, the date and source of the request, delivery information and email engagement information. We use these details to send the resource, deal with delivery problems and understand which resources are useful.

These resources are intended for representatives of companies and other corporate organisations. When you request one using business details, we will add those details to our MailerLite distribution list and may send a relevant follow-up sequence and occasional B2B marketing about De Havilands resources and services. We explain this at the point of collection and every marketing email includes an unsubscribe option.

3.3 When you complete a quiz or assessment

If you complete a quiz, scorecard, questionnaire or other assessment, we may collect:

Our assessments are intended for representatives of companies and other corporate organisations. When you complete one using business details, we will add those details to our MailerLite distribution list and may send relevant follow-up and B2B marketing. Every marketing email includes an unsubscribe option.

3.4 When you book or attend a call

We may collect your name, business email address, organisation, job title, telephone number, preferred meeting details and anything you choose to tell us about your Excel-related concern. We may use website booking, scheduling and video-conferencing providers to arrange and conduct the call. We keep relevant correspondence and follow-up notes. If we intend to record or transcribe a call, we will tell you beforehand and explain the relevant choice and use.

3.5 When you contact us directly

If you contact us by email, through a website form, on LinkedIn or by another business channel, we collect your contact details and the information in your message so that we can respond. We may also keep records of our correspondence, how you heard about us and any requested next steps, including a Triage or other service enquiry.

3.6 Marketing and relationship information

If we add your corporate business details to our distribution list, or otherwise contact you in a business context where the law permits, we may keep your communication preferences, the subjects likely to be relevant to your role, emails sent, delivery and engagement information, unsubscribe or objection records, and a minimal suppression record so that we do not contact you again after an opt-out.

3.7 Information from other sources

We may receive business contact information from your employer, a referral, a meeting or event, public corporate websites, Companies House or equivalent registers, and professional networking platforms such as LinkedIn. If we obtain your personal information from elsewhere, we will provide privacy information within the period required by applicable law, normally by our first communication and no later than one month, unless an exemption applies.

4. Information you should not provide

The website, downloadable-resource forms and assessments are designed for ordinary business contact information and high-level information about an organisation's operations and needs. They are not designed to collect special-category or highly sensitive personal information.

Please do not enter health information, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic or biometric information, sexual orientation, criminal-offence information, passwords, access credentials, personal information about colleagues or clients, client records, transaction-level financial data, workbook contents, or other confidential or regulated information. If you need to discuss sensitive material with us, contact us first so that we can agree a suitable secure method.

5. How we use personal information and our lawful bases

The lawful basis depends on the particular purpose. Where more than one basis is shown below, the basis actually used depends on the context; we record that decision internally before processing begins.

6. Quizzes and assessments: scoring, segmentation and automated processing

A quiz or assessment may use pre-set scoring rules. Each answer may contribute points to an overall score and, where applicable, category or pillar scores. Those scores may place the organisation into a risk, readiness or other result band and select corresponding explanations, recommendations and calls to action. We may also use the score, organisation and role to place a response into a follow-up segment or to prioritise a human review.

The score is an indicative self-assessment based only on the answers supplied. It is not an audit, assurance opinion, regulatory assessment, professional advice or guarantee, and it does not establish a client relationship. A low or high score does not by itself determine whether we will provide a service. You may contact us irrespective of your result.

The automated result and segmentation do not produce legal effects or similarly significant effects on an individual. Any material decision about an engagement is made or reviewed by a person. You may ask us to explain the scoring approach, correct inaccurate input information or review a result.

We do not use identifiable assessment answers to train a public artificial-intelligence model. We also do not submit identifiable answers to a general-purpose generative AI service to create your result unless we first update this notice, explain the use clearly and put the required lawful basis, contracts and safeguards in place.

7. Marketing choices

Our downloadable resources, quizzes and assessments are intended for people acting for companies and other corporate organisations, principally in the financial-services sector. If you request or complete one using business details, we will add those details to our MailerLite distribution list and may send a relevant follow-up sequence and occasional B2B marketing about De Havilands resources and services. We rely on our legitimate interests in relevant B2B marketing and, for UK electronic mail, the rules permitting marketing to corporate subscribers without consent. We tell you about this use at the point where we collect your details.

A general enquiry does not automatically place you on the marketing list unless we tell you otherwise at the point of collection or another lawful basis applies. We do not actively market our downloads or assessments to sole traders, unincorporated partnerships or people acting privately. If we knowingly market by email to an individual subscriber, we do so only where we have valid consent or another specific legal permission.

Every marketing email includes an unsubscribe link. You can also object or unsubscribe by contacting hello@dehavilands.com. We will stop direct marketing and related profiling when you object. Where processing is based on consent, withdrawal does not affect processing already carried out lawfully. We may retain a minimal suppression record to respect your choice.

8. What we do not do with assessment and download data

9. When we share information

We share personal information only where needed for the purposes in this notice, under appropriate contractual and security controls. Recipients may include:

Service providers acting as processors may use the information only on our documented instructions, except where they have an independent legal obligation. We remain responsible for selecting appropriate processors and agreements.

10. International transfers

De Havilands is established in Mauritius, so personal information may be received or accessed here. The cloud services supporting our email distribution, downloadable resources, assessments, website, scheduling, video calls and analytics may also process information in the United Kingdom, European Economic Area or United States. These transfers arise principally from the locations used by those service providers and their approved subprocessors.

We do not provide assessment or download data to Excel-development contractors merely because they work with us. A contractor receives personal information only where it is reasonably needed for specific work and is subject to appropriate confidentiality and data-protection obligations.

Where transfer rules apply and the destination is not covered by an applicable adequacy decision, we use an approved transfer mechanism and additional safeguards where required. These may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, transfer-risk assessments, contractual confidentiality, access controls, encryption and minimisation. You may contact us for more information about the relevant safeguard, subject to protection of confidential and security-sensitive terms.

11. How long we keep information

We keep identifiable information only for as long as reasonably needed for the purpose collected, to respect your choices, and to meet legal, accounting, security or claims requirements. Our normal periods are:

At the end of the relevant period, we delete the information or irreversibly anonymise it. We may keep aggregated information that no longer identifies a person for trend analysis, benchmarking and service improvement.

12. Cookies and similar technologies

Our website may use strictly necessary technologies for security, network management, accessibility and functions you request. We do not require consent for a technology only where applicable law permits this. Optional analytics, advertising or similar technologies are not activated until the required choice has been made.

Our email-distribution provider records operational information such as delivery, bounces and unsubscribes. Marketing emails may also use tracking technologies to measure opens, clicks or related engagement. We use those technologies only where applicable storage-and-access rules permit and, where consent is required, after that consent has been obtained; otherwise the relevant tracking is disabled.

We currently use only technologies that are strictly necessary for the security, operation and functionality of our website or to remember your privacy choices. These technologies cannot be switched off through our website because the website cannot operate properly without them. You can configure your browser to block them, although parts of the website may then not function correctly. We will update this notice and introduce an appropriate consent mechanism before using optional analytics, advertising or similar technologies.

13. Security

We use proportionate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. Measures may include access controls, multi-factor authentication, encryption in transit and where appropriate at rest, least-privilege access, confidentiality duties, supplier due diligence, backups, monitoring, staff procedures and incident response. No internet service is completely secure, and we cannot guarantee absolute security.

14. Your rights

Depending on the law that applies and the circumstances, you may have the right to:

Rights are not absolute and exemptions may apply. To exercise a right, email hello@dehavilands.com. We may ask for proportionate information to verify identity or authority. We normally respond within one month, subject to any permitted extension, and do not usually charge a fee.

15. Complaints

Please send a data protection complaint to hello@dehavilands.com with the subject line "Data protection complaint". We will acknowledge it within 30 days, make appropriate enquiries, keep you informed where needed, and tell you the outcome without undue delay.

You may also complain to the Data Protection Commissioner in Mauritius. If the UK GDPR applies, you may complain to the UK Information Commissioner's Office. If the EU GDPR applies, you may complain to the supervisory authority in the EEA country where you live or work or where the alleged infringement occurred. We would appreciate the opportunity to address the concern first, but this does not limit your right to approach a regulator.

16. Children

The website, downloadable resources, quizzes and assessments are intended for adults acting in a business capacity and are not directed to anyone under 18. We do not knowingly collect personal information from children through these services. Please contact us if you believe a child has submitted information.

17. External links

Our website or result report may link to third-party websites. The third party controls its own processing, and its privacy notice applies when you use that site. A link does not mean that we control or endorse its privacy practices.

18. Changes to this notice

We may update this notice when our services, suppliers or legal obligations change. We will publish the updated version with a new effective date and, where a change materially affects an existing use of personal information, provide additional notice or obtain a new choice where required.

19. Contact us

For questions, rights requests or complaints, contact: