Privacy Policy

This Privacy Policy applies to personal data processed in connection with:

Jungfrau Advisory is the trading name of Jungfrau Holdings Ltd, a company incorporated in England and Wales. The practice presents locations in London and Zürich and provides entirely remote consulting services to organisations, principally in the United Kingdom and Europe.

The firm provides independent business advisory services, including strategic advisory, business reviews, strategic reviews, project advisory, executive advisory, operational improvement, business transformation, technology advisory, corporate strategy, business planning, process improvement and executive decision support.

The firm does not provide legal advice, financial advice, investment advice, tax advice, regulated financial services, FCA regulated activities, insurance services, accounting services or employment law advice. Nothing in this policy should be read as expanding the scope of services beyond those actually offered.

For the purposes of applicable data protection law, the data controller of personal data covered by this Privacy Policy is Jungfrau Holdings Ltd, trading as Jungfrau Advisory.

Primary contact details are:

The personal data collected will vary depending on how an individual interacts with the website or the firm. Information provided directly may include name, job title and employer; business contact details such as email address, telephone number and business address; the contents of an enquiry, message or correspondence; information provided when requesting a meeting, proposal or follow-up communication; information voluntarily included in documents, attachments or other materials sent to the firm; professional background or curriculum vitae information where someone applies for a role; and any other information that an individual or organisation chooses to provide.

When the website is used, certain technical and usage information may be collected automatically, either directly or through standard service providers. This may include IP address or truncated IP information, browser type and version, device type and operating system, referral source, pages viewed and navigation paths, date, time and duration of visits, approximate location inferred from technical data, server and security logs, and information recorded through cookies or similar technologies, subject to consent preferences.

The website may use cookies and similar technologies to support essential website functions and, where enabled and accepted by the user, standard analytics functions. Under PECR, cookies that are not strictly necessary require consent. Further detail is set out in the separate Cookie Policy, which should be read alongside this Privacy Policy.

Where analytics are enabled, the firm configures them in a proportionate and privacy-conscious way, for example by reducing data granularity where reasonably practicable and limiting retention within the relevant analytics service.

Under the UK GDPR, personal data must be processed on one or more lawful bases. Jungfrau Advisory generally relies on the following bases, as applicable:

The firm may send limited professional updates, invitations, publications or related communications on a business-to-business basis where applicable law permits. Where electronic marketing rules apply, the firm complies with PECR, including obtaining consent where required and providing an appropriate means to opt out. Individuals may object to direct marketing at any time.

The firm does not use the website for consumer mass marketing, targeted advertising networks or unrelated promotional profiling.

The firm does not sell personal data. Personal data may be shared where reasonably necessary with third-party service providers (such as website hosting, email and communications, document management and cloud storage, IT support, analytics and security providers), professional advisers (solicitors, barristers, insurers, auditors and accountants), and where required by law, regulation or court order, in response to lawful requests from authorities, to establish, exercise or defend legal claims, or in connection with a corporate transaction subject to appropriate safeguards.

The firm operates remotely and may use service providers whose systems or support arrangements involve processing outside the United Kingdom. Where personal data is transferred internationally, the firm takes reasonable steps to ensure such transfers are made in accordance with applicable data protection law, relying on a UK adequacy regulation, appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or another lawful transfer basis.

The firm takes appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Such measures may include access controls and least-privilege practices, authentication controls, reputable third-party service providers, encryption in transit and, where appropriate, at rest, device and network security, and confidentiality obligations for personnel and contractors. No method of transmission over the internet or method of electronic storage is entirely secure and absolute security cannot be guaranteed.

Personal data is retained only for as long as reasonably necessary for the relevant purpose, taking into account legal, regulatory, tax, accounting, professional, risk management and record-keeping requirements. Website technical logs and security records are retained for a limited period appropriate to security, troubleshooting and audit needs. Enquiry records and prospective client correspondence may be retained for as long as reasonably necessary to manage the relationship. Client engagement records may be retained for the duration of the engagement and a reasonable period afterwards. Recruitment records are retained only for as long as reasonably necessary for the recruitment purpose.

Subject to applicable law and depending on the circumstances, individuals may have the following rights under the UK GDPR:

A request may be made using the contact details below. The firm may ask for information reasonably necessary to verify identity and clarify the scope of the request. The firm will respond within the period required by applicable law. In some cases a request may be declined or limited where an exemption applies or where the request is manifestly unfounded or excessive.

Individuals are encouraged to contact the firm first if they have concerns. Individuals also have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection matters.

This Privacy Policy may be updated from time to time to reflect changes in law, regulatory guidance, business operations, website functionality or data processing practices. The latest version will be made available on the website with the effective date shown at the top of the document.