1. Who we are

Mediajem Consultancy Ltd (“Mediajem”, “we”, “us” or “our”) provides AI governance, data protection, compliance advisory, consultancy and training services.

Mediajem Consultancy Ltd is responsible for deciding how personal information collected through this website and our own business activities is used. This means we act as a data controller for that information.

Our registered office is 189 Laleham Road, London SE6 2AE.

For privacy enquiries, contact info@mediajemcompliance.com.

2. Our trading names

Mediajem Consultancy Ltd operates under the trading names:

·       Mediajem Compliance

·       CryptoCompliance Institute (CCI)

·       Aspire-GJR

This policy covers personal information processed by Mediajem Consultancy Ltd through these activities. Specific programmes or services may provide additional privacy information where necessary.

3. What personal information we collect

Depending on how you interact with us, we may collect:

·       Contact details: your name, email address, telephone number and organisation.

·       Professional details: your job title, responsibilities and organisational role.

·       Enquiry information: the information you provide when contacting us or requesting services.

·       AI & Data Governance Review information: responses about your organisation, regulatory environment, AI use, data protection exposure, existing controls and reasons for requesting a Review.

·       Cryptoasset Authorisation Readiness Pulse information: your answers to seven organisational readiness questions, your follow-up preference and any name, organisation or business email address you choose to provide.

·       Subscription information: your email address, relevant contact details and marketing preferences.

·       Service information: records and correspondence needed to arrange and deliver agreed consultancy or training services.

·       Website information: technical information collected through cookies and other website technologies, subject to the website's actual settings.

Please do not submit identifiable information about employees, customers or service users, confidential documents, or sensitive case details through our general enquiry forms or the Cryptoasset Authorisation Readiness Pulse. You can complete the Cryptoasset Authorisation Readiness Pulse without providing your name, organisation or email address; however, information supplied in a response may still identify someone in some circumstances.

Where more detailed information is needed for an engagement, we will agree an appropriate means of sharing it.

4. How we collect information

We collect information when you:

·       Complete a website contact or enquiry form, including the Cryptoasset Authorisation Readiness Pulse.

·       Request an AI & Data Governance Review or workshop.

·       Subscribe to news and updates.

·       Correspond with us by email or other agreed means.

·       Engage us to provide professional services.

We may also receive relevant professional information from business contacts, client organisations and publicly available professional sources.

Our website is operated using Squarespace. Website form submissions are processed through Squarespace and notifications containing the submitted information are delivered to our business email inbox. Cryptoasset Authorisation Readiness Pulse responses are also recorded in a Google Sheets spreadsheet connected to our Google account for reviewing responses and managing any requested follow-up.

5. Why we use information and our lawful bases

We use personal information for the following purposes:

·       Responding to enquiries and discussing possible services — Legitimate interests in operating our business and responding to requests; or steps before entering into a contract where applicable

·       Assessing requests for an AI & Data Governance Review or workshop — Legitimate interests in assessing prospective engagements; or pre-contractual steps where applicable

·       Assessing Cryptoasset Authorisation Readiness Pulse responses and responding to requests for a follow-up conversation — Legitimate interests in reviewing submitted organisational readiness information, understanding interest in our services and responding to requested contact; or pre-contractual steps where applicable

·       Providing agreed services — Contract where applicable; or legitimate interests in administering business-to-business engagements

·       Maintaining business records and meeting legal requirements — Legal obligation where applicable; otherwise legitimate interests

·       Sending newsletters and marketing updates to people who choose to subscribe — Consent

·       Maintaining website security and essential functionality — Legitimate interests or legal obligation, as applicable

·       Website analytics and non-essential cookies, where used — Consent where required

Where we rely on legitimate interests, these include responding to enquiries, managing professional relationships, maintaining appropriate records and operating our consultancy effectively. We consider the impact on individuals and their rights.

You can withdraw marketing consent at any time. Withdrawing consent does not affect processing that took place before withdrawal.

6. AI & Data Governance Review enquiries

Our Review enquiry form asks questions about your organisation and its use of AI, information and oversight arrangements.

We use these responses to understand your enquiry, assess the proposed scope of a Review, identify appropriate next steps and prepare for a potential engagement.

Submitting the form does not confirm a booking or create an obligation to pay.

Please provide information at an organisational level rather than identifying individual employees, customers or service users.

7. Cryptoasset Authorisation Readiness Pulse

The Pulse asks seven questions about an organisation’s potential readiness for the FCA cryptoasset regulatory regime, together with a question about whether the respondent would welcome a conversation about Mediajem’s paid readiness review and practical application-preparation support.

We use the answers to understand the readiness issues identified by respondents, assess interest in our services and, where a respondent requests follow-up and supplies contact details, arrange an introductory conversation. Name, organisation and email details are optional. Respondents who do not request follow-up will not be contacted on the basis of their Pulse submission alone.

Completing the Pulse does not establish regulatory readiness, constitute regulatory advice, confirm a booking or create an obligation to pay. It does not subscribe the respondent to marketing updates.

8. News and updates

You may choose to subscribe to news and updates through our website.

The subscription option on our Review form is unticked by default. Squarespace records the marketing preference submitted with the form and maintains contact and subscriber information.

We use subscriber information to manage subscriptions and send relevant communications. We do not treat the submission of a service enquiry alone as consent to receive marketing.

You may unsubscribe or withdraw consent by using an unsubscribe facility where provided or by contacting us.

9. Sharing personal information

We do not sell personal information.

Where necessary, information may be processed or shared with:

·       Squarespace, which provides website, form and contact-management functionality.

·       Google, which provides the Google Sheets storage used for Pulse responses, and our email and IT service providers, which support business communications and information storage.

·       Professional advisers or authorised associates, where necessary for an agreed purpose and subject to appropriate confidentiality and data protection arrangements.

·       Regulators, public authorities or other parties, where disclosure is required or permitted by law.

We limit sharing to what is appropriate for the relevant purpose.

10. International transfers

Some technology service providers may process or make personal information accessible outside the UK.

Where a transfer is subject to the UK GDPR's international transfer rules, we must ensure that an appropriate legal transfer mechanism applies. This may include UK adequacy regulations or approved contractual safeguards, as applicable.

You may contact us for further information about relevant international transfers and safeguards.

11. Information security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.

The measures used depend on the nature of the information and the services involved. Access to personal information is limited according to business need.

No electronic transmission or storage system can be guaranteed to be completely secure.

12. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, taking account of legal, contractual, regulatory and legitimate business requirements.

Retention periods depend on the nature of the information. This includes Cryptoasset Authorisation Readiness Pulse responses held in Squarespace, business email and Google Sheets. We consider whether information is still needed to respond to an enquiry, manage a professional relationship, understand aggregate readiness themes, deliver services, maintain appropriate business records or establish, exercise or defend legal claims. We review identifiable responses and remove or de-identify them when no longer needed.

Marketing subscription information is retained while a subscription remains active. Where someone unsubscribes or withdraws consent, we may retain limited information necessary to record and respect that preference.

We periodically review information held and securely delete or otherwise dispose of it when it is no longer required.

We are updating our retention and disposal schedule to document the periods and disposal arrangements applicable to different categories of information.

13. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

·       Request access to your personal information.

·       Ask us to correct inaccurate or incomplete information.

·       Request erasure.

·       Request restriction of processing.

·       Object to certain processing.

·       Request data portability.

·       Withdraw consent where processing is based on consent.

These rights are not absolute and may be subject to legal conditions or exemptions.

To exercise your rights, email info@mediajemcompliance.com.

You may also complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/. We would welcome the opportunity to address your concerns first.

14. Cookies and website technologies

Our website uses Squarespace's built-in functionality and analytics to support website operation and understand how visitors use the site. This includes information about visits, page views, unique visitors and website engagement.

We have enabled Squarespace's cookie consent banner, which allows visitors to accept all cookies, reject non-essential cookies or manage their preferences.

We do not currently use separately installed Google Analytics, Google Tag Manager, Meta Pixel or other third-party advertising analytics tools.

You can also manage cookies through your browser settings. For questions about our use of cookies, please contact info@mediajemcompliance.com.

15. Consultancy and client information

When providing consultancy, fractional DPO or other professional services, Mediajem may act as a controller for its own administration and professional records, or as a processor where it handles personal information on a client's documented instructions.

The applicable roles, responsibilities and information-handling arrangements will be addressed in the relevant engagement documentation where required.

16. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, systems, legal obligations or information-handling practices.

The date of the latest update will appear at the top of this page.

17. Contact us

Mediajem Consultancy Ltd

Email: info@mediajemcompliance.com

Registered office: 189 Laleham Road, London SE6 2AE

Mediajem Consultancy Ltd (“Mediajem”, “we”, “us” or “our”) provides AI governance, data protection, compliance advisory, consultancy and training services.

Mediajem Consultancy Ltd is responsible for deciding how personal information collected through this website and our own business activities is used. This means we act as a data controller for that information.

Our registered office is 189 Laleham Road, London SE6 2AE.

For privacy enquiries, contact info@mediajemcompliance.com.

2. Our trading names

Mediajem Consultancy Ltd operates under the trading names:

·       Mediajem Compliance

·       CryptoCompliance Institute (CCI)

·       Aspire-GJR

This policy covers personal information processed by Mediajem Consultancy Ltd through these activities. Specific programmes or services may provide additional privacy information where necessary.

3. What personal information we collect

Depending on how you interact with us, we may collect:

·       Contact details: your name, email address, telephone number and organisation.

·       Professional details: your job title, responsibilities and organisational role.

·       Enquiry information: the information you provide when contacting us or requesting services.

·       AI & Data Governance Review information: responses about your organisation, regulatory environment, AI use, data protection exposure, existing controls and reasons for requesting a Review.

·   Cryptoasset Authorisation Readiness Pulse information: your answers to seven organisational readiness questions, your follow-up preference and any name, organisation or business email address you choose to provide.

·       Subscription information: your email address, relevant contact details and marketing preferences.

·       Service information: records and correspondence needed to arrange and deliver agreed consultancy or training services.

·       Website information: technical information collected through cookies and other website technologies, subject to the website's actual settings.

Please do not submit identifiable information about employees, customers or service users, confidential documents, or sensitive case details through our general enquiry forms or the Cryptoasset Authorisation Readiness Pulse. You can complete the Pulse without providing your name, organisation or email address; however, information supplied in a response may still identify someone in some circumstances.

Where more detailed information is needed for an engagement, we will agree an appropriate means of sharing it.

4. How we collect information

We collect information when you:

·       Complete a website contact or enquiry form, including the Cryptoasset Authorisation Readiness Pulse.

·       Request an AI & Data Governance Review or workshop.

·       Subscribe to news and updates.

·       Correspond with us by email or other agreed means.

·       Engage us to provide professional services.

We may also receive relevant professional information from business contacts, client organisations and publicly available professional sources.

Our website is operated using Squarespace. Website form submissions are processed through Squarespace and notifications containing the submitted information are delivered to our business email inbox. Cryptoasset Authorisation Readiness Pulse responses are also recorded in a Google Sheets spreadsheet connected to our Google account for reviewing responses and managing any requested follow-up.

5. Why we use information and our lawful bases

We use personal information for the following purposes:

·       Responding to enquiries and discussing possible services — Legitimate interests in operating our business and responding to requests; or steps before entering into a contract where applicable

·       Assessing requests for an AI & Data Governance Review or workshop — Legitimate interests in assessing prospective engagements; or pre-contractual steps where applicable

·       Assessing Cryptoasset Authorisation Readiness Pulse responses and responding to requests for a follow-up conversation — Legitimate interests in reviewing submitted organisational readiness information, understanding interest in our services and responding to requested contact; or pre-contractual steps where applicable

·       Providing agreed services — Contract where applicable; or legitimate interests in administering business-to-business engagements

·       Maintaining business records and meeting legal requirements — Legal obligation where applicable; otherwise legitimate interests

·       Sending newsletters and marketing updates to people who choose to subscribe — Consent

·       Maintaining website security and essential functionality — Legitimate interests or legal obligation, as applicable

·       Website analytics and non-essential cookies, where used — Consent where required

Where we rely on legitimate interests, these include responding to enquiries, managing professional relationships, maintaining appropriate records and operating our consultancy effectively. We consider the impact on individuals and their rights.

You can withdraw marketing consent at any time. Withdrawing consent does not affect processing that took place before withdrawal.

6. AI & Data Governance Review enquiries

Our Review enquiry form asks questions about your organisation and its use of AI, information and oversight arrangements.

We use these responses to understand your enquiry, assess the proposed scope of a Review, identify appropriate next steps and prepare for a potential engagement.

Submitting the form does not confirm a booking or create an obligation to pay.

Please provide information at an organisational level rather than identifying individual employees, customers or service users.

7. FCA Crypto Asset Readiness Pulse

The Pulse asks seven questions about an organisation’s potential readiness for the FCA cryptoasset regulatory regime, together with a question about whether the respondent would welcome a conversation about Mediajem’s paid readiness review and practical application-preparation support.

We use the answers to understand the readiness issues identified by respondents, assess interest in our services and, where a respondent requests follow-up and supplies contact details, arrange an introductory conversation. Name, organisation and email details are optional. Respondents who do not request follow-up will not be contacted on the basis of their Pulse submission alone.

Completing the Pulse does not establish regulatory readiness, constitute regulatory advice, confirm a booking or create an obligation to pay. It does not subscribe the respondent to marketing updates.

8. News and updates

You may choose to subscribe to news and updates through our website.

The subscription option on our Review form is unticked by default. Squarespace records the marketing preference submitted with the form and maintains contact and subscriber information.

We use subscriber information to manage subscriptions and send relevant communications. We do not treat the submission of a service enquiry alone as consent to receive marketing.

You may unsubscribe or withdraw consent by using an unsubscribe facility where provided or by contacting us.

9. Sharing personal information

We do not sell personal information.

Where necessary, information may be processed or shared with:

·       Squarespace, which provides website, form and contact-management functionality.

·       Google, which provides the Google Sheets storage used for Pulse responses, and our email and IT service providers, which support business communications and information storage.

·       Professional advisers or authorised associates, where necessary for an agreed purpose and subject to appropriate confidentiality and data protection arrangements.

·       Regulators, public authorities or other parties, where disclosure is required or permitted by law.

We limit sharing to what is appropriate for the relevant purpose.

10. International transfers

Some technology service providers may process or make personal information accessible outside the UK.

Where a transfer is subject to the UK GDPR's international transfer rules, we must ensure that an appropriate legal transfer mechanism applies. This may include UK adequacy regulations or approved contractual safeguards, as applicable.

You may contact us for further information about relevant international transfers and safeguards.

11. Information security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.

The measures used depend on the nature of the information and the services involved. Access to personal information is limited according to business need.

No electronic transmission or storage system can be guaranteed to be completely secure.

12. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, taking account of legal, contractual, regulatory and legitimate business requirements.

Retention periods depend on the nature of the information. This includes Pulse responses held in Squarespace, business email and Google Sheets. We consider whether information is still needed to respond to an enquiry, manage a professional relationship, understand aggregate readiness themes, deliver services, maintain appropriate business records or establish, exercise or defend legal claims. We review identifiable responses and remove or de-identify them when no longer needed.

Marketing subscription information is retained while a subscription remains active. Where someone unsubscribes or withdraws consent, we may retain limited information necessary to record and respect that preference.

We periodically review information held and securely delete or otherwise dispose of it when it is no longer required.

We are updating our retention and disposal schedule to document the periods and disposal arrangements applicable to different categories of information.

13. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

·       Request access to your personal information.

·       Ask us to correct inaccurate or incomplete information.

·       Request erasure.

·       Request restriction of processing.

·       Object to certain processing.

·       Request data portability.

·       Withdraw consent where processing is based on consent.

These rights are not absolute and may be subject to legal conditions or exemptions.

To exercise your rights, email info@mediajemcompliance.com.

You may also complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/. We would welcome the opportunity to address your concerns first.

14. Cookies and website technologies

Our website uses Squarespace's built-in functionality and analytics to support website operation and understand how visitors use the site. This includes information about visits, page views, unique visitors and website engagement.

We have enabled Squarespace's cookie consent banner, which allows visitors to accept all cookies, reject non-essential cookies or manage their preferences.

We do not currently use separately installed Google Analytics, Google Tag Manager, Meta Pixel or other third-party advertising analytics tools.

You can also manage cookies through your browser settings. For questions about our use of cookies, please contact info@mediajemcompliance.com.

15. Consultancy and client information

When providing consultancy, fractional DPO or other professional services, Mediajem may act as a controller for its own administration and professional records, or as a processor where it handles personal information on a client's documented instructions.

The applicable roles, responsibilities and information-handling arrangements will be addressed in the relevant engagement documentation where required.

16. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, systems, legal obligations or information-handling practices.

The date of the latest update will appear at the top of this page.

17. Contact us

Mediajem Consultancy Ltd

Email: info@mediajemcompliance.com

Registered office: 189 Laleham Road, London SE6 2AE