Who We Are

Fivepenny Limited (“we”, “us”) is a UK‑registered information security and data protection advisory firm.

When delivering professional services, we act as a data processor on behalf of our clients (the data controllers). A Data Processing Agreement (DPA) is executed for every engagement. This privacy notice does not apply to that processing.

What Personal Data We Process

We process:

• Contact details (names, job titles, email addresses, phone numbers)

• Business and professional role information relevant to our services

• Marketing preferences

Who’s personal data do we process

We process:

• Employees and representatives of clients and prospective clients

Purposes and Lawful Bases for Processing

We process personal data for:

• Service delivery: To fulfil contractual obligations or in the negotiation of contract (performance of a contract)

• Direct marketing: To promote our services and attract new customers (legitimate interests)

You can opt out of marketing communications at any time by emailing [email protected].

Sharing and Transfers

We share data only with:

• Service providers to us as our processors

• On rare occasions with authorities or regulators when it is legal and appropriate

• International transfers are safeguarded by adequacy decisions or other Appropriate Safeguards as recognised under Article 46 of UK GDPR.

Retention

Data is retained only as long as necessary for contractual, legal, or legitimate business purposes.

Your Rights

Under GDPR, you have certain limited rights to access, rectify, erase, restrict, object (including to marketing), and request portability of your data. Contact us if you wish to exercise any of these rights using the details below.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe your data has been processed unlawfully. Visit www.ico.org.uk for details.

Contact

Any correspondence relating to data protection should be directed to [email protected]