TERMS
Fees
Fees are discussed and agreed prior to any project involvement. An initial consultation by telephone is free of charge, and any subsequent involvement will include a fully costed proposal for the client. Project fees are usually billed monthly and in arrears. For large projects we may request a deposit up front. Our terms of payment are three weeks from the date of invoice.
PRIVACY
Stewart Miller associates (SMas) is a management consultancy business, and we work with and advise a number of businesses and organisations in Scotland and elsewhere. As part of delivering this consultancy service we may from time to time use certain data which relates to individuals and businesses.
SMas operates from Mansfield Road, Prestwick, KA9 2DN.
We are committed to protecting and respecting the privacy of individuals and businesses. This privacy policy explains what personal data we may collect about you and your business, how we use this data, for what purposes and who we may share it with. (For the legal version read our GDPR Compliance, provided below).
What data do we collect about you?
In providing services to businesses and organisations we may collect data about you and the business you represent, summarised as follows:
- Individual’s name & position within the business
- Business name
- Business contact details including address, telephone number, mobile number, email address and website address
- Industry sector the business operates in
- To allow us to provide recommendations we usually need to undertake business reviews, to gather key business information including, but not restricted to: company status (e.g. limited company); company turnover for the last three years; a breakdown of sales by geographical market and customer type; information on the company’s products and services; the routes to market and business partners; access to existing marketing & business plans; aspirations for the business in terms of growth and expansion; projected turnover; available finances; and experience and skills of the current management team and workforce
For what purposes do we use data about you?
When we have undertaken a brief analysis of the business in terms of capability and desire – in conjunction and agreement with you the client – the information we have collected via meetings (face-to-face or on the telephone) and any recommendations are typed on a word document and sent to the key individual for any comments and approval. This will include any recommendations, who is expected to deliver what, what timeframe, and associates fees/expenses.
Who do we share your data with, and for what purposes?
The data we collect and put in a report is firstly shared with the client, to agree the contents. The report containing the data may in some circumstances be distributed to other third parties, but only where written approval has been provided by the client (by email or letter). Third parties may include the client’s bank, representatives from local economic development agencies, approved associates of SMas, and so on. The data is not shared with any non-approved third parties, like marketing agencies or companies that may ‘sell’ your details for promotion purposes. SMas is a reputable consultancy company and we will not share information with non approved third parties
Where might data about you be sent?
The data is initially stored on SMas computers, then transferred to USB format, and eventually deleted when any agreed work has been completed and signed off by the client. SMas does not keep any computerised records. As an additional safeguard, when the contract is terminated, SMas can guarantee that no records of any client are contained on any SMas paper-based systems or digital files.
What rights and options do you have?
Under data protection law you have a right to access information held about you and your company. You can request a copy of your personal/business data from SMas at any time. To exercise any of your rights you can contact us on the details provided below.
Whom should you contact with questions?
If you have any questions about this privacy policy, or wish to exercise any of your rights, please contact Stewart Miller of SMas at stewart@smas.uk
Changes to this privacy policy?
We may update this privacy policy from time to time. We will notify of the changes where required by law to do so.
Fair Work Practices
The directors of SMas are highly ethical individuals who strive to deliver an excellent service for their clients. The team of two consultants (S Miller and L Miller) are both experienced business people, having worked in a number of roles in their careers. Each of them has significant work experience, having travelled all over the world in a work capacity, and also have many years experience as business consultants. They are used to dealing with a number and diversity of clients simultaneously, and understand the importance of developing and maintaining good working relationships.
Any staff or associates contracted by SMas sign contracts to cover areas such as: roles and responsibilities; client confidentiality; anti-slavery policy; expectations including work outputs/targets; fees & expenses; GDPR policy; and standards of business dress & appearance.
The SMas payment standard is to issue invoices on a monthly basis, in arrears. Large contracts may require a payment up front before commencement of work. Where this applies it is always discussed and agreed with any client. Fees are agreed beforehand with clients, including travel and subsistence expenses. Expenses are kept to a minimum where possible. For example, SMas staff when travelling with work try to stay in competitive accommodation, and any meals are often on the move and therefore purchased from supermarkets or similar outlets.
General Data Protection Regulation (GDPR Compliance)
The General Data Protection Regulation (“GDPR”) is the principle piece of legislation governing the handling of personal data in the UK and the European Union and it applies to all handling of personal data between the Client and Stewart Miller associates (SMas).
The data processing provisions below define obligations in relation to compliance with data protection legislation:
1. DEFINITIONS and interpretation
1.1.1 “Agreement” means this service agreement entered into between the Parties;
1.1.2 “Data Protection Legislation” means:
(a) Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) including the recitals (the “GDPR”) and any equivalent or implementing legislation; and
(b) all other applicable laws (including judgments of any relevant court of law) and regulations relating to the processing of personal data, data privacy, electronic communications, marketing and/or data security,
in each case as from time to time in force and as from time to time amended, extended, consolidated, re-enacted, replaced, superseded or otherwise converted, succeeded, modified or incorporated into law and all orders, regulations, statutes, instruments and/or other subordinate legislation (including the provisions of the Data Protection Act 2018 (when in force)) made under any of the above in any jurisdiction from time to time, in each case interpreted in accordance with the DP Guidance, and Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data insofar as such Directive is referred to in any other element of this definition of Data Protection Legislation;
1.1.3 “DP Guidance” means any and all guidelines, recommendations, best practice, opinions, directions, decisions, codes of practice and codes of conduct issued, adopted or approved by the European Commission, the Article 29 Working Party, the European Data Protection Board, the UK’s Information Commissioner’s Office and/or any other supervisory authority or data protection authority from time to time (in each case to the extent legally binding) in relation to the processing of personal data, data privacy, electronic communications, marketing and/or data security;
1.1.4 “Sub-processor” has the meaning given in Clause 2.6.1;
1.1.5 “Personal Data” means the personal data to be processed by or (subject to Clause 2.6) on behalf of SMaS in connection with this Addendum;
1.1.6 “Services” means the services to be provided by SMaS to Customer under the Agreement;
1.1.7 ”controller”, “processor”, “personal data”, “personal data breach”, ”data subject”, and “processing” have the meanings given to these terms in the GDPR interpreted in accordance with the relevant DP Guidance.
1.1.8 references to sub-contracting the processing of personal data include sub-contracting the performance of any Services which may involve the processing of personal data;
1.1.9 general words are not to be given a restrictive meaning because they are followed by examples, and any words introduced by the word “including” or any similar expression are to be construed as illustrative and will not limit the sense of the related general words;
1.1.10 use of the singular includes the plural and vice versa, and use of any gender includes the other genders;
1.1.11 a reference to a Party includes that Party’s personal representatives, successors and permitted assignees;
1.1.12 any reference to a statute, statutory provision or statutory instrument includes a reference to that statute, statutory provision or statutory instrument as from time to time in force and as from time to time amended, replaced, extended, consolidated, re-enacted, superseded or otherwise converted, succeeded, modified or incorporated into law and all orders, regulations, statutes, instruments and/or other subordinate legislation made under any of the above from time to time in force;
1.1.13 a person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality);
1.1.14 a reference to a Clause is to the relevant clause of this Addendum;
1.1.15 any negative obligation of any Party will be construed as if it were also an obligation not to permit the relevant act or thing, and any positive obligation of any Party will be construed as if it were also an obligation to procure that the relevant act or thing be done; and
1.1.16 the headings are included for convenience only and are not intended to affect the interpretation of this Addendum.
2. data processing provisions
2.1 Roles
Each of the Parties acknowledges and agrees that for the purposes of the Data Protection Legislation:
2.1.1 Client (the Customer) is the controller; and
2.1.2 SMas (the Contractor) is the processor
in relation to the processing by SMas of any Personal Data.
2.2 Description of personal data, data subjects and processing etc
2.2.1 The types of Personal Data, categories of data subject to whom it relates, and the subject matter, duration, nature and purposes of the processing to be carried out under this Addendum are set out in Annex A.
2.2.2 If the Customer wishes SMas to process different data and/or for different purposes, it will promptly notify SMas of the proposed changes to this Addendum and will at the same time notify SMas in writing of any amendment to Annex A required to ensure that it remains accurate, up-to-date and complete. If SMas approves the proposed amendment, the then current version of Annex A will be replaced by the amended version as approved by SMas. If SMas and the Customer do not agree the proposed amendment, SMas will continue to process personal data in accordance with the then current version of Annex A.
2.3 SMas obligations in relation to processing Personal Data
SMas will:
2.3.1 in relation to the processing of Personal Data, comply with its obligations under the Data Protection Legislation and ensure the protection of the rights of data subjects;
2.3.2 process (and will procure that its personnel will process) the Personal Data (including the transfer to an international organisation or a country (other than the United Kingdom) outside the European Union) only:
(a) in accordance with the Customer’s written instructions from time to time; or
(b) as otherwise required by law (subject to SMas first notifying the Customer of the relevant legal requirement unless such notification is itself prohibited by law on important grounds of public interest)
and only to the extent and in such a manner as is necessary for SMas to provide the Services and to perform its other obligations under this Addendum in accordance with this Addendum and not for any other purpose;
2.3.3 immediately notify the Customer if SMas (or any of its sub-contractors) believes any of the Customer’s instructions relating to processing Personal Data breaches any Data Protection Legislation;
2.3.4 only disclose the Personal Data to, and ensure that access to the Personal Data is limited to, those of its personnel who are bound by confidentiality obligations in relation to the Personal Data;
2.3.5 not transfer any Personal Data to an international organisation or any country (other than the United Kingdom) outside the European Union without the express prior written consent of the Customer;
2.3.6 implement appropriate technical and organisational measures to ensure a level of security appropriate to the data security risks presented by processing the Personal Data, including the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;
2.3.7 when SMas ceases to provide Services relating to processing pursuant to this Addendum:
(a) at the Customer’s option, delete or return to the Customer all Personal Data; and
(b) delete all copies of the Personal Data except insofar as SMas is required by law to continue to store such copies.
2.4 Information, co-operation and assistance
2.4.1 SMas will take appropriate technical and organisational measures to assist the Customer in fulfilling the Customer’s obligations to respond to any request by any data subject to exercise any data subject right under articles 12-23 inclusive of the GDPR or any equivalent or implementing legislation, in each case only to the extent that the data subject’s request relates to the processing of Personal Data by Seven League pursuant to this Addendum.
2.4.2 SMas will at the Customer’s request assist the Customer in complying with the Customer’s obligations under articles 32-36 inclusive of the GDPR or any equivalent or implementing legislation, in each case only to the extent that the Customer’s request relates to the processing of Personal Data by SMas pursuant to this Addendum.
2.5 Records, audit and inspection
SMas will:
2.5.1 at the Customer’s request, make available to the Customer all information required to demonstrate:
(a) SMas’ compliance with this Addendum;
(b) the compliance by each of its Sub-processors with the agreement between SMas and such Sub-processor referred to in Clause 2.6.3; and
(c) the Customer’s compliance with its obligations under this Addendum and/or with the Data Protection Legislation in relation to the engagement of a processor; and
2.5.2 on reasonable notice during business hours allow the Customer, its statutory or regulatory auditors, and in each case their authorised agents, access to the information referred to in Clause 2.5.1 as the Customer may require in order to verify SMas’ compliance with its obligations in relation to data processing under this Addendum. Unless the Customer has reasonable grounds to believe SMas has committed a material breach of this Clause 2, the Customer may not exercise its audit right more than once in any twelve-month period. The Customer shall use all reasonable endeavours to ensure that the conduct of any audit by the Customer or its authorised agents does not unreasonably disrupt SMas or its business. Any audit by the Customer or its authorised agents will be limited to an audit of the Personal Data and the processes relating to the Personal Data and will not include any information relating to any other customer of SMas or any other third party (other than a Sub-processor).
2.6 Sub-processing
2.6.1 The Customer acknowledges and agrees that SMas may use Sub Contractors (each a Sub-processor) to process any personal data on behalf of the Customer pursuant to this Addendum. The Customer hereby gives its specific written authorisation to SMas to use the Sub-Processors listed in Annex A to process any personal data on behalf of the Customer pursuant to this Addendum. SMas will not appoint any new or replace any Sub-processor without approval from the Customer. The Customer must notify SMas of any objection to such appointment within ten days’ after receiving notice of the proposed appointment from SMas; if the Customer’s objection to the proposed appointment is reasonable, SMas will re-arrange the processing arrangements so that proposed appointee is not used to process personal data or make such other amendment to the terms of this Addendum as the parties, acting reasonably and in good faith agree is appropriate to reflect the change in the sub-processing arrangements.
2.6.2 SMas will ensure that the Sub-processors and any proposed replacement or additional sub-processor provides sufficient guarantees to implement appropriate technical and organisation measures in such a way that its processing will comply with the Data Protection Legislation.
2.6.3 If SMas sub-contracts the processing of any personal data to any third party on behalf (directly or indirectly) of the Customer (including the Sub-processors) SMas will enter into a written agreement with such Sub-processor and include in that agreement at least:
(i) obligations on the Sub-processor which are equivalent to the obligations on SMas in relation to Personal Data under this Addendum;
(ii) obligations on the Sub-processor not to sub-contract the processing of any personal data on behalf (directly or indirectly) of the Customer to any third party without obtaining the prior written consent of each of SMas and the Customer; and
(iii) provisions in favour of the Customer equivalent to those in this Clause 3.
2.6.4 If SMas sub-contracts the processing of any personal data on behalf (directly or indirectly) of the Customer, SMas will not consent to any such Sub-processor further sub-contracting the processing of any personal data on behalf (directly or indirectly) of the Customer without obtaining the Customer’s prior written consent and ensuring that such Sub-processor enters into a written agreement with its sub-sub-processor including provisions equivalent to those in Clauses 2.6.3(i) to 2.6.3(iii) inclusive.
2.6.5 SMas remains fully liable to the Customer for the performance of each of its Sub-processors and their sub-contractors in relation to processing Personal Data.
2.7 Customer obligations in relation to processing Personal Data
2.7.1 The Customer will:
(a) comply with its obligations under the Data Protection Legislation which arise in relation to this Addendum and the receipt of the Services;
(b) not do or omit to do anything which causes SMas to breach any of its obligations under the Data Protection Legislation; and
(c) reimburse SMas for any reasonable costs reasonably incurred by SMas in performing its obligations under Clauses 2.3.7, 2.4.1, 2.4.2, 2.5.1(c) and 2.5.2, in each case except to the extent that such costs were incurred as a result of any breach by SMas of any of its obligations under this Clause 2 or Data Protection Legislation.
2.7.2 The Customer represents, warrants and undertakes to SMas that:
(a) the Customer (and any other sub-contractor of the Customer) has obtained the Personal Data in accordance with the Data Protection Legislation and has provided (or will provide) all necessary notices to data subjects whose personal data comprises part of the Personal Data; and
(b) it has (or will at the required time have) one or more valid grounds for SMas’ (and any Sub-processors and their sub-sub-processors’) processing of the Personal Data in accordance with this Addendum
(c) so that SMas (and any Sub-processors and their sub-sub-processors) processing of the Personal Data in accordance with this Addendum complies with the Data Protection Legislation.
2.8 Cost
Except as expressly provided in Clause 2.7.1(c) each Party will comply with its obligations in this Clause 2 at no additional charge or cost to the other Party.
3. consequential variations to the AGREEMENT
3.1 Any provision of this Addendum that expressly or by implication is intended to come into or continue in force on or after termination or expiry of the Agreement as amended by this Addendum including Clauses 1, 2.3.7 and 3 to 9 shall remain in full force and effect.
4. ENTIRE AGREEMENT
4.1 This Addendum constitutes the entire agreement and understanding between the Parties relating to its subject matter, including any usage or custom and any terms arising through any course of dealing, whether or not in writing, relating to any of such subject matter.
4.2 Each Party acknowledges and agrees that:
4.2.1 in entering into this Addendum it does not rely on (and will have no remedy in respect of) any statement, representation, undertaking or warranty made or given by any person (whether party to this Addendum or not, and whether negligently or innocently made), whether or not in writing, except as expressly set out in this Addendum;
4.2.2 its only remedy in respect of any untrue representation or warranty expressly set out in this Addendum will be for breach of contract;
4.2.3 each Party’s liability under this Addendum will be part of its liability under the Agreement as varied by this Addendum; and
4.2.4 except as provided in Clause 3.1, each Party’s liability under the Agreement as varied by this Addendum will be subject to the same limits and exclusions as its liability under the Agreement.
5. Variation of this addendum
No purported variation of this Addendum will be effective unless it is in writing and signed by or on behalf of each of the Parties.
6. Waiver
No forbearance or delay by either Party in exercising or enforcing any right (and/or the continued performance of the Agreement) will prejudice or restrict the rights of that Party, and no waiver of any right or of any breach of any term of the Agreement as amended by this Addendum will be deemed to be a waiver of any other right or other breach. No single or partial exercise of any right or remedy will restrict the further exercise of that or any other right or remedy. The rights and remedies provided in this Addendum are in addition to and not exclusive of any right or remedy provided by law.
7. Invalidity
To the extent that any provision of this Addendum is found by any court or competent authority to be invalid, unlawful or unenforceable in any jurisdiction, that provision will be deemed not to be part of this Addendum nor will it affect the enforceability of that provision in any other jurisdiction.
8. Third parties
No term of this Addendum is intended to confer a benefit on or to be enforceable by any person who is not a party to this Addendum (whether under the Contracts (Rights of Third Parties) Act 1999 or otherwise).
9. Governing law and jurisdiction
This Addendum (and any non-contractual obligations arising out of or in connection with it and any claim or dispute in relation to its formation) will be governed by and construed in accordance with Scottish law, and each Party irrevocably submits to the exclusive jurisdiction of the Scottish Courts over any claim, dispute or matter arising out of or in connection with it or its formation