Privacy Policy
Website: www.CJOMconsultants.com
Privacy enquiries: cjom@cjomconsultants.co.uk
Last updated: 15 August 2026
1. Introduction
CJOM Consultants ("CJOM Consultants", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.
We provide criminal justice support, expert report writing, training, policy advice and advocacy support to individuals and organisations, including, where appropriate, the police, courts, probation services, prisons, local authorities, government bodies, law firms and private clients.
Because of the nature of our work, we may handle personal information relating to individuals involved in criminal justice matters. This can include confidential case information, special category personal data and criminal offence data.
This Privacy Policy explains how we collect, use, store, disclose and protect personal data and your rights in relation to that data.
We seek to comply with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
Where applicable, we will also comply with other laws and regulatory requirements relating to confidentiality, professional obligations and information security.
2. Who We Are
CJOM Consultants is the organisation responsible for the processing of personal data described in this Privacy Policy, except where we are processing personal data solely on behalf of another organisation as a processor.
Organisation: CJOM Consultants
Website: www.CJOMconsultants.com
Privacy contact: cjom@cjomconsultants.co.uk
If you have any questions about this Privacy Policy or how we process personal data, please contact us using the email address above.
3. What Personal Data We May Collect
Depending on the nature of our relationship with you and the services we provide, we may collect and process the following categories of personal data:
Contact and identification information
This may include:
- name;
- address;
- email address;
- telephone number;
- professional title or occupation;
- organisation or employer;
- other information necessary to identify or communicate with you.
Client and case information
Where relevant to our services, we may process information concerning:
- current or previous criminal justice proceedings;
- allegations, offences and convictions;
- court proceedings and outcomes;
- probation or prison matters;
- police or law enforcement interactions;
- witness or victim information;
- legal or advocacy matters;
- case histories;
- statements and reports;
- correspondence;
- professional assessments;
- information supplied by solicitors, public authorities or other professionals; and
- other information necessary to provide our services.
Special category data
Depending on the circumstances of a case, we may process special category personal data, such as information concerning:
- physical or mental health;
- disability;
- racial or ethnic origin;
- religious or philosophical beliefs;
- biometric information, where applicable; or
- other categories of information defined as special category data under UK GDPR.
We will only process special category data where an appropriate legal condition under UK data protection law applies.
Criminal offence data
Because of the nature of our services, we may process information concerning:
- alleged offences;
- criminal convictions;
- criminal proceedings;
- sentencing;
- cautions or other criminal justice information;
- investigations;
- related security measures; and
- other information falling within the definition of criminal offence data.
Criminal offence data is subject to additional legal requirements under Article 10 UK GDPR and the Data Protection Act 2018. We will only process such information where the applicable requirements and conditions under UK data protection law are satisfied.
4. How We Collect Personal Data
We may obtain personal data:
- directly from you;
- from your representative, solicitor or legal adviser;
- from a client organisation;
- from police or other law enforcement bodies;
- from courts, tribunals or justice-sector organisations;
- from probation or prison services;
- from local authorities or government bodies;
- from professional advisers;
- from witnesses or other individuals involved in a matter;
- from publicly available sources, where appropriate;
- from documents and records provided to us;
- through correspondence, telephone calls, meetings or consultations;
- through our website or online forms; and
- from third-party service providers supporting our business operations.
Where we receive personal data from another organisation, we will seek to ensure that the information is processed lawfully and transparently.
Where required by law, we will provide appropriate privacy information to individuals whose data we obtain from another source.
5. Why We Use Personal Data
We may process personal data for the following purposes:
- providing criminal justice consultancy and support services;
- preparing expert reports and other professional reports;
- providing training and educational services;
- providing policy advice;
- providing advocacy support;
- assisting clients with criminal justice-related matters;
- communicating with clients and professional contacts;
- managing enquiries and potential engagements;
- carrying out contractual obligations;
- complying with legal and regulatory obligations;
- maintaining appropriate business and financial records;
- protecting our business, clients and information systems;
- managing professional relationships;
- investigating or responding to complaints;
- establishing, exercising or defending legal claims;
- preventing fraud, misuse or unlawful activity;
- maintaining appropriate records for accountability purposes; and
- administering and improving our website and services.
We will not use personal data for purposes that are incompatible with the purpose for which it was originally collected unless permitted or required by law.
6. Our Lawful Bases for Processing Personal Data
Under the UK GDPR, we will only process personal data where we have a lawful basis for doing so. Depending on the circumstances, our lawful bases may include:
Contract
We may process personal data where it is necessary to enter into or perform a contract with you.
For example, this may apply when providing consultancy, report-writing, training or other services.
Legal obligation
We may process personal data where processing is necessary for us to comply with a legal obligation.
Legitimate interests
We may process personal data where necessary for our legitimate interests, or those of a third party, provided those interests are not overridden by the individual's rights and interests.
Our legitimate interests may include:
- operating and managing CJOM Consultants;
- providing and improving our services;
- communicating with clients and professional contacts;
- maintaining appropriate business records;
- managing risks;
- protecting our business and information systems;
- establishing or defending legal claims; and
- maintaining professional and operational security.
Where we rely on legitimate interests, we will consider whether the processing is necessary and proportionate and whether an individual's interests, rights or freedoms override our legitimate interests.
Consent
Where appropriate, we may rely on your consent to process personal data. Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before consent was withdrawn.
7. Special Category Data
Special category personal data receives additional protection under the UK GDPR.
Where we process special category data, we will ensure that both:
1. an Article 6 lawful basis exists; and
2. an applicable condition under Article 9 UK GDPR and/or the Data Protection Act 2018 applies.
Depending on the circumstances, this may include processing necessary for employment, legal claims, substantial public interest or other circumstances permitted by UK data protection law.
We will only process such information to the extent that it is necessary and appropriate for the relevant purpose.
8. Criminal Offence Data
Criminal offence data is particularly sensitive and is subject to additional safeguards.
Where our work requires us to process criminal offence data, we will comply with Article 10 UK GDPR and the applicable requirements of the Data Protection Act 2018. This may include information relating to alleged offences, criminal convictions, proceedings, sentencing and related matters.
We will only process criminal offence data where we have an appropriate UK GDPR lawful basis and the additional legal requirements applicable to criminal offence data have been satisfied. We will take appropriate measures to restrict access to criminal offence information to people who need it for legitimate business or service-related purposes.
9. Confidentiality and Case Information
We understand that information provided to us in connection with criminal justice matters can be highly confidential.
We will take reasonable and appropriate measures to protect confidential information and will only disclose it where:
- disclosure is necessary to provide our services;
- you have authorised disclosure;
- disclosure is necessary to comply with a legal or regulatory obligation;
- disclosure is necessary to establish, exercise or defend legal rights;
- disclosure is necessary to protect someone's vital interests where legally permitted; or
- disclosure is otherwise permitted or required by law.
Where we work for an organisation such as a law firm, public authority or other client, the organisation may determine the purposes and means of processing certain personal data. In those circumstances, CJOM Consultants may act as a data processor or another form of service provider rather than as the independent data controller.
The respective responsibilities will depend on the nature of the engagement.
10. Who We May Share Personal Data With
Depending on the nature of our work, we may share relevant personal data with:
- clients and authorised representatives;
- solicitors and law firms;
- courts and tribunals;
- police and law enforcement organisations;
- probation services;
- prisons and custodial organisations;
- local authorities;
- government departments and agencies;
- professional advisers;
- experts and consultants working on a matter;
- insurers;
- accountants and financial advisers;
- IT, hosting and software service providers;
- legal or regulatory authorities where required;
- our professional or business service providers; and
- other organisations where disclosure is necessary, lawful and proportionate.
We will seek to limit disclosures to information that is relevant and necessary for the particular purpose.
We do not sell personal data.
11. Third-Party Service Providers
We use third-party providers to support the operation of our business. These may include providers of:
- email and communications services;
- cloud storage and document management;
- website hosting and domain services;
- business administration services;
- company formation and corporate administration services;
- accounting and financial services;
- IT and cybersecurity services; and
- other essential business systems.
Our current or anticipated providers include Microsoft 365/Outlook, GoDaddy and company formation/business administration providers.
Third-party providers may process personal data on our behalf. Where applicable, we will take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are in place.
12. International Transfers
Some of our service providers may process or store personal data outside the United Kingdom. Where personal data is transferred outside the UK, we will ensure that the transfer is carried out in accordance with applicable UK data protection law.
Depending on the circumstances, this may involve:
- a UK adequacy regulation;
- appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum;
- appropriate contractual protections; or
- another lawful transfer mechanism recognised under UK data protection law.
Where required, we will provide further information concerning relevant international transfers and safeguards.
13. How We Protect Personal Data
We take the security of personal data seriously. We use appropriate technical and organisational measures designed to protect personal data against:
- unauthorised access;
- accidental loss;
- destruction;
- alteration;
- inappropriate disclosure;
- misuse; and
- other unlawful or unauthorised processing.
Depending on the circumstances, our safeguards may include:
- access controls;
- password protection;
- secure email and cloud services;
- restricted access to case information;
- appropriate authentication measures;
- secure storage;
- confidentiality obligations;
- staff awareness and training;
- appropriate backup arrangements; and
- procedures for identifying and responding to data security incidents.
No electronic transmission or storage system can be guaranteed to be completely secure. However, we will take reasonable steps appropriate to the risks associated with the information we process.
14. Data Retention
We will retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to:
- provide our services;
- comply with legal and regulatory obligations;
- maintain appropriate professional and business records;
- resolve disputes;
- establish, exercise or defend legal claims; and
- meet legitimate business requirements.
Retention periods will depend on the nature of the information and the circumstances of the engagement.
For sensitive case information, we will seek to ensure that information is not retained longer than necessary.
When personal data is no longer required, we will take reasonable steps to securely delete or dispose of it, subject to any legal, regulatory, contractual or legitimate requirement to retain it.
15. Your Data Protection Rights
Subject to applicable legal conditions and exemptions, you may have the following rights under UK data protection law:
Right of access
You may request a copy of the personal data we hold about you.
Right to rectification
You may ask us to correct inaccurate or incomplete personal data.
Right to erasure
In certain circumstances, you may ask us to delete your personal data. This is right is not absolute and may not apply where we have a lawful reason to continue processing the information.
Right to restrict processing
In certain circumstances, you may ask us to restrict the processing of your personal data.
Right to object
You may have the right to object to certain processing, including processing based on legitimate interests. Where applicable, we will clearly explain your right to object.
Right to data portability
In certain circumstances, you may have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and to request its transmission to another organisation.
Right to withdraw consent
Where processing is based on consent, you may withdraw your consent at any time.
These rights are subject to certain conditions and exemptions under UK data protection law. In particular, rights may be restricted in certain circumstances involving legal proceedings, legal professional obligations, regulatory requirements, crime prevention or other matters.
16. How to Exercise Your Rights
To exercise your rights or ask questions about how we process your personal data, please contact:
Email: cjom@cjomconsultants.co.uk
Please provide sufficient information to allow us to identify you and understand your request. We may need to request additional information to verify your identity before responding to a request.
We will normally respond to valid requests within the time period required by applicable data protection law.
17. Information Obtained From Third Parties
Where we obtain personal data about an individual from another organisation or source, rather than directly from that individual, we may process information such as:
- identity and contact information;
- case and professional information;
- criminal justice information;
- special category information;
- criminal offence information; and
- information contained within reports, statements, records or correspondence.
The source of the information may include clients, legal representatives, public authorities, justice-sector organisations, professional advisers, witnesses, publicly available sources or other persons involved in the relevant matter.
Where required by law, we will provide the individual with appropriate privacy information.
18. Automated Decision-Making and Profiling
CJOM Consultants does not currently intend to make decisions about individuals based solely on automated processing or profiling that produce legal or similarly significant effects.
If this changes, we will update this Privacy Policy and provide any information required by applicable data protection law.
19. Website and Cookies
Our website may use cookies and similar technologies to enable the website to operate, understand how it is used and, where applicable, improve the user experience.
Where non-essential cookies or similar technologies require consent, we will seek consent in accordance with applicable law.
Our website may also contain links to third-party websites. We are not responsible for the privacy practices or content of external websites.
Where appropriate, we may publish a separate Cookie Policy explaining the cookies and similar technologies used on our website.
20. Marketing Communications
We may use contact information to communicate with clients, prospective clients and professional contacts about our services where this is lawful.
Where consent is required for electronic marketing, we will obtain the appropriate consent.
You can ask us to stop sending marketing communications at any time by contacting us at: cjom@cjomconsultants.co.uk
21. Data Breaches
If we become aware of a personal data breach, we will assess the incident and take appropriate action in accordance with applicable data protection law.
Where legally required, we will notify the Information Commissioner's Office (ICO) and/or affected individuals.
We will also take reasonable steps to contain, investigate and remediate the incident.
22. Complaints
If you have concerns about how CJOM Consultants has handled your personal data, we encourage you to contact us first so that we have an opportunity to investigate and address your concerns.
You can contact us at:
Email: cjom@cjomconsultants.co.uk
You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).
The ICO's website provides information about making a data protection complaint and your rights.
23. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- changes to our services;
- changes to how we process personal data;
- changes to technology;
- changes to applicable legislation or regulatory requirements; or
- changes to guidance from the ICO or other relevant authorities.
The latest version will be published on our website.
We recommend that you review this Privacy Policy periodically.
24. Contact Us
If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how your personal data is being processed, please contact:
CJOM Consultants
Privacy enquiries:
cjom@cjomconsultants.co.uk
Website:
CJOMconsultants.com
Policy version: 1.0
Last updated: 15 August 2026