Privacy and Cookies Policy

Effective date: 1 January 2020
Last updated: 7 January 2026

This single policy explains how Walvius Partners collects, uses, shares and protects personal data. It also describes how we use cookies and similar technologies on our website. It is written in British English and is intended for publication as one page on our website.

1) Who we are (Controller)

Walvius Partners operates this website. Walvius Partners consists of two EU companies that jointly determine the purposes and means of processing personal data:

Walvius Group s.r.o. (Czech Republic) – U půjčovny 953/4, 110 00 Praha 1, Czech Republic.
Walvius & Wierda B.V. (Netherlands) – Reidingweg 15, 9203 KR Drachten, The Netherlands.

For privacy questions, contact info@walvius.partners or write to either address above.

2) Personal data we collect

We collect and process personal data in the following contexts:

Website and contact forms: name, email, subject, message and any information you choose to include. We also collect technical data such as IP address, device, browser type, pages visited and timestamps for security and performance. We store cookie-based preferences and analytics as explained below.
Business communications and engagements: business contact details including name, role, company, email, phone, engagement history, invoices and payment information, meeting notes and contractual documents.
RAISE asset level services: data necessary to deliver asset sustainability services, such as building identifiers, meter and sensor readings, equipment and BMS information and operational logs. Where such data may incidentally contain personal data, we minimise and limit its use to service delivery.
Marketing and events: business contact details for updates, invitations and thought leadership. Where required, consent is requested.
Recruitment: CVs, cover letters and interview notes provided by candidates or recruiters.

We generally process business contact data about professionals rather than consumer data.

3) Sources of personal data

Directly from you via forms, email, phone or meetings.
From your employer or colleagues during business-to-business engagements.
Publicly available sources such as company websites and LinkedIn.
From tools and platforms used to deliver services, where providers act as processors under our instructions.

4) Purposes and legal bases

We process personal data under the UK GDPR and the EU GDPR, where applicable:

Service delivery and contract performance: Article 6(1)(b).
Legitimate interests: Article 6(1)(f).
Consent: Article 6(1)(a).
Legal obligations: Article 6(1)(c).

5) How we share personal data

We may share personal data with the following recipients:

Group entities listed in Section 1 to operate as Walvius Partners.
Independent consultants engaged on specific mandates, acting under confidentiality and data processing agreements.
Processors and service providers supporting delivery and operations, such as secure cloud hosting, collaboration tools, analytics and ESG or built environment platforms used to deliver RAISE.
Professional advisers and authorities, where required by law.

We do not sell personal data.

6) International transfers

We operate within the European Union. If a processor or recipient is located outside the European Economic Area, we apply appropriate safeguards, such as EU Standard Contractual Clauses, and conduct transfer risk assessments where required.

7) Data retention

Enquiries and contact form submissions: up to 24 months.
Contractual and project records: generally 7 to 10 years.
RAISE operational data: for the duration of the engagement and agreed retention periods, then anonymised or deleted.
Recruitment records: typically 6 to 12 months unless extended by consent.

8) Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, object and port your personal data. You can also withdraw consent at any time. You have the right to complain to a supervisory authority, such as the Autoriteit Persoonsgegevens in the Netherlands or the Úřad pro ochranu osobních údajů in the Czech Republic.

9) Cookies and similar technologies

Cookies are small text files that a website stores on your device. We use cookies to operate the site, remember preferences and, with your consent, to analyse traffic and support marketing. You can manage your preferences at any time via the cookie settings link in the website footer.

Strictly necessary cookies: required for core functionality.
Preference cookies: remember your choices.
Analytics cookies: help us improve the site, used only with consent.
Marketing cookies: support professional communications, used only with consent.

10) Security

We implement organisational and technical measures appropriate to risk, including role-based access, encryption in transit, secure configuration, supplier due diligence and monitoring.

11) Children’s data

Our services target professional clients. We do not knowingly collect personal data from children under 16.

12) Changes to this policy

We may update this policy to reflect changes in law or our services. The “Last updated” date will change, and significant changes will be highlighted.