Privacy Policy (SustainCase & FBRH Consultants Ltd)

Effective date: 29 April 2026

  1. Who we are

SustainCase (“we”, “us”, “our”) is owned and operated by FBRH Consultants Ltd, registered in England and Wales, with registered address:

124 City Road, London, EC1V 2NX, United Kingdom

Email: contact@sustaincase.com
Website: www.sustaincase.com

For the purposes of data protection law, FBRH Consultants Ltd is the data controller of your personal data.

This policy applies to:

  • sustaincase.com
  • related websites
  • newsletters and communications
  • training and services provided by FBRH

We process personal data in accordance with:

  • UK GDPR
  • EU GDPR
  • Data Protection Act 2018
  • Privacy and Electronic Communications Regulations

 

  1. The value exchange (how our service works)

We provide free access to case studies, articles, and insights on sustainability.

In return, we may:

  • collect your contact details
  • send you newsletters, insights, and information about FBRH services (including training and assurance)

We are transparent about this exchange so you can make an informed choice.

 

  1. What personal data we collect

We may collect:

Information you provide:

  • Name
  • Email address
  • Company name
  • Job title
  • Phone number (if provided)
  • Any information you submit via forms or emails

Information collected automatically:

  • IP address
  • Device and browser information
  • Website usage data (e.g. pages visited, links clicked)

Email engagement data:

  • Whether emails are opened
  • Links clicked

This helps us improve relevance and effectiveness.

 

  1. How we use your data (and lawful basis)

We process your data for the following purposes:

a. Provide access to content and services

Lawful basis: Contract / Legitimate interest

b. Send newsletters and insights

Lawful basis: Consent or Legitimate interest

c. Promote FBRH services (training, assurance, programmes)

Lawful basis: Legitimate interest or Consent

We only send communications we reasonably believe are relevant to your professional interests.

d. Improve our services and content

Lawful basis: Legitimate interest

e. Administer training and certification

f. Lawful basis: Contract

 

  1. Sharing your data

We do not sell your personal data.

We may share your data with:

a. Service providers (processors)

    • Email platforms
    • Website hosting providers
    • Payment processors

These providers:

    • act under our instructions
    • are contractually bound to protect your data
    1. Certification bodies (where applicable)
    • GRI, ISEP, CPD (or equivalent)

b. Strategic partners (only with your explicit consent)

We will only share your personal data with partners (e.g. universities or training providers) where:

    • you have clearly opted in, and
    • you understand who will contact you and why

c. Legal obligations

Where required by law or regulatory authorities

 

  1. International users and data transfers

We operate internationally and may process personal data of users located in different jurisdictions.

We process personal data in accordance with applicable data protection laws depending on your location, including:

  • UK GDPR
  • EU GDPR

Where personal data is transferred outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place, including:

  • adequacy decisions, or
  • Standard Contractual Clauses (SCCs)

 

  1. Data retention

We retain your data only as long as necessary:

  • Newsletter subscribers: until you unsubscribe
  • Clients / training participants: as required for service delivery and legal obligations
  • Analytics data: retained in line with platform settings

We periodically review and delete data that is no longer required.

 

  1. Your rights

Under applicable data protection laws, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion
  • Restrict processing
  • Object to processing (including marketing)
  • Data portability
  • Withdraw consent at any time

You also have the right to lodge a complaint with the:

  • Information Commissioner’s Office

 

  1. Additional rights for US users

If you are a resident of certain US states (such as California), you may have additional rights under applicable laws, including:

  • The right to know what personal data we collect and how it is used
  • The right to request deletion of your personal data
  • The right to opt out of the “sale” or “sharing” of personal data

We confirm that:

We do not sell your personal data.

If you wish to exercise any of these rights, please contact us using the details below.

 

  1. Marketing and your choices

You will only receive marketing communications if:

  • you have opted in, or
  • we have a legitimate interest and you have not opted out

You can:

  • unsubscribe at any time via email links
  • contact us to stop communications

We act promptly on all requests.

 

  1. Cookies and tracking

We use cookies and similar technologies to:

  • ensure website functionality
  • analyse usage
  • improve user experience

Where required, we obtain your consent before placing non-essential cookies.

You can manage your preferences via our cookie banner.

 

  1. Data security

We implement appropriate technical and organisational measures to protect your data, including:

  • secure systems and restricted access
  • encryption where appropriate
  • regular review of security practices

 

  1. Third-party links

Our website may contain links to third-party websites.
We are not responsible for their privacy practices.

 

  1. Changes to this policy

We may update this policy from time to time.

Where changes are significant, we will:

  • notify users where appropriate
  • update the effective date

 

  1. Contact us

If you have any questions or wish to exercise your rights:

Email: contact@sustaincase.com