CP Data Protection Terms & Conditions
Last updated October 2025
Introduction
‘CP Data Protection®’ is a trading name of ‘Clare Paterson Ltd’, who owns and runs this ‘Website’ (www.cpdataprotection.com)
These ‘Terms and Conditions’ apply to your use of this Website and any of the ‘Services’ (free-of-charge and charged-for consultancy, training, documents, templates, and any other support) provided to ‘Clients’ by CP Data Protection or any other trading name or style of ‘Clare Paterson Ltd’, including but not limited to ‘DiSH’, ‘Data in Social Housing’, ‘Data in Safe Hands’, ‘The Hive Online’, ‘The Hive Live’, ‘The Hive Insights’.
We provide expert consultancy on data protection and information management, helping organisations navigate legal and regulatory requirements with confidence. While we offer guidance on the interpretation and application of relevant laws, we do not provide formal legal advice or legal representation. Our approach focuses on practical solutions, strategic insights, and compliance best practices to help organisations fulfil their obligations effectively.
If you engage CP Data Protection to undertake a significant piece of consultancy work, especially if the work is likely to involve acting as a Processor on your behalf of any Personal Data, we may ask you to sign a Consultancy Agreement. If there is any conflict between these T&Cs and the Consultancy Agreement, the Consultancy Agreement takes precedent over these T&Cs.
Our company details are:
| Registered Address: | 41 Wolverhampton Road, Codsall, Wolverhampton, WV8 1PT |
| Company No: | 10814591 Registered in England |
| Email: | Clare Paterson, director; Clare@cpdataprotection.com |
| Sue Penny, customer service; Sue@cpdataprotection.com | |
| VAT Registration No: | 279688619 |
| ICO Registration No: | ZA265049 |
If you have any queries about these Terms or anything related to this Website or the Services, you can contact our director, Clare Paterson, using the above contact details.
Your use of this website and our Services is subject to these Terms and Conditions. We may alter or vary them from time to time and the changes will take effect as soon as they are posted on this website.
Content of this Website & of the Services
Copyright materials on this Website and the materials provided as part of our free and paid-for Services are owned by Clare Paterson Ltd T/A CP Data Protection® unless otherwise stated. Unauthorised use of the material without the prior written consent of Clare Paterson Ltd or, where applicable, the respective copyright owner(s) is prohibited.
The information on this Website and provided in our training, events, or membership is for general information purposes only and does not claim to be or provide legal advice. If you require bespoke advice on specific issues please contact us so we can assess how best to help you.
We provide both free and paid-for Services, including consultancy, training, events and a membership network, to support organisations regarding Data Protection related work and compliance; for the avoidance of doubt, CPDP is a specialist consultancy and training provider, not a law firm and as such, while we provide advice based on the law, it is not protected by Legal Professional Privilege.
CP Data Protection has taken all reasonable steps to ensure that the information on this Website and provided in our Services is accurate and current at time of publishing and we may make changes to the information we provide, without prior notice.
The information and content on this Website may become out of date and CP Data Protection accepts no responsibility for any losses or damages arising out of errors or omissions contained in the Website or arising from reliance on information contained in the Website.
Confidential Information
CP Data Protection will keep all Client Confidential Information secret and not disclose it without written consent of the Client, unless required to do so by law. Confidential Information includes secret or confidential commercial, financial or technical information, data, knowhow, trade secrets, inventions, software and other information, in any format.
The only exceptions are when any piece of information; is already in or later enters the public domain (other than as a breach of this undertaking), or was already known to CP Data Protection prior to disclosure by the Client, or is disclosed to CP Data Protection independently by a third party entitled to disclose it.
For the purposes of providing the Services, Clare Paterson Ltd T/A CP Data Protection may make available to the Client, documentation and guidance which are Clare Paterson Ltd’s information including its Confidential Information. Clare Paterson Ltd asserts and retains Copyright and all Intellectual Property rights over that information and the Client is licensed to use the information for its own purposes only, and shall not reproduce, copy, sell or otherwise share the information without prior written approval from Clare Paterson Ltd.
As part of the Services, including as a member or training or event attendee, Clients may share, and be privy to, Confidential Information relating to themselves and/or organisations they have or had a connection with. Clients are required to treat any such information as strictly confidential and follow our rules of conduct when interacting with others as part of the Service, which are:
Be kind and respectful (even during debates!)
No hate speech or bullying of any kind.
No spam, selling to, or attempting to sell to, other Clients or attendees, unless with prior written consent.
And finally, respect everyone’s privacy (of course!)
Data Protection and Processing
Personal Data and other phrases that relate to data protection are given the meaning in the Data Protection Legislation (all laws that CP Data Protection or you are subject to that relate to the Processing of Personal Data or to privacy.)
If you submit your own personal data to CP Data Protection via this Website, email, or any other contact method, our use of your data is covered by our Privacy Notice.
If you provide any other Personal Data to us as part of us providing you with a free or charged-for Service so that we can Process that data on your behalf, for example Personal Data about your clients or employees so we can assist you with a data protection query, we are acting as a Data Processor on your behalf and you guarantee that you have the necessary legal basis to Process that Personal Data.
When acting as your Data Processor, CP Data Protection will: Process the Data only on your documented instructions unless required to do otherwise by law; handle the Data as confidential; engage Sub-Processors as necessary but only with the legally required controls in place; assist the Data Controller as far as possible with responding to requests from Data Subjects related to their Data; use appropriate security measures; make available to the Controller reasonably requested information to demonstrate compliance with our legal Data Protection obligations and submit to reasonable audits and reviews; at the choice of the Controller delete or return all Personal Data when requested unless we have a legal basis to retain it. See the Data Processing Clause that applies whenever we are acting as a Data Processor.
For the avoidance of doubt, CP Data Protection is a Data Controller for other Personal Data obtained and handled as part of providing our free and charged-for Services, including information about clients, prospective clients, other stakeholders and business contacts, where we are Processing that Data for our own purposes, and not on the instructions of a client.
Bookings & Payments
VAT is payable to CP Data Protection and the VAT amount will be added at invoice stage for most Services including training bookings and consultancy work. VAT is included in the price displayed for purchases made directly via this website, including Memberships.
Unless otherwise noted and agreed, payment terms are 7 days of receipt of an invoice. Invoices are emailed via Xero. We may exercise the statutory right to claim interest (at 8% over the Bank of England base rate) and compensation for debt recovery costs under the Late Payment legislation, if payment is not paid according to these terms.
The default payment method for most of the Services – where an invoice is raised – is direct bank transfer but the Client can request the functionality to pay via credit card or debit card. If a request is made, CP Data Protection will provide an invoice with links to pay via the credit/debit payment processor Stripe.
Toolkits, Templates & Similar
Purchases made via this Website’s shop, including for online Toolkits and Templates – but not Memberships – can be paid by either direct bank transfer or by credit card or debit card (via Stripe, or via Apple or Google Pay where available). A receipt is emailed automatically for payments made by credit or debit card. An invoice is not automatically raised for purchases made this way, but can be raised and provided for your records upon request by the Client.
When payment has been made for an online Toolkit, you will you will receive access to set up an account on this website. Each account is intended for only one person, and only that one person is permitted to have direct access to the account and its contents, unless consent is given in writing by CP Data Protection. We will not unreasonably withhold our consent.
When you purchase an online Toolkit or Template or join a membership or programme you receive a non-commercial license for the documents provided. This means you may adapt the documents as required or use them exactly as they are, and you may use them for your own use and your employer’s use. You are not permitted to share or sell the documents in any form without the written permission of the copyright holder – CP Data Protection® – and doing so could result in legal action. We will not withhold permission for reasonable requests although we will usually charge a fee for a commercial license, to be negotiated at the time of request.
Membership Subscriptions
When a membership subscription, including the Data in Social Housing Membership (the ‘DiSH’) is purchased through this website, payment can be made by credit or debit card, which will recur on a monthly basis (or annually for the annual membership) until you cancel. You can cancel by filling in the cancellation form, accessible on the My Account page. If a recurring payment is unpaid for whatever reason, including if a credit/debit card has expired, the subscription will be cancelled after 15 days of non-payment. We may use our discretion to reduce payments for members on a case-by-case basis, and we will not raise prices without at least one month’s notice in writing to members.
When payment has been made for the membership, you will receive access to set up an account on this website. Each membership account is for only one person, and only that one person is permitted to have access to the content, events and community provided by the membership, unless consent is given in writing by CP Data Protection. We will not unreasonably withhold our consent.
Members are expected to act with integrity and in the spirit of community, collaboration, and continued learning and growth. Members will not always agree, but any discussions should be handled with respect and politely at all times. The DiSH is built on trust, respect and confidentiality. Members are required to respect the Intellectual Property rights of CP Data Protection and any other contributors, and to treat everything shared within the group by members and attendees at events as strictly confidential. In a nutshell:
Be kind and respectful (even during debates!)
No hate speech or bullying of any kind.
No spam, selling, or attempting to sell please, unless with prior written consent.
And finally, respect everyone’s privacy (of course!)
CP Data Protection reserves the right to eject any member who breaches these rules, or is otherwise disruptive, without any refund, but future payments will be cancelled.
When you purchase a membership subscription, you receive a non-commercial license for the content and documents provided. This means you may use the content provided within the membership for your own use (including if you are self-employed or a company owner) and for your employer’s use. You are not permitted to share or sell the content in any form without the written permission of the copyright holder – Clare Paterson Ltd T/A CP Data Protection® – and doing so could result in legal action. We will not withhold permission for reasonable requests.
Payment for live events or sessions
For live events (online or in-person), including training sessions, workshops, VIP days, consultancy, or similar, we require payment in full at least 7 days before the session is scheduled to be held, otherwise we reserve the right to postpone the session until 7 days from payment.
General Consultancy
Most work is carried out remotely, but travel costs will be quoted and invoiced if any in-person attendance is requested and agreed.
Ad hoc work is charged on a fixed fee basis quoted in advance, which is our preference, or on an hourly rate, unless otherwise agreed in writing. Project work is charged on a fixed fee basis quoted in advance. Part or full payment may be required in advance, or work may be invoiced soon after completion or after the end of the month. Time is charged by the tenth of an hour (period of 6 minutes), or each part of a tenth of an hour spent on the work. We will provide a total of the time spent on your project, which will be considered conclusive, and we request that you accept this record without requesting additional breakdowns or justifications. This approach helps us maintain efficiency and focus on delivering value to your project.
Payment for General Consultancy and Training Projects
We reserve the right to invoice each project, or discrete phase of a project as appropriate, in advance or – if requested by the Client – in two parts; 50% when the work is agreed and 50% soon after the work has been completed.
Payment for the DPO+ Service
By signing up to the DPO+ Service you get a 12-month partnership for stability, so you know we’ll be there for the long term, with quarterly reviews for flexibility. Every three months, we’ll sit down with you to check whether your package is still the right fit. You can step up to a higher package if you need more support, or re-balance to a lighter package if things have eased. The DPO+ Service is invoiced quarterly in advance, based on your current package level, unless otherwise agreed in writing.
The CP Data Protection Affiliate Programme
For reference, in this section:
- “We/Us/Our” refers to CP Data Protection and our consultancy and toolkit offerings.
- “You/Your” refers to you the affiliate partner.
- “Toolkit(s)” refers to any of our consultancy resources, usually called Toolkits, available for immediate purchase from the CP Data Protection website. It does not include DiSH membership, workshops or live training, or the book ‘A Practical Guide to Data Protection in Social Housing.”
- “Affiliate Programme” means the opportunity to earn commissions by sharing and promoting our toolkits.
The unique affiliate link is at the heart of the system that allows us to identify sales originating from your referrals so we can ensure you receive your rewards. Only sales using the provided affiliate link will lead to a reward payment, and you should make your contacts aware of the tracking and its purpose. Data collected via the tracking link is the minimal needed to manage the sale and referral, and the data is not used for any other purpose.
If anyone objects to using the tracking link but is making a purchase because of your introduction to CP Data Protection, contact Clare@cpdataprotection.com to discuss other ways to share the rewards.
Our current commission rate for affiliate rewards is 20% and we’ll notify you if this changes. Commissions apply to valid sales only, as outlined below, and are calculated based on the price at the time of sale.
Valid sales are made within 30 days of using your referral link and paid for and not refunded/cancelled. One a sale is validated we will email you to request you raise and send us an invoice and we will make payment in the next payment cycle, as long as invoices are received at least 7 days before the payment date. The Payment date is monthly, typically around the 15th of the month for valid sales made the previous month. All payments are made via bank transfer to the details on your invoice, unless we agree otherwise.
To keep things fair and safe, affiliate status may be revoked if any fraudulent, abusive, disruptive, or otherwise unacceptable behavior is detected. We reserve the right to deny or end your participation in the Affiliate Programme if we determine you are not in compliance with these Terms.
Our community relies on trust, so please ensure that all your promotional activities comply with applicable laws, including any advertising, transparency, or data protection regulations (of course!) It is your responsibility to ensure you comply with these laws in your promotional activities.
We’re happy for you to use our brand assets (like logos and product images) when promoting the toolkits, but please remember these are our Intellectual Property, so you are required to only use them responsibly and to stop using them immediately if we instruct you to do so.
We kindly ask that affiliates refrain from promoting direct competitors within the same promotional material that features our toolkits. We trust this won’t be an issue but include it here for clarity.
Any confidential information shared with you as part of the Affiliate Programme, including product details, pricing, and commissions received, should remain confidential unless given express permission to share or they are already in the public domain.
Your agreement to these Terms as an affiliate is effective from your enrollment and remains active unless terminated by either party. Either party can terminate at any time, with or without reason. Upon termination, you’ll no longer be eligible to earn commissions from future referrals unless you reapply and are approved again.
We always aim for trouble-free experiences, but in the event of a disagreement, we’ll work with you to resolve it amicably. If that isn’t possible, disputes will be resolved in accordance with the applicable laws in England.
By becoming an affiliate, you agree to indemnify and hold us harmless against any losses, liabilities, or claims arising out of your promotional efforts. Simply put, if anything goes wrong due to your own actions, you’re responsible for managing it, but we will help if we can of course.
Cancellations & Substitutions
As a company, CP Data Protection may substitute the individuals who provide the Services, including trainers and consultants, without notice where necessary. You can find information about some of the CP Data Protection team on our About page.
The Client may substitute delegates, attendees or main contacts at any point without any fee, unless otherwise included in additional terms of service for any specific service.
When the Client is an Organisation: Organisations can usually cancel an order for CP Data Protection Services within 7 days of placing the order, where placing an order is; booking a place on a training course (by email or via any electronic diary management tools made available by CP Data Protection such as Calendly), or accepting a proposal for consultancy or training, or the DPO+ Service, or agreeing in writing to purchase documents, templates or Toolkits.
These cancellations must be in writing, including email to clare@cpdataprotection.com or sue@cpdataprotection.com.
If an organisation cancels an order within the 7 days’ timescale, any money already paid to CP Data Protection for the order will be refunded in full as soon as possible, and within 30 days of the cancellation at the most.
After the 7 days right-to-cancel period, and up to 14 days before the Service provision, cancellations will receive a refund of between 90% and 50% of any money already paid to CP Data Protection. After the 7 days right-to-cancel period, and if less than 14 days before the Service provision, cancellations will not usually receive a refund, but we can make exceptions in extreme circumstances so please contact us.
Alternatively, we can offer a substitute Service, if appropriate.
An exception to the right to cancel is when delivery of the Service(s) has begun within 7 days of the order being placed, and you had agreed to the Service(s) beginning in that time frame. This will be the case if you place an order for training due to begin within 7 days of your booking or agree to the provision of consultancy work that starts within 7 days of the agreement. The right-to-cancel period ends at the point the Service provision begins.
When the Client is an Individual: For individuals making a personal purchase of any Services such as a membership, or attendance at training or an event, a full refund will be given if attendance is cancelled in writing prior to the Services being provided.
For both Organisations & Individuals: An exception to the right to cancel – for both organisations and individuals – is when purchasing digital downloads including documents and toolkits or on-demand online training; due to the immediate nature of the purchase and delivery, we cannot accept returns or provide refunds so please ask any questions before purchase. If a digital product or Service is faulty we will of course do everything possible to make it right as quickly as we can.
Technical: For content delivered over Microsoft Teams or another remote method as stated in advance, you are responsible for ensuring you can access and use Teams or other stated method, and CP Data Protection is not liable or responsible for any technical issues which you may experience including as a result of your hardware, software, or internet connection, and CP Data Protection is not liable or responsible for any delay, disruption or disturbance in the operation of the internet.
If any Services cannot be provided due to disruption or disturbance in the operation of the internet, or any other causes outside of our control, CP Data Protection will provide the Services at another suitable time. That time will be within 30 days of the original date of Service provision unless otherwise agreed with the Client.
Disclaimers & Warranties
CP Data Protection does not warrant that the functions contained in this Website will be uninterrupted or error free, that defects will be corrected, or that this Website or the server that makes it available are free of viruses.
We are not responsible for the contents or the reliability of linked third-party Websites.
When working at our own premises, CP Data Protection is responsible for its own and its employees’, associates’, and other contacts’ own health and safety. CP Data Protection has in place and will maintain Professional Indemnity Insurance and Public Liability Insurance.
If there is anything about the Services that is not going or has not been as you hoped, or if you have any query or complaint, please speak to us as soon as possible so any problems can be resolved amicably.
Law
These Terms and Conditions shall be governed and construed in accordance with the laws of England. Any disputes arising here shall be exclusively subject to the jurisdiction of the courts of England.
Data Processing Clause
- The Parties acknowledge that for the purposes of the Data Protection Legislation, where the Client is the Controller and CP Data Protection (CPDP) is the Processor when Personal Data is Processed by CPDP when carrying out a task on behalf of the Client both Parties will comply with their obligations under the Data Protection Legislation.
- The Controller must identify a valid lawful basis for any Processing it requires the Processor to carry out on its instructions, and is obliged to respond to any complaint, communication or request made relating to the Processing.
- The only processing that CPDP is authorised to do on behalf of the Client is described below:
- Processing of Personal Data relating to the Client’s internal and external contacts for the purposes of advising on data protection matters.
- The Personal Data could include names, contact details, special categories of data as required, employment details, financial details, contract details, relating to the Client’s employees, customers/clients/members, suppliers, and any data subjects connected to the Client through lawful and transparent interaction with them.
- At the end of the Service provision, or if appropriate, at the end of a specific project, and at the Client’s direction, CPDP will destroy or return all of the Personal Data, unless there is another lawful basis for retaining some or all of the data.
- CPDP shall notify the Client immediately if it considers that any of the Client’s instructions infringe the Data Protection Legislation.CPDP shall provide all reasonable assistance to the Client in the preparation of any Data Protection Impact Assessment required to be undertaken prior to commencing any Processing.
- CPDP shall, in relation to any Personal Data Processed in connection with its obligations under this Agreement:
- process that Personal Data only in accordance with this Agreement, unless CPDP is required to do otherwise by Law. If it is so required CPDP shall promptly notify the Client before processing the Personal Data unless prohibited by Law;
- ensure that it has in place Protective Measures to protect against a Data Loss Event having taken account of the: (i) nature of the data to be protected; (ii) harm that might result from a Data Loss Event; (iii) state of technological development; and (iv) cost of implementing any measures;
- ensure that: (i) CPDP Personnel do not process Personal Data except in accordance with this Agreement; (ii) it takes all reasonable steps to ensure the reliability and integrity of any CPDP Personnel who have access to the Personal Data and ensure that they are subject to appropriate confidentiality undertakings with CPDP and are informed of the confidential nature of the Personal Data; and
- not transfer Personal Data outside of the UK unless appropriate and lawful safeguards are in place in relation to the transfer.
- CPDP shall notify the Client without undue delay if it:
- receives a Data Subject Access Request (or purported Data Subject Access Request), a request to rectify, block or erase any Personal Data, or any other request, complaint or communication relating to either Party’s obligations under the Data Protection Legislation;
- receives any communication from the Information Commissioner or any other regulatory authority in connection with the Personal Data processed under this Agreement; or
- becomes aware of a Data Loss Event.
- CPDP’s obligation to notify shall include the provision of further information to the Client in phases, as details become available.
- Taking into account the nature of the processing, CPDP shall provide the Client with full assistance in relation to either Party’s obligations under Data Protection Legislation and any complaint, communication or request made (and insofar as possible within the timescales reasonably required by the Client) including by promptly providing the Client with: full details and copies of the complaint, communication or request; such assistance as is reasonably requested by the Client to enable the Client to comply with a Data Subject Access Request; at the Client’s request, any Personal Data it holds in relation to a Data Subject; assistance as reasonably requested by the Client following any Data Loss Event; and assistance as reasonably requested by the Client with respect to any request from the Information Commissioner’s Office, or any consultation by the Client with the Information Commissioner’s Office.
- If required by the Data Protection Legislation CPDP shall maintain complete and accurate records and information to demonstrate its compliance with this clause.
- CPDP shall allow for reasonable audits of its Data Processing activity under this Agreement, by the Client or the Client’s designated auditor given reasonable notice.
- CPDP shall appoint any Sub-processor to process any Personal Data related to this Agreement only on the basis of appropriate due-diligence and a written agreement with the Sub-processor which give effect to the terms set out in these Data Protection clauses such that they apply to the Sub-processor.
- CPDP shall remain fully liable for all acts or omissions of any Sub-processor in relation to the Processing under this Agreement.