How 2040 uses your data

2040 Training Limited is a limited company registered in England. The controller of any personal data that relates to you is therefore the company. However, 2040 has a single director, Tim Turner, so for all practical purposes, you will be dealing with me. 2040 Training provides training and consultancy services, and so data processed in these contexts are the company’s responsibility. Any interactions you have with Tim Turner outside the business activities of the company are not the responsibility of 2040 Training and are not covered by this notice. The dude who made a SAR for my Twitter DMs didn’t get them and if he complained to the ICO like he said he was going to, they never got in touch.

Personal data is processed on the basis of 2040 Training’s legitimate interest in making money and for tax reasons.

The specific purposes for which your data will be used will depend why you contacted 2040.

Client work: Personal data is used for carrying out requested work under 2040’s legitimate interests in making money, and for the purpose of paying tax, under 2040’s legal obligations to do so. Personal data will be retained under the legal obligation to pay UK taxes if personal data appears on invoices. If you do not wish personal data relating to you and your colleagues to appear on invoices, please indicate this at the time of booking.

Mailing list: the purpose of processing your data is to send you a limited number of emails promoting 2040 training courses and other products.

FOI Five: your email address will be used to send you the FOI newsletter once a month.

Enquiries: if you contact me about a course or ask a question, your data will be processed under legitimate interests to deal with whatever you contacted me about.

Booking and running training courses: your data will be processed under legitimate interests to deliver courses in line with your booking, invoice you and chase debts if you do not pay your invoice. Please pay your invoice.

Blocklist: people and organisations who don’t pay debts to 2040 will be put on a blocklist under the company’s legitimate interest in not dealing with such people. The blocklist will be used to ensure that any future bookings from those people are cancelled immediately. You will be informed directly if you are placed on the blocklist. There is no procedure to be removed. You can attempt to exercise your right to erasure from the blocklist, but mate, I’ll just put your name on the dartboard.

Blogs: your data may be processed for the purpose of researching and publishing blog posts on the 2040 website. The subjects of these blogs vary, but the lawful basis is 2040’s legitimate interests in commenting of DP, Privacy and FOI issues.

COOKIES: There isn’t a cookie banner because the 2040 website doesn’t use cookies but people ask so I’m telling you. There is some weird Google font nonsense at work because of the WordPress Theme I am using, but I am working on having these expunged.

The main recipients of your data will be the company’s accountants (see below). If circumstances arise where your data might be shared with a third party for any reason beyond tax purposes, 2040 Training will contact you directly.

I use Mailjet to run my mailing list & FOI Five newsletter. I run public courses using GoToWebinar. There is no alternative to this so if you do not wish these organisations to process your data on 2040’s behalf, you can’t be on the lists or attend public courses.

Data relating to you will be deleted after any work is completed and any invoices are paid, unless you consent to for it to be retained, or 2040 has a legal obligation to retain the data. This is likely to involve your name to be retained for seven years for tax purposes, if your name features on any invoices or purchase orders.

Emails and other correspondence are purged after one year. Invoices or other data with your name on will be accessed by 2040’s accountant for the purposes of paying tax and other legal requirements.

Your data will be stored in the UK except where it is used by one of the above processors.

You can exercise any of your data protection rights to 2040 Training.

Your rights are:
  • a right of access to your personal data held by or on behalf of 2040
  • a right to rectify any personal data held by 2040 that you believe is incorrect
  • a right to erase any personal data that 2040 no longer has a legitimate purpose to process
  • a right of access to a machine readable version of your data, as long as you have provided it or 2040 has observed it via your use of a service. This is only applicable to data provided with your consent or under a contract, but I will endeavour to give you a portable version of any of your data should time and technology allow
  • a right to stop 2040 Training Ltd processing any of your data that it does not have a legal or contractual obligation to process
  • a right to prevent any wholly automated decisions involving your data. This right exists, but 2040 does not use any wholly automated decision-making techniques
To exercise any of these rights, please contact 2040 Training does not meet the UK GDPR requirement to appoint a Data Protection Officer, so it does not have one.

You will need to prove your identity before getting access to data that relates to you or to exercise your other rights. You can either provide a proof of ID (copies of which will not be retained) or by providing contextual information that establishes that you are who you say you are.

If you have any concerns about 2040’s handling of your personal data, you can raise these with me (Tim Turner) directly, but you have a right to make a complaint to the Information Commissioner. See their website:

And as you got all the way to the end, here’s a picture of a squirrel: