Privacy Policy

SUF Consulting is the strategic advisory arm of SUF Group. SUF Consulting Inc. is registered in Texas, US, SUF Consulting (Private) Limited is registered in Karachi, Pakistan, and in the UK we are available through SUF Digital UK Ltd.

The entity you deal with decides how and why your personal data is used, and is the controller of it. Questions about any of them can go to connect@sufconsulting.com.

Contact details you give us, such as your name, email address, phone number, company, job title and the message you send through a form or by email.

Business information you share while discussing or running an engagement, such as your organization, systems, goals, processes and the materials you provide for an assessment.

Website usage information, such as pages viewed, referring site, device and browser type, approximate location and the date and time of your visit. We collect this through cookies and similar technology, subject to your choices.

We may also receive business contact details from public sources or professional networks when we reach out about work relevant to your organization.

We use personal data to reply to your enquiries, scope and deliver consulting services, run assessments, send proposals and contracts, manage client relationships and invoice for our work.

We also use it to run and secure the website, understand how it is used, improve our content and services, meet legal obligations and protect our rights.

Where the law requires a legal basis, we rely on your consent, the need to take steps toward or perform a contract with you, our legitimate interest in running and growing a consulting business, or a legal obligation.

Sensitive business information that clients share with us is treated as confidential. We use it only to deliver the agreed work, and we limit access to the people who need it.

The confidentiality terms of your client agreement govern that information and take priority over this policy. Please do not send confidential or regulated data through the website before we have agreed how it will be handled.

Some of our assessments, reports and workflows use AI and other digital tools. Where we run client information through such a tool, we choose tools and settings that fit the sensitivity of the data, and we review the output before it reaches you.

We do not put client confidential information into public AI tools that use inputs to train models. Where an engagement involves AI processing of your data, your agreement describes the tools and terms that apply.

People, not automated systems alone, make the decisions that significantly affect you. If that ever changes, we will tell you and explain your options.

We apply technical and organizational safeguards suited to the sensitivity of the data, including access controls, encrypted connections, restricted internal access and confidentiality obligations on our people.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires.

We share personal data with service providers and technology partners who help us run the business, such as hosting, email, analytics, communication, document and project tools. They may use it only to provide services to us and must protect it.

We may share data with affiliates in the SUF Group, with professional advisers, and with authorities where the law requires it or where we need to protect our rights. If our business is restructured or sold, data may transfer to the successor.

We do not sell personal data.

We work across the United States, the United Kingdom and Pakistan, so your data may be processed in those countries and in others where our providers operate. Those countries may have different data protection laws from your own.

Where the law requires it, we put safeguards in place for these transfers, such as standard contractual clauses or an equivalent mechanism.

Our site uses cookies and similar technology. Necessary cookies keep the site working. Analytics cookies tell us how visitors use it. Marketing cookies help us measure and tailor outreach.

Analytics and marketing cookies stay off until you accept them in our cookie banner. You can change your choice at any time, and you can also block or delete cookies in your browser settings.

We may send you updates, insights and invitations where you have asked for them, where you are an existing client, or where the law allows us to contact you about relevant services.

Every marketing email has an unsubscribe link. You can also write to us, and we will stop. We will still send messages needed to run an active engagement.

We keep personal data only as long as we need it for the purpose we collected it for, to meet legal, tax and accounting duties, and to resolve disputes. Client engagement records are kept for the period your agreement and the law require.

When data is no longer needed, we delete it securely or anonymize it.

Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent you have given.

To use any of these rights, email connect@sufconsulting.com. We may need to confirm who you are first, and we will respond within the time the law sets. You can also complain to your local data protection authority.

We handle personal data in line with the privacy laws that apply to us and to our work, including the EU and UK GDPR where they apply, relevant United States federal and state privacy laws, and applicable data protection requirements in Pakistan.

Our site and services are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16.

We may update this policy as our practices or the law change. We will post the new version here with a new date, and for material changes we will take further steps to tell you, such as an email to clients or a notice on the site.

Identifiers and contact data, such as your name, email address, phone number and company. We hold these to answer you, run engagements and keep business records.

Professional and business data, such as your role, organization and the information you share for an assessment. We hold these to scope and deliver the work.

Technical and usage data, such as IP address, device and browser details and pages visited. We hold these to keep the site secure and understand how it is used.

Communications data, such as emails, call notes and form messages. We hold these as a record of what was discussed and agreed.

We do not ask for sensitive personal data, such as health, biometric or financial account information, through the site, and we ask you not to send it.

During an engagement a client may share data about its own employees, customers or partners. In that case the client decides why that data is used and we act on its instructions under the client agreement.

We use that data only to deliver the agreed work, and we ask clients to share only what the work needs.

Our site may use automated tools, such as spam filters, form handling and analytics, to run and protect it. These tools do not make decisions that have legal or similarly significant effects on you.

If we learn of a security incident that affects your personal data, we investigate it promptly, take steps to contain it and tell you and the relevant authorities where the law requires, with the details we have and the steps you can take.

If you are in the European Economic Area or the United Kingdom, you have the rights listed above under the GDPR and UK GDPR, and you may complain to your local supervisory authority, such as the Information Commissioner's Office in the UK.

If you live in a US state with a privacy law, you may have the right to know what we collect, to delete or correct it, and to opt out of the sale or sharing of your data and of targeted advertising. We do not sell personal data, and we will not treat you worse for using these rights.

If you are in Pakistan, we handle your data in line with the data protection rules that apply there, and you may contact us about any concern.

Browsers offer settings such as Do Not Track and Global Privacy Control. Where the law requires us to honor a signal, we do. Beyond that, our cookie banner is the main way to control tracking on our site.

Our site links to other sites, including SUF Digital and our partners. They have their own privacy practices, and this policy does not cover them. Please read their policies before you share data with them.

If you are unhappy with how we have handled your data, write to connect@sufconsulting.com first. We will look into it and reply. You may also take the matter to your data protection authority at any time.

For any privacy question or request, write to connect@sufconsulting.com.