We, Columbus Holdings UK Limited trading as Rightspend, take the protection of your personal data very seriously and strictly adhere to the rules laid out by data protection laws such as the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).

This privacy notice aims to give you information on how Rightspend as a whole collects and processes your personal data through your use of this site and any data you may provide if you contact or engage with us regarding our products and services.

If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us on [email protected]

Lawful Basis of Processing Personal Information

We only collect and use personal information about you when the law allows us to. We have successfully identified our lawful basis for processing across the business and we use the following: 

  • The data subject (you) has given consent to the processing activity taking place.
  • If the processing is necessary for the performance of a contract 
  • If the processing is necessary for compliance with a legal obligation to which the controller is subject
  • If the processing in necessary for the purpose of the legitimate interest by us or our partners.

Where we may rely on consent

We may like to use your personal data for a variety of different purposes and in that case, we will obtain your prior consent before we do so.

The legal basis of consent is only used by us in relation to processing that is entirely voluntary – it is not used for processing that is necessary or obligatory in any way, including where we are using the information for performance of a contract with you or pursuant to our legitimate interest.

You may at any time withdraw the specific consent you give to our processing your personal data.

Please note even if you withdraw consent for us to use your personal data for a particular purpose, we may continue to rely on other bases to process your personal data for other purposes.

If you have any questions regarding our lawful basis for processing your data, please get in contact.

Contractual or Statutory requirements on you to provide personal data

In certain circumstances the provision of personal data by you is a requirement to comply with the law or a contract, or necessary to enter a contract.

It is your choice as to whether you provide us with your personal data necessary to enter a contract or as part of a contractual requirement. If you do not provide your personal data then the consequences of failing to provide your personal data are that we may not be able to perform our service to the level you expect under our contract with you.  An example of this would be where we are unable to provide you with certain services as we do not have your full details, or where we cannot perform our contract with you at all because we rely on the personal data you provide in order to do so and that information is incorrect. 

What Information do we collect and where from?

We collect personal information from you, for example, if you register to our website, request product information, call us, apply to work for us or use any of our services. The categories of personal information that we may collect, store, and use about you include: Your name and email address

Please note that the examples above are not intended to be exhaustive and represents a description of the kinds of sources of information we rely upon. If you have any questions that the above does not answer, please get in touch and we will be happy to help.

Personal data about other people which you provide to us

If you provide personal data to us about someone else, you must ensure that you are entitled to disclose that personal data to us and that, without our taking any further steps, we may collect, use and disclose that personal data as described in this Privacy Notice.

You must ensure the individual concerned is aware of the various matters detailed in this Privacy Notice, as those matters relate to that individual, including our identity, how to contact us, the way in which we collect and use personal data and our personal data disclosure practices, that individual’s right to obtain access to the personal data and make complaints about the handling of the personal data, and the consequences if the personal data is not provided.

How long do we keep information for?

We will store your personal data for the time that we believe is appropriate in accordance with our data retention policy. 

We keep the length of time that we hold personal data under constant review.  Those reviews take place annually. If you have any questions regarding the retention of your data, please get in touch.

Accuracy of your personal information

It is important that the personal data we hold about you is accurate and current and we take all reasonable precautions to ensure that this is the case but we do not undertake to check or verify the accuracy of personal data provided by you.

Please keep us informed if your personal data changes during your relationship with us by contacting us either via your Rightspend account manager or using [email protected]

We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient, or incomplete personal data that you provide to us or permit us to retain through failing to notify of any changes to your personal information.

Security of personal information

Rightspend is committed to handling your personal information with high standards of information security. We use computer safeguards such as firewalls and data encryption, we enforce physical access controls to our buildings and files, and we authorise access to personal information only for those employees who require it to fulfil their job responsibilities.

At Rightspend we have also ensured that all employees have enough information security training and have a set of data protection policies which helps maintain, enforce, and communicate best practices throughout the business. 

Children’s information

Rightspend does not knowingly collect information on children without consent from a responsible parent. If you are aware that RightSpend have inadvertently collected personal information on a child, please inform us immediately, so we can either remove this or see the appropriate consent information without any undue delay. 

Your individual rights

In this Section, we have summarised the rights that you have under General Data Protection Regulation. Some of the rights are complex, and not all the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights. Please note, not all of these rights are absolute and there are scenarios where your rights may be refused under the appropriate exemptions laid out by the ICO.

Your principal rights under General Data Protection Regulation are:

  • The right to be informed (through this notice)
  • Right to Access
  • Right to Rectification
  • Right to Erasure
  • Right to Restrict Processing
  • Right to Object
  • Right to Data Portability
  • Right to Contest Automated Decision Making (Automated decision making is not carried out by Rightspend)

You have the right to confirmation as to whether we process your personal data and, where we do, access to the personal data, together with certain additional information. That additional information includes details of the purposes of the processing, the categories of personal data concerned and the recipients of the personal data. Providing the rights and freedoms of others are not affected, we will supply to you a copy of your personal data. The first copy will be provided free of charge, but additional copies may be subject to a reasonable fee.

You, as a data subject, have the right to rectification, which will allow you as the data subject to modify/change any personal information to the purpose of ensuring that the information we process is update to date.

The right to erasure or right to be forgotten will allow you as the data subject to inform us that you no longer want Rightspend to continually to store or process your personal information. Please be aware that we may decline your right for several reasons, which are not limited to, having a lawful basis to process your information or us needing your information for the performance of a contractual obligation.

As a data subject, you have the right to stop any processing of your personal information. Please be aware that you must provide us with a legitimate reason for us to stop processing. Any request made that does not conform to the GDPR will be rejected.

On occurrence Rightspend may send you marketing emails to make you aware on new products that we believe can benefit you, the data subject and in situations where you have consented to this activity. As you have the right to object, you can click the unsubscribe link on all our emails to inform us that you no longer want to receive marketing emails from us.

The right to data portability will allow you as the data subject to have your personal information securely transferred to another organisation for processing. At Rightspend we place this reasonability on you that data subject. When you make this request, we will export all information about you and securely transfer it to yourself. You, the data subject will be able to give this information to your chosen organisation.

If you have any question about these rights, please see “additional information” section of this policy.

International transfers

The data that we collect from you may be transferred to, and stored at, a destination outside of the European Economic Area (“EEA”). By submitting your personal data to us, you agree to such transfer, storing or processing.  We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

Right to complain 

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading, or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact us via email on [email protected]

Alternatively, you can make a complaint to the Information Commissioner’s Office:

By Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

By Website: Click Here

By Email: [email protected]

By Phone: 0303 123 1113 (Local rate) or 01625 545 745 (National rate) 

Additional information

Your trust is important to us. That is why we are always available to talk with you at any time and answer any questions concerning how your data is processed. If you have any questions that could not be answered by this privacy policy or if you wish to receive more in-depth information about any topic within it, please contact our Compliance Team via email on [email protected]

Review of this Policy

We keep this Policy under regular review. This Policy was last updated on 10 May 2021


We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.