Privacy notice

Carthage Risk Consulting, an independent risk, resilience and continuity advisory firm based in Tunis, Tunisia, is the controller of the personal information described here. Company registration in Tunisia is in progress and the registered particulars will be added to this notice on completion.

Write to info@carthageriskconsulting.com on any question about this notice or to exercise any right described in it. We answer within one business day and complete substantive requests within thirty days.

Enquiries. When you write to us or complete the enquiry form we hold your name, email address, any telephone number you choose to give, the country or city of the matter, the introduction route if you name one, and what you tell us about the matter itself. We use it to answer you, to judge whether we are the right firm for the work, and to run the conflict and acceptance checks any advisory firm must run before taking instructions. Our basis is our legitimate interest in responding to an approach made to us, and in Tunisia your submission of the enquiry is the consent required by Organic Law No. 2004-63.

Engagements. If you engage us we hold the contract and its correspondence, the names and roles of the people we deal with, billing details, and the material gathered for the assessment itself. Our basis is the performance of that contract and, for records we must keep afterwards, our legal obligation to keep them.

People named in an assessment. An assessment of a property or a household will often record the roles, duties and access held by staff, and sometimes the movements and exposure of a principal and a family. We hold no more than the assessment requires, we record roles rather than individuals wherever a role will do, and we do not seek information about anyone’s health, beliefs, origins, political opinions or union membership. Where a client asks us to consider such a matter, we ask the client to obtain the consent that Tunisian law requires and we record that it was obtained.

We do not buy personal information from data brokers, we do not build profiles of individuals, and we take no automated decision about any person.

An enquiry that does not become an engagement is deleted twelve months after the last exchange. Engagement files are kept for the duration of the engagement and then for ten years, which is the period for which we may need to answer for the advice we gave and to meet Tunisian accounting and tax requirements. Assessment working material, such as photographs, site notes and drawings, is destroyed on the client’s written instruction, or otherwise twenty-four months after the report is delivered. A client may ask for the whole file to be returned or destroyed at any time and we will confirm in writing when it is done, keeping only the minimum record of the engagement itself.

Nobody, in the ordinary course. We do not sell personal information, we do not share it for advertising, and we do not pass a client’s name to anybody as a reference without written permission.

Three exceptions. We use a business email and document service to correspond and to store files, and that provider processes information on our written instruction alone. We may instruct a specialist, such as an engineer, a lawyer or a translator, where an engagement needs one, always under a confidentiality obligation and, where the client has reserved it, with the client’s prior approval. And we disclose where a court or a competent authority lawfully requires it, in which case we tell the client unless we are forbidden to.

We work from Tunisia for clients who are largely in Europe, so information moves in both directions and we would rather be exact about it than vague.

Tunisia has not been the subject of an adequacy decision by the European Commission. Where you are in the European Economic Area or the United Kingdom and personal information reaches us here, the transfer therefore rests on the European Commission’s standard contractual clauses, which we enter into as part of our engagement documents, together with a transfer assessment and the practical measures set out under security below. Tunisia has been a party to the Council of Europe’s Convention 108 on the protection of individuals with regard to automatic processing of personal data since 1 November 2017 (Council of Europe), and its domestic regime is Organic Law No. 2004-63 of 27 July 2004, supervised by the Instance Nationale de Protection des Données Personnelles.

In the other direction, Tunisian law is strict: Article 52 of Organic Law No. 2004-63 requires the prior authorisation of the Instance for any transfer of personal data out of Tunisia, in every case, and an unauthorised transfer is a criminal offence under Article 90 (DLA Piper). We therefore keep engagement material in Tunisia, we make the declarations and seek the authorisations the law requires of us, and where a client needs a report or a file sent abroad we address the authorisation before anything moves. This is a real constraint on how quickly material can be sent out of the country and we would rather a client hears it from us at the outset.

Reports and assessment material are held encrypted, on named devices, with full-disk encryption and multi-factor authentication on every account that can reach them. Access is limited to the people working on the engagement. A secure channel is provided for exchanging documents once an enquiry is accepted; we ask that confidential material is never sent to the general enquiry address. Site photographs and drawings are stripped of location metadata before filing. Paper is held in a locked cabinet and cross-cut shredded on destruction. Everyone who works on an engagement is under a written confidentiality obligation that survives it.

If a breach occurs that is likely to affect you, we will tell you and the competent authority without undue delay, and we will tell you what we know rather than wait until we know everything.

Under the General Data Protection Regulation, where it applies to you, you may ask for a copy of the information we hold about you, ask us to correct it or complete it, ask us to delete it, ask us to restrict what we do with it, object to our relying on legitimate interest, ask for it in a portable form, and withdraw a consent you have given. You may complain to the supervisory authority in your country of residence.

Under Organic Law No. 2004-63 you hold rights of access, rectification and objection, and you may complain to the Instance Nationale de Protection des Données Personnelles in Tunis (INPDP).

Ask by email and we will not make it difficult. We may need to satisfy ourselves who you are before we release anything, which is a protection for you rather than an obstacle. One limit applies honestly: where information about you sits inside a client’s confidential assessment, we may be obliged to consult that client and to withhold the parts that would disclose their confidential affairs, and we will tell you when that is what we are doing.

This website sets no cookies and carries no analytics, advertising or tracking of any kind. The enquiry form does not transmit anything by itself; it prepares a message in your own email program, which you then choose to send. Two font services are requested from your browser, and the hosting provider keeps ordinary server logs. The cookie notice sets out both.