On this page
- 01 — Who we are
- 02 — Legal framework
- 03 — Data we collect
- 04 — How we use data
- 05 — Lawful bases
- 06 — Cookies & analytics
- 07 — CrediPulse AI data
- 08 — Sharing & disclosure
- 09 — International transfers
- 10 — Data retention
- 11 — Security
- 12 — Your rights
- 13 — Children's data
- 14 — Changes
- 15 — Contact & complaints
01. Who we are
ACH Consulting Inc ("ACH Consulting", "we", "us", or "our") is a finance and strategy advisory firm based in Barbados, serving small and medium-sized businesses across the Caribbean, and the provider of the CrediPulse AI™ financial-health platform. For the purposes of the Barbados Data Protection Act, 2019 and comparable data-protection legislation, ACH Consulting Inc is the data controller responsible for the personal data described in this policy.
This policy explains what personal data we collect through our website, assessment and checklist tools, contact forms, and the CrediPulse AI platform, how and why we use it, who we share it with, and the rights available to you. If you do not agree with this policy, please do not use our website or services.
02. Legal framework
We are committed to handling personal data lawfully, fairly, and transparently. Our practices are designed to comply with:
- ▹the Barbados Data Protection Act, 2019, and any regulations, guidance, or codes issued by the Data Protection Commissioner of Barbados;
- ▹applicable data-protection and privacy laws of other Caribbean jurisdictions in which our clients operate (for example, Jamaica's Data Protection Act, Trinidad & Tobago's Data Protection Act, and comparable CARICOM-region statutes), to the extent they apply to a given engagement;
- ▹the EU General Data Protection Regulation (GDPR) and the UK GDPR, where we process the personal data of individuals located in the European Economic Area or the United Kingdom.
Across all of these, we apply the same core data-protection principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Where laws differ, we apply the standard that offers the individual the greatest protection.
03. The data we collect
We collect only the data we need for the purposes set out in this policy.
a. Information you give us
- ▹Contact details — name, email address, telephone/WhatsApp number, company name — when you use our contact form, book a consultation, or email us.
- ▹Assessment & checklist responses — business information you enter into the Financial Readiness Assessment or Financial Health Checklist, such as revenue band, team size, years in business, and the software you use.
- ▹Waitlist & marketing preferences — details you provide to join the CrediPulse AI™ waitlist or to receive updates.
- ▹Engagement information — correspondence and documents you share with us during an advisory engagement.
b. Information we collect automatically
- ▹Usage & device data — IP address, browser and device type, pages viewed, referring pages, and interactions, collected through cookies and similar technologies (see Section 06).
c. Information from third parties
- ▹Data from analytics and infrastructure providers, and — only with your explicit authorisation — financial data drawn from accounting or banking systems you connect to CrediPulse AI™ (see Section 07).
We do not seek to collect special-category or sensitive personal data through this website. Please do not submit such data unless we specifically request it for a defined, lawful purpose.
04. How we use your data
We use personal data to:
- ▹respond to enquiries, schedule consultations, and deliver our advisory services;
- ▹generate your assessment or checklist results and provide the resources you request;
- ▹administer the CrediPulse AI™ waitlist and, once live, provide the platform;
- ▹send service and, where you have consented, marketing communications you can opt out of at any time;
- ▹maintain, secure, and improve our website and services, and understand how they are used;
- ▹comply with legal, regulatory, and professional obligations, and to establish or defend legal claims.
05. Our lawful bases for processing
We rely on one or more of the following lawful bases, consistent with the Barbados Data Protection Act, 2019 and the GDPR:
- ▹Consent — where you opt in to marketing, join the waitlist, or connect financial data. You may withdraw consent at any time.
- ▹Performance of a contract — to take steps at your request and to deliver services you have engaged us for.
- ▹Legitimate interests — to run, secure, and improve our business and website, provided your rights do not override those interests.
- ▹Legal obligation — where processing is necessary to comply with applicable law or professional duty.
06. Cookies & analytics
Our website uses cookies and similar technologies. Strictly necessary cookies keep the site working; analytics cookies (including Google Analytics) help us understand and improve how the site is used. We set non-essential cookies only where permitted, and where required we ask for your consent first.
You can control or delete cookies through your browser settings; blocking some cookies may affect how the site works. Analytics data is aggregated and used to improve our services, not to identify you personally.
07. CrediPulse AI™ platform data
CrediPulse AI™ is designed to analyse your business's financial health. Any accounting, banking, or financial data you choose to connect is processed only on your explicit instruction and authorisation, and solely to provide the platform's features to you — including the Financial Health Check Score™, the What-If Simulator™, the Cash Conversion Check (CCC) Tracker™, and the Banker & Lender Readiness Report™.
We do not sell this data, and we do not use it to train models for other customers without your separate, informed consent. You control which sources are connected and may disconnect them and request deletion at any time, subject to legal retention requirements.
08. Sharing & disclosure
We do not sell your personal data. We share it only with:
- ▹Service providers (data processors) — trusted vendors who host our infrastructure, deliver email, process forms, and provide analytics, bound by contract to protect your data and use it only on our instructions.
- ▹Professional advisers — such as legal, accounting, and insurance advisers, where necessary.
- ▹Authorities — where required by law, regulation, or valid legal process, or to protect our rights, safety, or property.
In the event of a business reorganisation, merger, or sale, personal data may be transferred as part of that transaction, subject to this policy.
09. International data transfers
Some of our providers are located outside Barbados and your home country. Where we transfer personal data internationally, we take steps to ensure a comparable level of protection — for example, transferring only to jurisdictions recognised as providing adequate protection, or putting appropriate safeguards in place (such as standard contractual clauses or equivalent contractual protections), consistent with the Barbados Data Protection Act, 2019 and the GDPR.
10. How long we keep data
We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, accounting, regulatory, or professional retention requirements, and to resolve disputes. When data is no longer needed, we securely delete or anonymise it.
11. How we protect your data
We maintain appropriate technical and organisational measures — including encryption in transit, access controls, and the principle of least privilege — to protect personal data against unauthorised access, loss, misuse, or alteration. No system is perfectly secure; if a personal-data breach occurs that is likely to affect your rights, we will act promptly and notify the Data Protection Commissioner and affected individuals where required by law.
12. Your rights
Subject to applicable law, you have the right to:
Ask what data we hold about you and receive a copy.
Have inaccurate or incomplete data corrected.
Ask us to delete data where there is no lawful reason to keep it.
Limit or object to certain processing, including direct marketing.
Receive certain data in a portable format, where applicable.
Withdraw consent at any time, without affecting prior processing.
To exercise any right, contact us using the details in Section 15. We will respond within the timeframe required by law and may need to verify your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.
13. Children's data
Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us and we will delete it.
14. Changes to this policy
We may update this policy from time to time to reflect changes in law, technology, or our practices. The "Last updated" date above shows when it was last revised. Material changes will be highlighted on this page.
15. Contact us & how to complain
For any privacy question, or to exercise your rights, contact our data-protection contact at ACH Consulting Inc:
If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commissioner of Barbados (the supervisory authority for the Barbados Data Protection Act, 2019), or with the data-protection authority in your own country. We ask that you contact us first so we can try to resolve your concern directly.