Privacy & security notice
Written to be read, not to be survived. If anything here is unclear, email [email protected] and a person will answer.
What we collect
Two categories, kept separate at every stage.
Website and enquiry data. Your name, work email, phone number, company and whatever you write in an enquiry form. Plus standard server logs: IP address, browser type, pages visited and referring URL.
Engagement data. For clients, the business records needed to perform the service, such as ledgers, invoices, payroll data and tax documents, accessed under the terms of the signed engagement agreement and the data processing agreement attached to it.
How we use it
- To respond to your enquiry and to arrange and run a scoping session.
- To deliver the services set out in a signed engagement agreement.
- To send the monthly insight brief, only where you have subscribed, with a working unsubscribe link in every message.
- To meet our own legal, tax and audit obligations.
We do not sell personal data, we do not share it with advertising networks, and we do not use client engagement data to train any machine learning model.
Client accounting data
Client data is processed under your instructions as the data controller. Where possible we do not take custody of it at all: our staff are provisioned as users inside your own systems, under your roles and permissions, so the data never leaves your environment.
Where a transfer is unavoidable, it moves over encrypted channels into an access-controlled environment scoped to that single engagement, and is deleted on the schedule set in the engagement agreement.
Security controls
These are the controls we operate. We will document them against your own policy, complete your security questionnaire, and provide our written control documentation under a confidentiality agreement. Where we hold a formal certification we will give you the report itself, including its exceptions section, rather than a badge.
- Endpoints. Virtual desktops with local storage, removable media, printing and clipboard transfer disabled. No personal devices access client systems.
- Premises. Badge controlled floors segregated by client, camera coverage with a documented retention period, no personal phones on the delivery floor.
- Access. Role based and least privilege, reviewed on a fixed cycle and revoked on a defined timeline after any departure.
- Transmission. Encrypted in transit and at rest, with keys managed separately from the data.
- People. Background verification at hire and on a refresh cycle, per engagement confidentiality agreements, and annual security training with auditable completion records.
- Monitoring. Session logging that can be made available directly to your IT team, with alerting on anomalous access patterns.
- Insurance and notification. Liability cover and the breach notification window are stated in the engagement agreement.
Retention
Enquiry data is kept for 24 months from last contact, then deleted. Subscriber data is kept until you unsubscribe. Client engagement data is retained for the period set in the engagement agreement, typically the statutory retention period where one applies, and deleted within 30 days of termination otherwise.
Your rights
Under GDPR, UK GDPR, CCPA and comparable regimes you may request access to the personal data we hold about you, its correction or deletion, a portable copy, or a restriction on how we process it. You may also withdraw consent to marketing at any time.
Send any request to [email protected]. We respond within 30 days and we do not charge for it.
Contact
Data protection queries: [email protected]
Security questionnaires and audit requests: our security lead responds directly. Ask and we will make the introduction.
Post: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Ready to build your offshore finance team?
Tell us what your firm is struggling with. We will map the roles, show you the cost model and give you a shortlist to interview. No retainer, no obligation.