Privacy Notice
1. Who we are
Controller. Altham Advisory Limited (Altham, we, us or our) is the controller of the personal information it processes, except where the relevant Engagement documents state a different role.
Contact. Send privacy requests by replying to the email that supplied the Engagement documents with "Privacy request" in the subject, or by post to Altham Advisory Limited, 115 Hardwicke Street, Rochdale, Greater Manchester, United Kingdom, OL11 1QJ.
2. Scope
This notice covers personal information processed through our website, enquiries, onboarding, engagements, complaints, business development, introducers, suppliers, subcontractors and reviewers. It applies to clients, prospective clients, business contacts, authorised representatives, owners and controllers, payers, counterparties, witnesses, advisers and any other person connected with a matter.
3. Information we use and its sources
Identity and business data. Names, contact details, role, signature, date of birth where needed, company and ownership/control information, identity evidence and authorised-instruction records.
Matter and financial data. Instructions, documents, correspondence, evidence, opinions, deadlines, billing, payment and complaint records.
Risk and technical data. Conflicts, sanctions and fraud-screening results; website, device, communications, access and security data.
Sensitive data. Special-category or criminal-offence information only where relevant and necessary for the Engagement, a legal claim, compliance or risk management.
Sources. The person concerned; the Client and its personnel; counterparties, witnesses and advisers; introducers and service providers; correspondence and matter documents; and public sources such as Companies House, court records, professional directories and sanctions lists.
4. Why we use information
| PURPOSE | PRINCIPAL LAWFUL BASIS |
|---|---|
| Enquiries, onboarding, identity, authority, conflicts and sanctions checks | Steps before or performance of a contract; legitimate interests in accepting work safely; legal obligation where applicable. |
| Delivering Services, communicating, producing Deliverables and managing providers | Contract where the individual is the Client; otherwise legitimate interests in delivering the Engagement and operating our business. |
| Billing, accounts, records, complaints and establishing or defending claims | Contract; legal obligation; legitimate interests in administration, risk management and protecting legal rights. |
| Security and fraud prevention | Legal obligation or legitimate interests in protecting systems, information, the business and clients. |
| Business development and B2B marketing | Legitimate interests or consent, with PECR compliance where required. |
| Website operation and analytics | Legitimate interests for essential operation and security; consent for non-essential cookies or similar technology where required. |
| Crime prevention, detection or investigation, and lawful disclosures to public authorities | Legal obligation; legitimate interests; or recognised legitimate interest where the applicable Annex 1 condition is met and the processing is necessary. |
5. Sensitive information
Where necessary, we process special-category data under Article 9(2)(f) UK GDPR for legal claims, or another documented condition that applies. Criminal-offence data is processed only where a DPA 2018 Schedule 1 condition applies, commonly legal claims, fraud prevention or preventing or detecting unlawful acts. We record the applicable condition and use only what is proportionate.
6. Who receives information
Engagement recipients. The Client's authorised people; approved bench subcontractors and second-opinion reviewers; and, where necessary or instructed, solicitors, counsel, experts, mediators, adjudicators, arbitrators, counterparties and their advisers.
Business providers. Secure hosting, communications, document management, cyber-security, approved AI tools, accounting and payment providers acting under appropriate terms.
Required disclosures. Courts, public authorities, regulators, law enforcement and professional advisers where lawful and necessary; and a prospective buyer or successor during a genuine business transaction subject to confidentiality.
Sale. We do not sell personal information.
7. AI-assisted processing
Where Altham uses an AI-enabled system for client work, that use requires documented tool and matter approval, classification of information, minimum necessary input and human review before reliance. Client-confidential material is not authorised for general AI use merely because this notice mentions AI. Altham does not make decisions producing legal or similarly significant effects solely by automated means.
8. International processing
International processing. Where a provider accesses personal information from outside the UK, we will use an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, together with any required transfer risk assessment. Ask us through the contact route in section 1 for the countries and safeguards relevant to your information.
9. Retention
| RECORD | CURRENT RETENTION RULE |
|---|---|
| Enquiries and declined matters | 24 months after last substantive contact. A minimal conflicts record may be retained for seven years. |
| Onboarding, sanctions and matter files | We ordinarily keep an Engagement file for seven years after closure. We keep it longer where a deed, longer limitation period, live or reasonably contemplated claim, litigation hold or legal requirement makes this reasonably necessary. |
| Complaints and claim-related records | Seven years after final resolution, and longer while a claim, investigation or litigation hold remains live. |
| Financial and tax records | Six years after the end of the relevant accounting period, or longer where law requires. |
| Marketing and suppression records | Until opt-out or 24 months after last meaningful engagement. Minimal suppression data is retained while marketing continues so objections are honoured. |
We may retain other records longer where required by law, a litigation hold or a live claim. We delete or anonymise information when the purpose ends.
10. Your rights
Depending on the purpose and lawful basis, you may ask for access, correction, erasure, restriction or portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. Send requests to the contact route in section 1. We may verify identity and will respond within the applicable statutory period.
RIGHT TO OBJECT You may object to direct marketing at any time and we will stop. You may also object where we rely on legitimate interests or recognised legitimate interest; we will stop unless the law permits continued processing, including for legal claims.
11. Providing information, complaints and changes
Required information. Identity, authority, conflicts, sanctions and core matter information may be necessary to consider or perform an Engagement. Without it, we may decline, pause or end work.
Complaints. Send a data protection complaint through the contact route in section 1. We will acknowledge it promptly and respond without undue delay. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes. We review this notice periodically and will notify material new uses before they begin. The current version is provided with the Engagement and can be requested through the contact route in section 1.