Privacy
Policy

Effective date: 29 April 2026  ·  Abbotts Advisory Limited  ·  ICO Registration: ZC135669

Abbotts Advisory Limited (“we”, “us”, “our”) is committed to protecting and respecting your personal data. This Privacy Policy explains how we collect, use, store, and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We act as a data controller in relation to our own business activities. Where we handle personal data on behalf of clients as part of a consulting engagement, we may also act as a data processor. Our approach to that role is set out in Section 9 below. If you have any questions, please contact us using the details in Section 2.

2. Who We Are

Company name: Abbotts Advisory Limited
Company number: 17157156
Registered office: Pipers Ridge, Brampton Abbotts, HR9 7JD
Data protection contact: contact@abbottsadvisory.co.uk
ICO Registration Number: ZC135669

3. The Data We Collect

We collect and process only the minimum personal data necessary to operate our business. This may include:

Contact Information

• Name
• Email address
• Telephone number
• Job title and organisation name

Business Interaction Data

• Communications, including emails, messages, and meeting notes
• Information shared during enquiries, proposals, or active engagements

Website Data

• Information submitted via contact or enquiry forms
• Technical data collected via cookies and similar technologies (see Section 12)

We do not intentionally collect sensitive personal data (special category data) as part of our ordinary business activities.

4. How We Use Your Data

• To respond to enquiries and contact requests
• To deliver consultancy services under an engagement
• To manage client relationships and ongoing communications
• To meet legal, regulatory, and contractual obligations
• To maintain internal business records
• To send relevant information or updates where you have consented to receive them
• To conduct business development and outreach relevant to our services, where individuals are contacted in their professional capacity on the basis of Legitimate Interest

We do not use personal data for automated decision-making or profiling. Where we rely on consent as a lawful basis, you have the right to withdraw that consent at any time.

5. Lawful Basis for Processing

• Legitimate interests — to operate, manage, and develop our business, where those interests are not overridden by your rights
• Contractual necessity — where processing is required to deliver services or fulfil a contractual obligation
• Legal obligation — where processing is required to comply with applicable law or regulation
• Consent — where you have given us clear, specific permission to process your data for a defined purpose

6. How We Store and Protect Your Data

• Secure cloud-based platforms, primarily Microsoft 365, for email, document storage, and communications
• A locally-hosted CRM application, stored on secure, access-controlled hardware
• Access controls and authentication, including multi-factor authentication where appropriate
• Restricting access to personal data to authorised individuals only
• Secure handling of documents and electronic communications

7. Data Retention

• Enquiry and pre-engagement data: typically up to 12 months from the date of last contact
• Client engagement data: retained for the duration of the engagement and for six years thereafter, in line with the Limitation Act 1980
• Financial and accounting records: retained for six years in accordance with the Companies Act 2006 and HMRC requirements

When data is no longer required, it is securely deleted or destroyed.

8. Sharing of Data

We do not sell or share personal data for marketing purposes. We may share personal data with trusted third parties where necessary to operate our business, including professional advisers, IT and cloud service providers, and business tools used for project management and communication. Where third parties process personal data on our behalf, we ensure appropriate contractual safeguards are in place.

9. Our Role as Data Processor

Where we are engaged to deliver consultancy services, we may access or process personal data belonging to our clients or their end customers. In these circumstances, we act as a data processor on behalf of the client, who remains the data controller. We handle client data only as directed by the client, apply the same safeguards as we apply to our own data, and do not use, retain, or disclose client data beyond what is required to fulfil the engagement. Where required, we will agree a formal Data Processing Agreement prior to commencing work involving personal data.

10. International Transfers

Some of our service providers may process personal data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as transfer to countries covered by UK adequacy regulations or standard contractual clauses approved under UK data protection law.

11. Use of AI Tools

We may use AI-based tools to support internal productivity. Where AI tools are used, no client personal data is knowingly shared with or used to train external AI models, data is handled in a controlled and proportionate manner, and human oversight is always applied to any AI-assisted output.

12. Cookies and Website Tracking

Our website does not set any cookies. A separate Cookie Policy is available on our website for further detail.

13. Children’s Data

Our services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18.

14. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• The right to access your personal data
• The right to request correction of inaccurate or incomplete data
• The right to request erasure of your data in certain circumstances
• The right to restrict or object to processing
• The right to data portability
• The right to withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact us at contact@abbottsadvisory.co.uk.

15. Data Breaches

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

16. Complaints

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or on 0303 123 1113. We would appreciate the opportunity to address your concerns directly in the first instance.

17. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website at abbottsadvisory.co.uk.