1. Who we are
Whitlow Consultancy Ltd (“Whitlow”, “we”, “us”, “our”) is the controller of your personal information when you visit our website or submit an application or expression of interest to become a nominee or member. Our registered office is 85 Great Portland Street, First Floor, London, England, W1W 7LT. You can contact us at privacy@whitlowconsultancy.com.
2. What this policy covers
This policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and your rights under UK data protection law. It applies to information collected through our website and landing pages, including any forms used to capture KYC documents.
3. What we collect
We may collect the following categories of personal information:
● Identifiers and contact details – name, email, telephone number, date of birth, residential address and previous addresses.
● Identity and verification data – passport, driving licence, proof of address, selfie or liveness checks, and unique applicant reference numbers.
● Background and screening data – sanctions and PEP screening results, credit check results, directorship and insolvency history, and, where strictly necessary, any information relating to criminal convictions and offences.
● Professional information – CV or LinkedIn profile, employment history, references.
● Technical data – IP address, device and browser type, and cookie identifiers. See the Cookie section.
● Financial details – bank details to pay fees or expenses, if applicable.
● Communications – messages and documents you send to us.
You do not have to provide all the information we ask for. However, if you do not provide the information required for identity verification, background checks, and risk assessments, we may be unable to proceed with onboarding.
4. Why do we use your information and our lawful bases
We will only use your personal information where permitted by law. Below are our purposes and the lawful bases on which we rely.
| Purpose | Examples | Lawful basis |
| Identity verification and due diligence | Verify identity, address and eligibility, conduct screening checks | Legal obligation (to comply with anti-money laundering and financial crime laws) and legitimate interests (to protect our business and clients) |
| Background, credit and sanctions screening | Using third-party providers to run checks | Legitimate interests and legal obligation, where applicable |
| Candidate evaluation and onboarding | Assess your application and manage our relationship | Contract or steps at your request before entering a contract |
| Communications | Respond to your enquiries, send service messages | Legitimate interests or contract |
| Record keeping and compliance | Maintain records required by law | Legal obligation |
| Marketing | Send updates about our services | Consent. You can withdraw at any time |
| Website operation and analytics | Operate the site, measure and improve performance | Consent for non-essential cookies. Legitimate interests for strictly necessary cookies |
Criminal offence data
In limited cases, we may process information about criminal convictions and offences. We only do this where it is necessary and lawful under the Data Protection Act 2018, Schedule 1 conditions, for example, to prevent fraud or comply with regulatory requirements. We prefer that a specialist screening provider conducts such checks and shares only a pass or fail result with us.
5. Where do we get your information
● Directly from you via our forms and communications
● From third-party verification and background check providers
● From publicly available sources such as corporate registries
6. Who we share it with
We share personal information with the following categories of recipients, only as necessary and under contract:
● Identity verification and background check providers
● Cloud storage, email, CRM and helpdesk providers
● Professional advisers such as lawyers and accountants
● Regulators and law enforcement, when required by law
● Group companies and service partners involved in your onboarding We do not sell your personal information.
7. International transfers
Some of our service providers are located outside the UK. When we transfer your personal information internationally, we use legally approved safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, to ensure its protection.
8. How long do we keep your information
We keep personal information only for as long as necessary for the purposes described above.
● KYC and due diligence records are typically retained for five years after the end of our relationship to comply with anti-money laundering record-keeping requirements.
● Contract and accounting records are retained for up to six years following the termination of our relationship.
● Marketing preferences are kept until you withdraw consent.
● Cookie data is stored in accordance with the lifetimes specified in our cookie banner.
9. Your rights
You have the following rights under UK data protection law: to be informed, access, rectification, erasure, restriction, data portability, and to object to processing. You also have rights regarding automated decision-making. To exercise your rights, email privacy@whitlowconsultancy.com. You also have the right to complain to the UK Information Commissioner’s Office. See ico.org.uk for contact details.
10. Cookies
We use essential cookies to ensure our site functions correctly. We will ask for your consent before setting analytics or similar cookies. You can withdraw your consent at any time through our cookie banner or by adjusting your browser settings. For more information, see our Cookie Notice.
11. Children
Our services are not intended for individuals under 18 years of age, and we do not knowingly collect personal information from them.
12. Security
We use technical and organisational measures to protect your information. No system can be completely secure, but we work to reduce risks of loss, misuse or unauthorised access.
13. Changes to this policy
We reserve the right to update this policy from time to time. We will post any changes to this page and, if significant, notify you accordingly.
Last updated: 9 August 2025