Privacy Policy and Client Privacy Notice
1. Introduction
Hughes Consultancy Service Limited (“we”, “us”, “our”) is committed to protecting and respecting your privacy.
This Privacy Policy and Client Privacy Notice explains how we collect, use, store, share and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
Data Controller
Hughes Consultancy Service Limited, Forest House Office, 3-5 Horndean Road, Bracknell, Berkshire, RG12 0XQ, United Kingdom
Email: info@contactchristie.com
ICO Registration Number: ZB687341
2. Personal Data We Collect
Depending on the nature of our relationship with you, we may collect and process the following personal data:
Identity Data
- Full name
- Date of birth
- Nationality
- Identification documents
- Photographic identification
Contact Data
- Postal address
- Email address
- Telephone number
Financial Data
- Bank account information
- Payment records
- Invoices and transaction history
Compliance Data
- AML and KYC verification information
- Risk assessments
- Source of funds information
- Source of wealth information where required
- Politically Exposed Person (PEP) screening results
- Sanctions screening results
Technical Data
- IP address
- Browser type and version
- Device information
- Website usage information
Communication Data
- Emails
- Letters
- Telephone records
- Meeting notes
- Enquiries and complaints
3. How We Collect Personal Data
We may collect personal data:
- Directly from you.
- Through our website.
- Through email correspondence.
- Through telephone conversations.
- Through meetings and consultations.
- Through publicly available sources where legally permitted.
- Through third-party identity verification and compliance providers.
- Through referrals and introductions where appropriate.
4. How We Use Personal Data
We may use personal data for the following purposes:
- Providing consultancy and professional services.
- Managing client relationships.
- Conducting anti-money laundering and identity verification checks.
- Managing contracts and engagements.
- Processing payments and maintaining accounting records.
- Meeting legal and regulatory obligations.
- Communicating with clients and prospective clients.
- Responding to enquiries and complaints.
- Improving our services and website.
- Sending marketing communications where permitted by law.
5. Lawful Bases for Processing
Under UK GDPR we rely upon one or more of the following lawful bases:
Contract
Where processing is necessary to perform a contract with you or to take steps before entering into a contract.
Legal Obligation
Where processing is necessary to comply with legal or regulatory requirements, including anti-money laundering obligations.
Legitimate Interests
Where processing is necessary for our legitimate business interests and does not override your rights and freedoms.
Consent
Where consent is required, such as for certain marketing activities.
6. Anti-Money Laundering (AML) and Know Your Customer (KYC) Checks
As part of our legal and regulatory obligations, we may be required to verify the identity of clients and conduct AML and KYC checks.
These checks may include:
- Verification of identity documents.
- Verification of residential addresses.
- Source of funds checks.
- Source of wealth checks.
- Sanctions screening.
- Politically Exposed Person (PEP) screening.
- Adverse media screening.
- Fraud prevention checks.
AML and KYC checks are generally carried out under our legal obligations and legitimate interests. Consent is not normally relied upon for these checks.
If required information is not provided, we may be unable to commence or continue providing services.
7. Third-Party Service Providers
We use trusted third-party providers to support our business operations.
Accounting and Financial Administration
We use Xero to manage accounting records, invoicing and financial administration.
Banking Services
We use Monzo Bank for business banking and payment processing.
Cloud Storage and Document Management
We use Microsoft OneDrive to securely store business records and client documentation.
AML and Identity Verification
We use Xama and other appropriate verification providers where necessary to conduct identity verification and compliance screening.
These providers may process personal data on our behalf and are required to maintain appropriate security and confidentiality measures.
8. Marketing Communications
We may send communications relating to:
- Business updates.
- Industry news.
- Regulatory developments.
- Educational content.
- Service updates.
- Newsletters.
- Events and promotions.
Where required by law, we will obtain your consent before sending marketing communications.
Where legally permitted, we may contact existing clients regarding services similar to those they have previously received.
You may unsubscribe from marketing communications at any time by:
- Clicking the unsubscribe link in any marketing email.
- Contacting us at info@contactchristie.com.
Opting out of marketing communications will not affect important service-related communications.
9. Website Use, Cookies and Analytics
Cookies
Our website may use cookies and similar technologies to improve functionality, analyse performance and enhance user experience.
Cookies may include:
- Strictly necessary cookies.
- Functional cookies.
- Analytics cookies.
- Marketing cookies where applicable.
You can manage cookies through your browser settings.
Website Analytics
We may collect information including:
- IP address.
- Device type.
- Browser type.
- Pages visited.
- Time spent on pages.
- Referring websites.
This information helps us improve our website and services.
Contact Forms
Where you complete a website contact form, we will use the information provided to respond to your enquiry and maintain records of our communications.
Newsletter Sign-Up Forms
If you subscribe to newsletters or updates through our website, we will process your information in accordance with this Privacy Policy and you may unsubscribe at any time.
Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the content or privacy practices of those websites.
10. Sharing Personal Data
We may share personal data with:
- Professional advisers.
- Accountants.
- Solicitors.
- Technology providers.
- Cloud storage providers.
- Banking and payment providers.
- AML and identity verification providers.
- Regulatory authorities.
- Government agencies.
- Law enforcement bodies where required by law.
We do not sell personal data to third parties.
11. International Transfers
Some service providers may process personal data outside the United Kingdom.
Where international transfers occur, we will ensure appropriate safeguards are in place in accordance with UK GDPR requirements.
12. Data Security
We implement appropriate technical and organisational measures to protect personal data against:
- Unauthorised access.
- Accidental loss.
- Destruction.
- Misuse.
- Alteration.
- Disclosure.
Access to personal data is restricted to those who require it for legitimate business purposes.
13. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected.
Typical retention periods include:
Client Records
Up to six years after the end of the client relationship.
Financial Records
At least six years to comply with tax and accounting requirements.
AML/KYC Records
At least five years after the end of the business relationship, or longer where required by law or regulatory guidance.
Marketing Records
Until consent is withdrawn or the information is no longer required.
14. Your Rights
Under UK data protection law, you have the right to:
- Access your personal data.
- Correct inaccurate or incomplete information.
- Request erasure of personal data where applicable.
- Request restriction of processing.
- Object to processing.
- Request data portability.
- Withdraw consent where consent is relied upon.
- Lodge a complaint with the Information Commissioner’s Office (ICO).
15. Automated Decision-Making
We do not make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards.
16. Complaints
If you have concerns regarding the way we process your personal data, please contact us first so that we can attempt to resolve the matter.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices or services.
The most current version will always be available on our website.
18. Contact Us
If you have any questions regarding this Privacy Policy or the processing of personal data, please contact:
Hughes Consultancy Service Limited, Forest House Office, 3-5 Horndean Road, Bracknell, Berkshire, RG12 0XQ, United Kingdom
Email: info@contactchristie.com
ICO Registration Number: ZB687341
Last Updated: 1st June 2026