Privacy Policy

---

Privacy Policy Balmoral Wolf Strategies Ltd Effective date: 1st January 2026

1. Introduction

Balmoral Wolf Strategies Ltd ("we", "us", "our") is committed to protecting your privacy and handling your personal data in a transparent, secure and lawful manner.

This Privacy Policy explains how we collect, use, disclose, store and protect personal information when:

• you visit our website(s) (including balmoralwolf.com or any related sites)
• you contact us, request information, or enquire about our services
• we provide strategic consulting, advisory or other professional services to you or your organisation
• you are a representative/contact person of a client, supplier, business partner or other organisation we deal with
• you apply for a position with us

We are the data controller for the personal data we process (unless otherwise stated). Our registered office is in England and we are registered in England and Wales (Company No. 16480309).

2. Contact details

Data Controller: Balmoral Wolf Strategies Ltd Registered address: 12 Kiver Road, London, N19 4PD Email:enquiries@balmoralwolf.com Telephone: +44 7947 764749

If you have any questions about this policy or our data practices, please contact us using the details above.

3. Personal data we collect

We may collect the following categories of personal data:

• Identity & contact data: name, job title, company name, business email address, business telephone number, postal address
• Correspondence data: information you provide when you contact us, send emails, fill in forms, or communicate via phone / meeting notes
• Service-related data: information necessary to deliver our professional services (e.g. financial information you voluntarily share for advisory purposes, business plans, strategic documents containing personal data, counterparty details)
• Marketing & communications data: preferences for receiving communications from us
• Technical data (website visitors): IP address, browser type/version, time zone setting, operating system, device identifiers, pages visited, time/date of visits, referral sources (collected via cookies/analytics – see our separate Cookie Policy if applicable)
• Recruitment data (if you apply to work with us): CV, employment history, qualifications, references, right-to-work information

We do not generally seek to collect special category data (health, race, religion, etc.) or criminal conviction data unless it is strictly necessary for a specific engagement and we have a clear lawful basis.

4. How we collect your personal data

We collect data:

• Directly from you (forms, emails, meetings, calls, contracts)
• From your employer / organisation (when you are their representative)
• From third parties ( introducers, professional advisers, public sources such as Companies House / LinkedIn, credit/reference checks where permitted)
• Automatically via website technologies (cookies, server logs)

5. Purposes and lawful bases for processing

We process personal data for the following purposes and on these lawful bases:

Purpose

Lawful basis(es)

Legitimate interests (where applicable)

Providing / negotiating our professional services

Contract / steps prior to contract

—

Managing client / business relationships

Contract / legitimate interests

Efficient management of client matters

Responding to enquiries & communications

Legitimate interests

Answering questions and providing information

Sending service updates, newsletters (non-marketing)

Legitimate interests

Keeping clients informed about relevant matters

Direct marketing (e.g. invitations to events)

Consent / legitimate interests

Developing business relationships (you can opt out)

Website operation & improvement

Legitimate interests

Understanding site usage and improving user experience

Complying with legal/regulatory obligations (e.g. anti-money laundering, tax, regulatory reporting if applicable)

Legal obligation

—

Preventing fraud, security & IT management

Legitimate interests

Protecting our systems and data

Recruitment / HR purposes

Contract / legitimate interests / consent (some aspects)

Evaluating candidates

6. Who we share personal data with

We may share personal data with:

• Our professional advisers (accountants, lawyers, insurers)
• IT / cloud service providers (e.g. email, document storage, CRM – subject to appropriate safeguards)
• Sub-contractors / consultants engaged on a specific client matter (with your knowledge)
• Regulatory authorities, law enforcement or courts when required by law
• Prospective buyers / successors in title in the event of a business sale/transfer (subject to confidentiality)

We do not sell personal data.

7. International transfers

We may transfer personal data outside the UK. Where we do so to countries without an adequacy decision, we use appropriate safeguards such as:

• UK International Data Transfer Agreement / Addendum
• Standard Contractual Clauses (as adapted for UK)
• Adequacy decision (where still applicable)

8. How long we keep personal data

We keep personal data only for as long as necessary for the purposes set out in this policy and to satisfy any legal, accounting or reporting requirements.

Typical retention periods (subject to specific circumstances):

• Client matter files → usually 6–7 years after matter closure (or longer if regulatory requirements apply)
• Marketing lists → until you unsubscribe/opt out
• Website logs → usually 12–26 months
• Recruitment records → usually 6–12 months after recruitment decision (longer with consent)

9. Your data protection rights

Under the UK GDPR you have the right to:

• Access your personal data
• Correct inaccurate/incomplete data
• Erase data (in certain circumstances)
• Restrict processing
• Data portability
• Object to processing (including direct marketing and processing based on legitimate interests)
• Withdraw consent (where we rely on consent)
• Not be subject to solely automated decisions with legal effect

To exercise any of these rights, please contact us at the details above. We usually respond within one month.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or damage.

11. Changes to this Privacy Policy

We may update this policy from time to time. The current version is always available on our website. Material changes will be notified via the website or direct communication where appropriate.

12. Third-party links

Our website may contain links to third-party sites. We are not responsible for their privacy practices.