Who we are
Hatherley Consultancy Limited is an independent information security consultancy registered in England and Wales, company number 17445178, with its registered office at 1st Floor, Swan Buildings, 20 Swan Street, Manchester M45 5JW.
For the personal information described in this notice we are the data controller. Questions about this notice, or about how we handle personal information, can be sent to enquiries@hatherley-infosec.com.
This website
It sets no cookies, runs no analytics and does not track you, so there is nothing to consent to. Three things are worth knowing: the enquiry form passes what you type to Web3Forms, which emails it to us; the site is hosted by Cloudflare, which keeps standard logs that may include your IP address; and the typefaces are served by Google Fonts, so your browser discloses your IP address to Google.
Information we hold, and why
Nearly all the personal information we hold is ordinary business contact information about people we work with. We keep it to a minimum, and we do not buy contact lists or sell anything to anyone.
Enquiries
Your name, email address, organisation and whatever you tell us in your message, whether you use the enquiry form or write to us directly, so that we can reply and work out whether we can help. Our lawful basis is our legitimate interest in responding to people who contact us. If nothing comes of it, we delete the correspondence after [retention period].
Client engagements
Contact details for the people we work with, correspondence, notes, and the documents an engagement produces. Our lawful basis is the performance of our contract with the client organisation, and our legitimate interests in running the engagement properly. Engagement material can incidentally include personal information about the client’s own staff, for example where a policy names a role holder or an interview record names who we spoke to; where that happens we act on the client’s instructions as their processor.
Suppliers and contractors
Contact and payment details for the people and businesses we buy from, used to manage the relationship and pay invoices. Our lawful basis is the performance of our contract with them, and our legal obligations.
Business records
Quotes, invoices, and the accounting records that follow from them. We are required to keep these, so our lawful basis is compliance with a legal obligation, and we hold them for [confirm: six] years after the end of the financial year to which they relate.
Anything you send us that we did not ask for
Occasionally material arrives containing more personal information than an engagement needs. We tell the sender, return or securely delete what is not required, and do not keep copies.
Who else sees it
We do not sell personal information, and we do not disclose client material to anyone outside our engagement without the client’s instruction. Information is shared only with organisations that provide the services we run the business on, each under a written agreement that restricts them to acting on our instructions: Google Workspace for email and documents, [accounting software], Cloudflare for hosting this website, Web3Forms for the enquiry form, and our professional advisers where we are obliged to consult them.
We would also disclose information where the law requires it, or to establish or defend a legal claim. Some of these providers process information outside the United Kingdom; where that happens we rely on [transfer mechanism, for example UK adequacy regulations or the International Data Transfer Addendum] so that the protection travels with the information.
How we look after it
We would be poor advisers if we did not hold ourselves to what we recommend. Access to client material is limited to those who need it, accounts require multi-factor authentication, devices are encrypted, and information is kept only as long as there is a reason to keep it. Everything a client tells us is treated as confidential, and engagement material is not used as an example or a reference without written agreement.
Your rights
Under UK data protection law you can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, delete it, or restrict what we do with it. You can object to our processing where we rely on legitimate interests, ask us to transfer information to another organisation where that applies, and withdraw consent at any time where consent is what we rely on.
Write to enquiries@hatherley-infosec.com and we will respond within one month. There is no charge. If the personal information is held on a client’s behalf, we will direct your request to that organisation, because the decision is theirs to make. Where we cannot do what you have asked, we will explain why.
If you are unhappy
Please raise it with us first, because most things are quickly put right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.
Changes to this notice
We update this notice when what we do changes. The date at the top tells you which version you are reading, and we will tell clients directly about any change that materially affects an engagement.