The Compliance Angle Ltd, trading as Compliance Angle (“we”, “us” or “our”), provides regulatory compliance consultancy services to businesses, including FCA authorisation support, ongoing compliance advice, compliance monitoring, governance support and training.

​

We are registered in England and Wales under company number 15185050. Our registered office is 5th Floor, 167–169 Great Portland Street, London, England, W1W 5PF.

​

This Privacy Policy explains how we collect, use, retain and share personal information relating to website visitors, prospective and existing clients, business contacts, suppliers and individuals whose information is relevant to our consultancy engagements.

​

We process personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, as amended. Our electronic marketing and use of cookies and similar technologies are also subject to the Privacy and Electronic Communications Regulations (“PECR”), where applicable.

​

For questions about this policy or our use of personal information, please contact info@complianceangle.co.uk.

​

1. Our role when handling personal information

 

We act as a data controller where we decide why and how personal information is used. This includes managing our website, enquiries, business relationships, marketing, invoicing and our own business records. We may also act as a controller for particular activities undertaken during a consultancy engagement.

​

For other activities, we may act as a data processor, handling personal information on a client’s behalf and in accordance with its documented instructions. For example, this may apply when we access customer or employee records to undertake an agreed compliance review.

​

Our role depends on the particular processing activity, rather than simply the type of service we provide. Where we act as a processor, the client remains responsible as controller for that processing, and its privacy information applies. Our responsibilities are also addressed in the relevant contractual arrangements.

​

This policy describes our own processing activities and does not replace our clients’ privacy notices.

​

2. Personal information we collect

 

The information we collect depends on your relationship with us and the services involved. It may include:

• Contact and business information: your name, job title, employer, business address, email address, telephone number, professional appointments and information about your organisation’s activities or regulatory status.

• Enquiry and engagement information: correspondence, meeting notes, instructions, proposals, contracts, reports, feedback and other information provided during a business relationship.

• Professional and regulatory information: identification details, employment history, qualifications, CVs, ownership interests, training records, references and information relevant to regulatory applications, competence or fitness and propriety.

• Client-provided information: personal information contained in customer files, complaints, employee records, governance documents, compliance reviews and other materials relevant to an engagement.

• Financial, website and marketing information: billing and payment records; IP address, browser and device information and website usage; and marketing preferences, subscription status and campaign engagement information where lawfully collected.

 

We seek to limit the personal information we handle to what is relevant and necessary. Where appropriate, we use anonymised information or request that unnecessary personal details are removed from documents.

 

Some engagements may involve health or disability information, or information about criminal allegations, convictions or offences. These types of information receive additional legal protection. We only process them where the applicable additional legal conditions are met. Where we act as controller, we provide engagement-specific privacy information identifying the relevant condition where required. Where we act as processor, we handle the information under the client’s lawful documented instructions.

 

3. Where personal information comes from

 

We may obtain personal information directly from you when you contact us, subscribe to communications, attend training or engage with our services.

 

We may also receive information from your employer, our clients, professional advisers, business contacts or people who refer you to us.

 

For business development and regulatory consultancy purposes, we may obtain relevant information from publicly available sources, including the FCA’s Financial Services Register, Companies House, company websites and professional directories.

 

Technical information may be collected through our website and associated technologies, subject to the choices and requirements described in Section 10.

 

Where we obtain personal information indirectly, we provide the required privacy information within the applicable legal timeframe, unless a lawful exception applies. You can contact us to ask about the source of information we hold about you.

 

4. How we use personal information and our lawful bases

 

The following explains our purposes and lawful bases where we act as controller. Where we act as processor, we process information on behalf of the relevant client under its instructions.

 

Enquiries and business relationships. We use contact details and correspondence to respond to enquiries, prepare proposals, arrange meetings and maintain relationships with clients, prospective clients and suppliers. We generally rely on our legitimate interests in operating and developing our consultancy.

 

Providing consultancy services. We use relevant engagement and professional information to deliver FCA application support, compliance advice and monitoring, regulatory health checks, governance and Senior Managers and Certification Regime support, Consumer Duty work, regulatory reporting and training. Where we act as controller, we generally rely on our legitimate interests and those of our clients in obtaining and delivering effective professional support.

 

Contracts with individuals. Where you personally enter into a contract with us, we rely on contractual necessity for processing needed to perform that contract or take steps at your request before entering into it. Where you represent a corporate client, we generally rely on legitimate interests instead.

 

Administration and legal obligations. We use relevant information to issue invoices, manage payments and administer engagements, relying on legitimate interests. We rely on legal obligations where processing is required for our tax, accounting or other statutory responsibilities.

 

Security, quality and disputes. We rely on legitimate interests to protect our systems, prevent misuse, review service quality, investigate concerns and establish, exercise or defend legal claims. Where handling a data protection request or complaint is required by law, we rely on our legal obligations.

 

Marketing and analytics. We use business contact information to promote relevant services and share regulatory updates as explained in Section 6. We rely on legitimate interests where permitted, or consent where required. For website analytics and email tracking, we obtain consent where required, as explained in Section 10.

Where we rely on legitimate interests, we assess whether the processing is necessary and balance those interests against your rights, freedoms and reasonable expectations.

 

Where particular information is necessary for an engagement or legal requirement, we will explain this when requesting it. Without that information, we may be unable to provide the relevant service or complete a regulatory application.

​

5. Direct marketing and your preferences

 

We may use relevant business contact information to send regulatory updates, Resources articles, information about training and details of our consultancy services. We may select communications based on your role, organisation type, regulatory sector or expressed interests.

 

For email marketing to UK corporate subscribers, such as limited companies and limited liability partnerships, we generally rely on legitimate interests where personal information is involved.

 

Different rules apply to individual subscribers, including sole traders and certain partnerships. We only send unsolicited marketing emails to these recipients where we have valid consent or meet all the conditions of an applicable exception, such as the existing-customer “soft opt-in”. A business-related email address does not, by itself, establish that the recipient is a corporate subscriber.

 

We use Wix to manage our marketing contacts, send email campaigns and record subscription preferences.

You can object to direct marketing at any time by using the unsubscribe link in our emails or contacting info@complianceangle.co.uk. We will stop using your personal information for direct marketing, including any related profiling.

 

We retain limited suppression information, such as your email address and opt-out status, to help ensure you are not added back to marketing lists. Unsubscribing does not prevent us from sending necessary, non-marketing communications about an existing engagement.

​

6. Who we share personal information with

 

We do not sell or rent personal information.

 

Where necessary for the purposes described in this policy, we may share information with technology providers supporting our website, email, contact management, accounting, cloud storage, communications and document processing. This includes Wix for our website and email marketing.

 

We may use software and AI-assisted tools to support research, document review and drafting. Where personal information is processed through these tools, its use is subject to appropriate contractual, confidentiality and security safeguards and any required client authorisation.

 

We may also share relevant information with authorised consultants or subcontractors assisting with our work; clients and their authorised representatives; accountants, legal advisers and insurers; and the FCA or other authorities where necessary for an engagement or required by law.

 

Access is limited to what is necessary for the relevant purpose. Where a recipient processes information on our behalf, we require appropriate contractual protections. Where we act as a client’s processor, any onward sharing must also comply with the client’s instructions and applicable contractual requirements.

 

7. International transfers

 

Some service providers process personal information outside the UK. For example, Wix’s arrangements involve processing in Israel and may involve onward processing in other countries used by Wix and its service providers.

 

Where a transfer is subject to UK international transfer restrictions, we ensure an appropriate transfer mechanism applies. This may include UK adequacy regulations or approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.

 

Where required, we assess the protection available following the transfer and apply additional safeguards.

You can contact info@complianceangle.co.uk for further information about relevant overseas processing and to request details or a copy of the applicable safeguards, subject to appropriate redactions.

 

8. How long we retain personal information

 

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

 

For client and engagement records, we consider the duration of the relationship, the nature of the work, applicable record-keeping requirements and the need to address complaints or legal claims.

 

For financial and accounting records, retention is determined by applicable statutory requirements.

 

For enquiries and prospective-client information, we consider whether the enquiry remains active and whether there is an ongoing, relevant business relationship or justified business-development purpose.

 

For marketing information, we review whether the information remains accurate, relevant and lawfully usable. Limited suppression records are retained for as long as needed to respect marketing objections.

 

Where we act as processor, we return or delete information in accordance with our client’s instructions and contractual arrangements, unless the law requires retention.

 

When information is no longer required, we securely delete it or anonymise it. You can contact us for information about the retention criteria applicable to a particular record.

 

9. Cookies, website analytics and email tracking

 

Our website uses cookies and similar technologies to operate securely, provide functionality and, where enabled, understand website use.

 

Where consent is required, we obtain it before using the relevant technology. You can review or change your choices through the website’s cookie controls. Further information about the technologies used, their purposes and duration is provided in our Cookie Policy and cookie settings.

 

Our email marketing platform may provide information about delivery, email opens and link clicks to help us understand campaign performance and improve communications.

 

Permission to send a marketing email does not automatically permit tracking technologies within that email. Where tracking requires consent, we use it only with the required consent.

 

We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

​

10. How we protect personal information

 

We apply appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

 

These measures include restricting access to those who need it for their work, applying confidentiality requirements and using appropriate security controls for the systems and information involved.

 

Where we access a client’s systems, we also follow the applicable access and security requirements agreed with that client.

 

12. Your data protection rights

 

Depending on the circumstances, you have rights to:

• Access and correction: request a copy of your personal information and ask us to correct inaccurate or incomplete information.

• Erasure and restriction: ask us to delete your information or restrict its use where the relevant conditions apply.

• Objection: object to processing based on legitimate interests because of your particular circumstances. Your right to object to direct marketing is absolute.

• Portability: receive certain information in a structured, commonly used, machine-readable format, or request its transfer, where the legal conditions apply.

• Withdrawal of consent: withdraw consent at any time where we rely on it. This does not affect the lawfulness of processing undertaken before withdrawal.

 

These rights are subject to applicable conditions and exemptions, which we will explain where relevant.

 

To exercise your rights, contact info@complianceangle.co.uk. We may request information reasonably necessary to confirm your identity.

 

We normally respond without undue delay and within one month. Where the law permits an extension or adjustment to the response period, we will explain this. Requests are normally handled free of charge.

 

Where your request concerns information we process on a client’s behalf, we will refer it to the relevant client and assist it as required.

 

13. Questions and complaints

 

You can raise a question or data protection complaint by emailing info@complianceangle.co.uk or writing to our registered office, marked “Data Protection”.

 

We will acknowledge a data protection complaint within 30 days, make appropriate enquiries without undue delay,

keep you informed of progress and communicate the outcome without undue delay.

 

You also have the right to complain to the Information Commissioner’s Office (“ICO”), the UK’s data protection regulator. Information about making a complaint is available through the ICO’s website. We welcome the opportunity to address your concerns first, but this does not remove your right to complain to the ICO.

 

14. Changes to this policy

 

We may update this policy to reflect changes to our services, processing activities or legal requirements. The latest version will be published on our website with the updated date.

 

Where required, we will draw material changes to your attention or provide further privacy information before using personal information for a new purpose.

​​

​

Last Updated: 10th October 2026

​