A.C.T. London Limited
Website Privacy Policy (UK)
1. About this policy
A.C.T. London Limited ("we", "us", "our") is committed to protecting your personal data and respecting your privacy. This policy explains what personal data we collect through our website, why we collect it, what we do with it, who we share it with and what rights you have in relation to it.
This policy is our privacy notice for the purposes of Articles 13 and 14 of the UK General Data Protection Regulation ("UK GDPR"). We act as the controller of the personal data described in this policy, meaning that we determine the purposes for which and the manner in which that data is processed.
We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 ("DPA 2018"), the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and the Data (Use and Access) Act 2025, in each case as amended from time to time.
Please read this policy together with our Cookie and Similar Technologies Policy, which explains in detail the cookies and similar technologies used on our website, and with any engagement letter or terms of business we have entered into with you.
2. Who we are and how to contact us
| Field | Detail |
|---|---|
| Controller | A.C.T. London Limited |
| Company number | 04505457 (registered in England and Wales) |
| Registered office | Berkeley Suite, 35 Berkeley Square, Mayfair, London, United Kingdom, W1J 5BF |
| Trading / correspondence address | 27 Hill Street, Mayfair, London W1J 5LP |
| Website covered | http://www.act.london |
| Website platform | WordPress.com |
| Cookie preference tool | CookieYes |
| Email for privacy queries | gdpr@act.london |
| Telephone | +44 (0)20 7432 6050 |
| Privacy contact | Head of Legal and Compliance |
| Data Protection Officer | We have not appointed a statutory Data Protection Officer. Privacy compliance is overseen by our Head of Legal and Compliance |
3. Who and what this policy applies to
This policy applies to personal data we collect through or in connection with http://www.act.london, including personal data relating to:
visitors to and users of our website;
individuals who submit an enquiry or contact us through our website;
individuals who subscribe to our newsletter, alerts or marketing communications
prospective clients and their personnel, officers, shareholders and beneficial owners, where their data reaches us through the website; and
Where we provide accountancy, payroll or tax advisory services, further information about how we process personal data in the course of those services is set out in our engagement letter and terms of business. This policy does not replace those documents.
4. How we collect personal data
4.1 Information you give us
You may give us personal data by completing a form on our website, corresponding with us by email or telephone, or subscribing to our communications.
General website forms must not be used to send confidential client files or sensitive personal data. Client documents should be sent only through the secure facilities we provide.
4.2 Information we collect automatically
When you visit our website, we and our service providers automatically collect certain technical and usage information, including through cookies and similar technologies. This is described in section 5 below and in our Cookie and Similar Technologies Policy.
4.3 Information we obtain from other sources
We may receive personal data about you from:
analytics and advertising platforms, where you have consented to the relevant cookies and technologies;
the referring website, search engine or advertisement that directed you to our website; and
a colleague, client or contact who provides your details to us in connection with an enquiry.
If you become a client, we also obtain personal data about you from public registers, screening and verification providers, banks and other professional advisers as part of our client due diligence.
5. The personal data we collect and why
The table below sets out the categories of personal data we process through or in connection with our website, the purposes for which we process it and the lawful basis we rely on under Article 6 UK GDPR.
This section describes processing that arises from your use of our website. It does not describe the personal data we process when we act for you as a client — including identity and verification data, financial and tax information, and client due diligence records. That processing is described in our Terms of Business.
| Processing activity | Personal data | Purpose | Lawful basis |
|---|---|---|---|
| Enquiries and contact form | Name, email address, phone number, select services (dropdown), date, the content of your message, and any other information you choose to provide. | To respond to your enquiry, to provide information about our services and to keep a record of the correspondence. | Article 6(1)(f) — our legitimate interest in responding to enquiries and keeping a record of them. Where your enquiry is a request that we provide services to you, Article 6(1)(b) — steps taken at your request before entering a contract. |
| Enquiries that progress to an engagement | The enquiry and contact details described above. | To assess whether we are able to act, to carry out conflict checks and to open a client file. If you become a client we then process a wider set of personal data — including identity, financial and due diligence information — which is described in our terms of business, and not in this policy. | Article 6(1)(b) — steps taken at your request before entering a contract. |
| Website security and availability | IP address, device and browser information, access times, pages requested, referring URL and server log data. | To operate the website securely, to balance load, to prevent and detect fraud, bot activity and attacks, and to diagnose faults. | Article 6(1)(f) — our legitimate interest in maintaining a secure and functioning website. |
| Website analytics and performance | Pages visited, session duration, device and browser type, approximate location, referral source, and mouse movement, scrolling and clicks. | To measure how the website is used, to identify usability problems and to improve our website and content. | Article 6(1)(a) — consent, given through our cookie preference centre. Consent under PECR is also required for the underlying technologies. |
| Advertising and audience measurement | Advertising and device identifiers, pages viewed, and interaction and conversion events transmitted to advertising platforms through the LinkedIn Insight Tag. | To measure the results of our advertising on LinkedIn and Meta platforms and to build retargeting, matched, custom and lookalike audiences. | Article 6(1)(a) — consent, given through our cookie preference centre. |
| Embedded content | IP address, device and browser information, and the fact that you viewed or interacted with the content, collected by the provider of the embedded video. | To display embedded video within our pages. Embedded content is blocked until you consent. | Article 6(1)(a) — consent, given through our cookie preference centre. |
| Legal and regulatory matters | Personal data collected through the website, as described above. | To respond to and comply with legal and regulatory enquiries. | Article 6(1)(c) — legal obligation.. |
| Legal claims | Personal data collected through the website, as described above. | To establish, exercise or defend legal claims, and to comply with court orders. | Article 6(1)(f) — our legitimate interest in protecting our legal position. |
Where we rely on legitimate interests, we assess whether our legitimate interests are not overridden by your interests, rights and freedoms. You may request further information about that assessment by contacting us using the details in section 2.
6. Special category data
We do not ask you to provide special category personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health data or data concerning a person's sexual orientation) or criminal offence information through our general website form. Please do not submit such information through those forms. If we receive it unexpectedly, we will restrict access and determine whether it should be securely deleted or handled under an applicable legal condition.
7. Cookies and similar technologies
Our website uses cookies and similar technologies, including pixels, tags, scripts and local storage. Technologies that are not necessary are switched off until you give your consent through our cookie preference centre.
Consent to non-essential technologies is collected and recorded through CookieYes. When you first visit our website, cookies and technologies that require consent are switched off. You may select "Accept all", "Reject all" or enable certain cookies and technologies and select "Save My Preferences" through our cookie banner, and you may change or withdraw your choices at any time by selecting the Cookie icon in the website footer.
8. Marketing communications
Where PECR’s soft opt-in applies, we may email an individual about our own similar services only where we obtained their contact details directly during a sale or negotiation for sale and offered a clear opportunity to opt out when the details were collected and in every subsequent message.
9. Who we share your personal data with
We do not sell your personal data. We may share it with:
our own personnel, on a need-to-know basis;
service providers who process personal data on our behalf under a written contract meeting the requirements of Article 28 UK GDPR, including our website platform, hosting, analytics, advertising, IT, cloud storage, practice management, payroll and communications providers;
other professional advisers, including lawyers, auditors, insurers and banks;
HM Revenue & Customs, Companies House, the National Crime Agency, our professional and anti-money laundering supervisory bodies, the Institute of Chartered Accountants in England and Wales (ICAEW) and other regulators, law enforcement agencies and courts, where required or permitted by law; and
a purchaser or prospective purchaser of our business or assets, or their advisers.
The third-party technologies used on our website, and the providers of those technologies, are identified in the table at section 4 of our Cookie and Similar Technologies Policy.
The following third-party service providers may also process personal data on our behalf:
Website platform/hosting and embedded video: WordPress.com (Automattic)
Consent tool: CookieYes and Google Tag Manager
Backup: UpdraftPlus and All-in-One WP Migration
Analytics: Google Analytics 4, Jetpack Stats, Microsoft Clarity
Advertising: LinkedIn Insight Tag, Meta
10. International transfers
Several of the providers identified in section 9 are established outside the United Kingdom, principally in the United States, and personal data may therefore be transferred outside the UK and the European Economic Area based on UK-US Data Bridge. We rely on the UK Extension to the EU–US Data Privacy Framework where the particular recipient is validly participating in it supported by a transfer risk assessment. You may contact us using the details in section 2 to request further information or a copy of the safeguards used for a particular transfer.
11. How long we keep your personal data
We keep personal data only for as long as is necessary for the purposes for which it was collected, including to satisfy legal, accounting, regulatory or reporting requirements, and to establish, exercise or defend legal claims.
| Category | Retention period | Basis |
|---|---|---|
| Enquiries that do not become engagements | Twelve months from last contact | Legitimate interests |
| Enquiries that become engagements | Transferred to the client file and retained in accordance with our terms of business | Contract; legal obligation |
| Cookies and similar technologies | As stated in our Cookie and Similar Technologies Policy | Consent; PECR |
| Website server logs | Twelve months | Legitimate interests |
At the end of the applicable period we will securely delete the personal data, unless we are required to retain it for longer by law or in connection with an actual or anticipated legal claim, regulatory investigation or professional complaint.
12. How we protect your personal data
We have implemented appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include access controls, encryption in transit, secure authentication, staff confidentiality obligations and training, and contractual controls on our service providers.
We have procedures to deal with any suspected personal data breach and will notify you and the Information Commissioner's Office (ICO) where we are legally required to do so.
No transmission of information over the internet is entirely secure. Where you send us confidential information, we encourage you to use the secure facilities we make available rather than ordinary email.
13. Your rights
Subject to the conditions and exemptions in data protection law (UK GDPR), you have the following rights:
| Right | What it means |
|---|---|
| Access (Article 15) | To be told whether we process your personal data and, if so, to receive a copy of it and information about how it is processed. |
| Rectification (Article 16) | To have inaccurate personal data corrected and incomplete personal data completed. |
| Erasure (Article 17) | To have your personal data deleted in certain circumstances. This right does not apply where we are required by law to retain the data, including under the Money Laundering Regulations 2017. |
| Restriction (Article 18) | To have the processing of your personal data restricted in certain circumstances. |
| Data portability (Article 20) | To receive personal data you have provided to us in a structured, commonly used and machine-readable format, where we process it by automated means on the basis of consent or contract. |
| Objection (Article 21) | To object to processing carried out on the basis of legitimate interests, and to object at any time and without qualification to processing for direct marketing purposes. |
| Withdraw consent (Article 7(3)) | To withdraw any consent you have given at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. |
| Complain (Article 77) | To lodge a complaint with the ICO. See section 17. |
To exercise any of these rights, please contact us at gdpr@act.london. We may ask you for information to verify your identity. We will respond within one month of receiving your request, which may be extended by up to two further months where the request is complex or where we have received a number of requests from you. There is normally no charge.
14. Automated decision-making and profiling
We do not make decisions about you based solely on automated processing which produce legal effects concerning you or similarly significantly affect you.
Where you have consented to analytical and advertising technologies, information about your use of our website may be used by the relevant providers to build audiences and to make advertising more relevant to you. This may constitute profiling for direct marketing purposes, and you may object to it at any time by withdrawing your consent through our cookie preference centre.
15. Children
Our website and our services are directed at businesses and at adults. We do not knowingly collect personal data from children under the age of 18 through our website. If you believe that we hold personal data relating to a child, please contact us so that we can delete it.
16. Third-party websites
Our website may contain links to, and embedded content from, third-party websites, plug-ins and applications. Following a link or interacting with embedded content may allow the third party to collect or share data about you. We do not control those third parties and are not responsible for their privacy notices. We encourage you to read the privacy notice of every website you visit.
17. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at gdpr@act.london so that we have the opportunity to resolve the matter. We will acknowledge your complaint and respond to it without undue delay.
We will acknowledge receipt of your complaint within 30 days, investigate it appropriately and without undue delay, keep you informed of its progress where appropriate, and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:
| Field | Detail |
|---|---|
| Information Commissioner's Office | Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
| Helpline | 0303 123 1113 |
| Website | ico.org.uk |
Making a complaint to the ICO does not affect any other legal remedy available to you.
18. Changes to this policy
We may update this policy from time to time to reflect changes to our website, our services, our service providers or our legal obligations. We will change the "Last updated" date at the top of this policy whenever we do so.
Where a change introduces a materially different purpose or a new recipient that is not covered by information we have already given you, we will bring the change to your attention and, where consent is required, obtain fresh consent before proceeding.
We recommend that you review this policy periodically.