Privacy & company information

Last updated: 13 October 2026.

Contact and scope

For questions about this notice or your personal information, email enquiries@subprotect.co.uk, telephone 020 7139 5084, or write to the registered office above. References to “we”, “us” and “our” mean the company identified in the Company information section.

This notice covers website visitors, people making enquiries, clients and business contacts whose information is supplied in connection with our services. Where we act only on a client’s documented instructions as a data processor, the applicable client agreement also governs that processing.

Information we use and where it comes from

Names, business roles, company names, email addresses, telephone numbers and correspondence supplied when you contact us.
Project details, instructions, contract documents, review comments and reports needed for the agreed service. Documents supplied by clients may contain information about other project contacts.
Engagement, invoicing and payment records needed to administer the business.
Technical information handled by our website provider, such as requests, IP addresses and browser or device information, for delivery, security and performance.

Most information comes from you or your organisation. Relevant project information may also come from an authorised representative or documents supplied for review. Please provide only information needed for the service and avoid sending unnecessary identity documents, bank details, health information or other sensitive personal information.

Why we use information and our lawful bases

Enquiries and business relationships: our legitimate interests in answering requests, agreeing scope, managing instructions and providing commercial support. We consider whether the use is necessary and whether the individual’s interests override ours.
Contracts with individuals: where you personally contract with us, or request steps before doing so, processing necessary for that contract or request. This basis does not automatically apply to employees merely because their employer is our client.
Records and legal obligations: compliance with applicable accounting, tax and other legal duties.
Security, complaints and claims: legitimate interests in protecting information, resolving complaints and establishing, exercising or defending rights.

We do not treat an enquiry as consent to unrelated marketing. We do not make decisions about individuals solely by automated processing that produce legal or similarly significant effects.

Sending and storing documents

Start with an enquiry describing the subcontract and deadline. We agree scope, fees, timing and the document-transfer method before the review starts. Email can be used for routine correspondence; confidential or large contract packs require an agreed method appropriate to their contents.

We use the SubProtect business mailbox for correspondence. Before you send confidential contract documents, we agree an appropriate transfer method and the arrangements for handling those documents. Please send an initial enquiry describing your requirements rather than attaching a contract pack.

Who may receive information

We use Namecheap Private Email to host our business mailbox, Microsoft Outlook to access and manage email, Cloudflare for website delivery and related technical services, and Voipfone for our business telephone service and call forwarding. These providers handle information needed to provide the services we use. Where Outlook cloud-connected features are used, Microsoft may also process or synchronise mailbox information. The website host is not used as a client-document archive.

Relevant information may also be shared with authorised people providing the agreed service, professional advisers or insurers where necessary, and public authorities where legally required. We limit sharing to the purpose concerned. We do not sell personal information. Any additional document-storage, transfer or AI provider must be assessed before client information is sent to it.

International processing

Our email and website providers operate internationally, so information may be processed outside the United Kingdom. Local storage of working files does not mean that email and website data stay in the UK.

We have asked Namecheap to confirm the current UK international-transfer safeguards applicable to our Private Email service and are awaiting its response. We are reviewing the arrangements applying to our providers and will update this notice when those details are confirmed. Contact us for the information currently available about international processing. Please do not send confidential contract packs with an initial enquiry.

How long we keep information

We retain information for as long as needed for the purpose for which it was collected, including answering enquiries, providing the agreed service and meeting legal, accounting, insurance and claims requirements. The relevant period depends on whether an enquiry becomes an instruction, the engagement terms, the nature of the records and any ongoing dispute or legal obligation. Information no longer needed is deleted or anonymised. You can contact us about retention of your particular records.

Your rights

Depending on the circumstances, you may request access to your information, correction, erasure, restriction or portability. You may object to processing based on legitimate interests, including explaining your particular circumstances. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Rights can be subject to legal conditions and exemptions.

Contact us using the details above. We may need proportionate information to verify your identity. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

Website analytics and advertising

Cloudflare provides the website infrastructure and may process operational and security information. Our hosting configuration includes Cloudflare Web Analytics for website performance measurement. Cloudflare states that its Web Analytics service does not use cookies or local storage for analytics.

This website does not include Google Analytics, Google Ads conversion tags or remarketing tags. Any new advertising or tracking technology will be assessed separately and, where required, used only after consent. This notice will be updated when the actual configuration changes.

Providing information and changes to this notice

We need sufficient business contact and project information to respond and carry out an agreed review. If essential information is not supplied, we may be unable to provide the service. Additional information is optional unless needed for a stated purpose.

We will update this notice when the way we handle information changes. Material changes affecting existing clients will be brought to their attention where appropriate.