This notice explains how Harwick Intelligence collects and uses personal information. It is written in plain English and follows the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Harwick Intelligence Limited, registered in England and Wales under company number 17545458, is the data controller for the personal information described in this notice. Our registered office is:
Harwick Intelligence Limited
71-75 Shelton Street
Covent Garden
London
WC2H 9JQ
We are registered with the Information Commissioner’s Office (ICO) under registration reference ZC286587.
If you have a question about this notice or how we handle your personal information, please contact us.
People investigated, witnesses and people incidentally appearing in evidence should also read our privacy notice for subjects of enquiry.
Information we collect
The personal information we collect depends on how you interact with us. Broadly, we collect:
- Information you give us when you make an enquiry — such as your name, organisation, email address, telephone number, and a description of the matter you wish to discuss.
- Information you give us when we are instructed — including any documents, correspondence, photographs, or other material you provide for the purposes of the investigation.
- Information about subjects of investigation — where we are instructed to investigate a third party, we will process personal information about that individual to the extent necessary and proportionate to the investigation.
- Information collected during an investigation — observation logs, photographs, video, and information obtained from open sources, public records, and other lawful means.
- Information about your use of our website — limited technical information collected by our hosting provider for security and reliability, and website usage statistics collected through Umami Cloud as described below.
How we use your information
We use personal information for the purposes set out below. The lawful basis on which we rely under the UK GDPR is shown alongside each purpose.
- To respond to enquiries — legitimate interests (responding to a request you have made).
- To deliver investigation services to clients — performance of a contract with you, or where instructed by an organisation, the legitimate interests of that organisation as our client.
- To process information about subjects of investigation — legitimate interests of our client, balanced against the rights and freedoms of the subject. Where we rely on legitimate interests, we document the purpose, necessity and balance against individuals’ rights for the relevant processing.
- To meet our legal and regulatory obligations — including obligations under the Proceeds of Crime Act 2002, anti-money-laundering legislation, and tax law.
- To establish, exercise, or defend legal claims — legitimate interests in protecting our position.
Sensitive information and criminal allegations
A general lawful basis alone does not authorise us to process every kind of information. Health, sex-life, and other special category data require an additional condition under Article 9 of the UK GDPR. Criminal offence data, including allegations, require authority under Article 10 and the applicable UK law. The relevant condition and safeguards must be identified before that processing begins.
Who we share your information with
We do not sell personal information. We share information only where it is necessary for the purposes set out above, including:
- With our client and their advisers, where you are the subject of an instructed investigation;
- With your solicitor or other professional advisers, where you have asked us to do so or where you have instructed us through them;
- With law enforcement, regulators, or other authorities where we are required to do so by law (including any obligations to file Suspicious Activity Reports under the Proceeds of Crime Act 2002);
- With our service providers (such as our IT and hosting providers) who process personal information on our behalf and under written instructions.
If you pay online, we share your invoice reference and payment amount with Stripe to arrange the payment. Stripe collects your payment and billing details on its checkout page. We receive payment records for reconciliation; card details are not entered on this website. See Stripe’s privacy notice for how it handles payment information.
How long we keep your information
We retain personal information only for as long as necessary for the purposes for which it was collected. In practice this means:
- Enquiries that do not lead to instruction — typically retained for up to 12 months, then securely destroyed.
- Investigation case files — generally scheduled for review and deletion six years after the engagement ends, with shorter retention for irrelevant material and specific exceptions where legal claims, legal holds or other necessary obligations require them to be kept. Specific retention periods are set out in our engagement letter.
- Records required by law — retained for the period required (for example, tax records for six years from the end of the financial year).
International transfers
We aim to keep personal information in the United Kingdom or the European Economic Area. Where information must be transferred outside these areas (for example, to a service provider), we will ensure that an appropriate transfer mechanism is in place — such as an adequacy regulation or the UK International Data Transfer Agreement.
Your rights
Under the UK GDPR you have a number of rights in relation to your personal information. These include:
- The right to be informed about how your information is used (this notice);
- The right of access to the personal information we hold about you;
- The right to have inaccurate personal information corrected;
- The right to have personal information erased in certain circumstances;
- The right to restrict processing in certain circumstances;
- The right to object to processing carried out on the basis of legitimate interests;
- The right to data portability in certain circumstances.
Some rights are subject to conditions or specific legal exemptions. An ongoing investigation does not automatically remove your rights. Any restriction must be assessed against the applicable provision of the Data Protection Act 2018 and justified for the particular request.
To exercise any of these rights, please contact us.
Cookies and website analytics
We use Umami Cloud to understand how people use this public website and improve its content. It collects page views, referring pages, browser and device information, language and approximate location. Umami’s web tracker does not use cookies. We do not send contact-form contents, invoice references or named visitor identifiers to Umami; query strings and URL fragments are excluded from page and referrer URLs. We do not enable session recordings or advertising tracking.
We rely on our legitimate interest in understanding and improving our website, using limited usage statistics. Where your browser supplies an enabled Do Not Track preference, our Umami configuration disables analytics tracking. This does not prevent the script download or necessary infrastructure logs. See our cookie policy and Umami’s privacy policy for further information.
How to complain
If you are unhappy with how we have handled your personal information, please contact us first so that we have an opportunity to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk ↗
Changes to this notice
We may update this notice from time to time to reflect changes in our practices, the law, or guidance from the ICO. The version date at the top of this page indicates when the notice was last reviewed.