Privacy Notice

1. Who we are

Z&S Advisory LLP (“we”, “us”, “our”) is the controller of the personal data described in this notice. We are a limited liability partnership registered in England and Wales under number OC459126, with our registered office at 124 City Road, London, EC1V 2NX, United Kingdom.

We have not appointed a Data Protection Officer. If you have any questions about this notice or your personal data, please contact the partners at nikita@zsadvisory.co.uk or write to us at our registered office.

2. The personal data we collect

We collect only the information we need:

• Contact form: your name, email address, phone number (optional) and the content of your message.
• Direct correspondence: the details you choose to share when you email or call us, including any documents you send.
• Technical data: when you visit the website, our hosting provider automatically records standard server logs, such as your IP address, browser type (user agent), the pages requested and the date and time of each request.

If we take you on as a client, we will also collect the information needed to provide our services and to meet our legal obligations, such as identity documents. We will explain this at the start of the engagement.

Please do not send us special category data (for example, information about your health) or information about criminal convictions through the contact form unless it is genuinely necessary for your enquiry.

3. Cookies and tracking

This website does not set any cookies. We do not use analytics, advertising or social media tracking tools, and we do not build profiles of visitors.

Our fonts are hosted on our own server, so your browser does not connect to Google Fonts or any other third-party font service when you visit the site.

4. How we use your data and our lawful bases

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for using your personal data. We rely on the following:

• Steps prior to entering into a contract (Article 6(1)(b)): when you ask us for a consultation or a quote, we use your details to respond and to prepare a possible engagement.
• Legitimate interests (Article 6(1)(f)): to answer general enquiries, manage our correspondence, and keep the website secure and protected against misuse. We have considered these interests and believe they are not overridden by your rights and interests.
• Legal obligation (Article 6(1)(c)): if we take you on as a client, to keep accounting records and to carry out any checks required by law, such as anti-money laundering checks.

We do not use your personal data for marketing, and we never sell it.

Providing your details is voluntary, but we cannot reply to an enquiry without a way to contact you.

5. Who we share your data with

We share personal data only where necessary, with:

• Formspree, Inc. (United States), which delivers messages sent through our contact form to our inbox;
• our website hosting provider (United Kingdom), which hosts the site and keeps its server logs;
• our email service provider, which stores our email correspondence;
• professional advisers (such as accountants or insurers) and public authorities or courts, where this is required by law or needed to establish, exercise or defend legal claims.

Our service providers act as processors on our instructions and are contractually required to protect your data.

If we introduce you to an independent professional (for example, a solicitor or barrister), we will share your information with them only with your agreement.

6. International transfers

Formspree is based in the United States, so information you send through our contact form is transferred outside the UK.

Whenever personal data is transferred outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum to the Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) where the recipient is certified under it. You can ask us for more information about these safeguards.

7. How long we keep your data

• Enquiries that do not lead to an engagement: up to 12 months after our last contact, after which they are deleted.
• Client files: typically six years after the end of the engagement, in line with limitation periods and accounting rules.
• Server logs: kept by our hosting provider for a limited period, typically up to 30 days.

We may keep data for longer where the law requires it or where it is needed in connection with a legal claim.

8. Your rights

Under UK data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased in certain circumstances;
• restrict how we use your data;
• object to our use of your data where we rely on legitimate interests;
• receive your data in a portable format (data portability);
• withdraw your consent at any time, where we rely on consent;
• not be subject to a decision based solely on automated processing that significantly affects you. We do not make such decisions.

To exercise any of these rights, email us at nikita@zsadvisory.co.uk. We will respond within one month. For complex or numerous requests, this period may be extended by up to two further months; if so, we will tell you. We may need to confirm your identity before acting on a request. Exercising your rights is normally free of charge.

9. Complaints

If you have concerns about how we handle your personal data, please contact us first so that we can try to resolve them. We will acknowledge your complaint within 30 days and deal with it without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection authority: ico.org.uk, telephone 0303 123 1113.

10. How we protect your data

The website is served over an encrypted HTTPS connection. Access to enquiries and client information is restricted to the partners and to service providers who need it to perform their services. No method of transmission or storage is completely secure, but we take reasonable steps to protect your information.

11. Children

This website and our services are not directed at anyone under the age of 18, and we do not knowingly collect personal data from children.

12. Changes to this notice

We may update this notice from time to time. The current version will always be available on this page, with the date of the latest update shown at the top.