UK GDPR · Data Protection Act 2018
Privacy Notice
What personal data we collect, why, and what rights you have.
Last updated: 31 July 2026
The UK GDPR requires us to tell you, clearly and openly, what personal data we collect and why, how long we keep it, who we share it with and what rights you have. This notice provides that information for website visitors, enquirers, clients and suppliers.
1. About this notice
Fathom Solutions Group Ltd (“Fathom”, “we”, “us”) is committed to protecting your personal data. This notice explains what personal data we collect, how we use it, and your rights, in accordance with the UK GDPR and the Data Protection Act 2018.
We are the data controller for the personal data described in this notice.
2. Our details
| Item | Detail |
|---|---|
| Controller | Fathom Solutions Group Ltd, company no. 17040942 |
| Registered office | 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ |
| Contact for privacy | privacy@fathomsolutions.co.uk |
| ICO registration | ZC208712 |
3. The personal data we collect
Depending on your relationship with us, we may collect:
- Identity and contact data — name, job title, employer, email, phone, postal address.
- Engagement data — information you provide when enquiring about or receiving our services, including correspondence and information relevant to a project.
- Supplier and associate data — contact, contract and payment details for people and companies we work with.
- Financial data — billing details and payment records (we do not store full card numbers).
- Technical data — IP address, browser and device information, and usage data collected via cookies (see our Cookie Policy).
- Marketing data — your preferences for receiving communications from us.
We do not routinely collect special category data. If an engagement requires it, we will identify a specific lawful basis and condition and put appropriate safeguards in place.
4. How we collect it
We collect personal data directly from you (when you contact us, enquire, engage us, or supply to us), automatically when you use this website (via cookies and analytics), and occasionally from third parties such as publicly available sources, business networks and referrals.
5. How and why we use it — lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and providing information | Legitimate interests; steps prior to a contract |
| Providing our services and managing engagements | Performance of a contract |
| Managing suppliers and associates | Performance of a contract; legitimate interests |
| Invoicing, payments and accounting | Legal obligation; performance of a contract |
| Business administration and improving our services | Legitimate interests |
| Marketing our services to businesses | Legitimate interests / consent (see section 8) |
| Complying with law and regulators | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have considered your rights and interests and are satisfied our use is proportionate and does not override them; contact us for details of that assessment.
6. Who we share it with
We share personal data only where necessary, with: our professional advisers (accountants, lawyers, insurers); our IT and cloud service providers who process data on our behalf under written contracts (for example our email, storage, CRM and accounting providers); subcontractors and associates who support delivery, under confidentiality and data-protection terms; payment and banking providers; and government bodies or regulators where required by law. We do not sell your personal data.
7. International transfers
We aim to keep personal data within the UK. Where a provider processes data outside the UK, we ensure an appropriate safeguard is in place, such as UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.
8. Marketing
We may send you information about our services where you are a business contact and you have not objected, or where you have consented. You can opt out at any time by using the unsubscribe link or contacting us. We handle electronic marketing in accordance with the Privacy and Electronic Communications Regulations (PECR).
9. How long we keep it
| Category | Typical retention |
|---|---|
| Enquiry data (no engagement) | Up to 12 months, then deleted |
| Client and engagement records | Term of engagement plus 6 years (limitation / tax) |
| Financial and accounting records | 6 years (Companies Act / HMRC) |
| Supplier records | Term plus 6 years |
| Marketing preferences | Until you opt out, or 24 months of inactivity |
| Website and analytics data | As set out in the Cookie Policy |
10. Your rights
Under data protection law you have the right to: be informed; access your data; have inaccurate data corrected; have data erased in certain circumstances; restrict processing; data portability; object to processing (including direct marketing); and not be subject to solely automated decisions with legal or similarly significant effects (we do not carry out such automated decision-making). To exercise a right, contact us using the details above. We will respond within one month. There is normally no charge.
11. Security
We use appropriate technical and organisational measures to protect personal data, including access controls, encryption, confidentiality obligations and reputable service providers. We have a process to deal with any suspected personal data breach and will notify you and the ICO where legally required.
12. Complaints
If you have a concern about how we handle your personal data, please contact us first so we can address it. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, by calling 0303 123 1113, or by post to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
13. Changes to this notice
We may update this notice from time to time. The current version is always available on this website.