Privacy Policy.
How Cultural Heritage Risk Management Ltd collects, uses and protects your personal data, in accordance with the UK GDPR and the Data Protection Act 2018.
Last updated: September 2026
1. Who we are
Cultural Heritage Risk Management Ltd ("we", "us", "our") is the data controller for the personal data described in this policy. We are a company registered in England and Wales, company number 17420010, with registered office at Grosvenor House, 3 Chapel Street, Congleton CW12 4AB. You can contact us about privacy or your data at neil@culturalheritageriskmanagement.com.
2. What this policy covers
This policy explains what personal data we collect through this website and in the course of our consultancy work, why we collect it, the legal basis on which we use it, who we share it with, how long we keep it, and the rights you have under UK data protection law.
3. The personal data we collect
When you use our contact form or email us, we collect the information you choose to provide, which is typically your name, your email address, and the subject and content of your message. If you go on to work with us, we may hold further business contact and project information necessary to deliver and administer that work.
When you visit the website, our hosting provider automatically records limited technical information in server logs, such as your IP address, browser type and the pages requested, which is used to operate the site securely and reliably.
4. How we use your data, and our legal basis
We use the personal data you provide to respond to your enquiry, to discuss and scope potential work, and to provide our services. Our lawful bases under Article 6 of the UK GDPR are:
- Steps prior to a contract, and performance of a contract (Article 6(1)(b)) where you contact us about, or engage us for, our services.
- Legitimate interests (Article 6(1)(f)) in responding to enquiries, managing our client relationships and running our business, balanced against your rights and freedoms.
- Legal obligation (Article 6(1)(c)) where we must retain records for tax, accounting or other legal requirements.
We do not use your data for automated decision-making or profiling, and we do not send marketing emails without your consent.
5. Cookies
This website uses only the cookies strictly necessary for it to function and be served securely. It does not currently use advertising or analytics cookies. If we introduce non-essential cookies in future, we will update this policy and ask for your consent before they are set.
6. Who we share your data with
We do not sell your personal data. We share it only with service providers who process data on our behalf, under contract and on our instructions, including our website hosting and contact-form provider and our email and office software provider. These providers act as our data processors and are permitted to use your data only to provide their service to us.
Some of these providers are based outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses).
We may also disclose personal data where we are required to do so by law, or to establish, exercise or defend legal claims.
7. How long we keep it
We keep enquiry correspondence for no longer than is necessary to deal with your enquiry and for a reasonable period afterwards in case you contact us again, and we then delete it. Where you become a client, we retain project and financial records for as long as needed to deliver the work and to meet our legal, tax and professional obligations, typically at least six years after the end of the engagement.
8. Your rights
Under the UK GDPR you have the right to access the personal data we hold about you, to have it corrected if it is inaccurate, to have it erased, to restrict or object to our processing of it, to data portability, and, where we rely on consent, to withdraw that consent at any time. To exercise any of these rights, email us at neil@culturalheritageriskmanagement.com. We will respond within one month.
If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns first.
9. Data security
We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and we use reputable providers who maintain their own security measures.
10. Changes to this policy
We may update this policy from time to time. The current version is always the one published on this page, and the date at the top shows when it was last revised.