How we handle your data.

Who we are

WM Commercial Advisory Ltd is the data controller for the personal data described here. We are a company registered in England and Wales, company number 17230385, with a registered office at 23 Silver Street, Stony Stratford, Milton Keynes MK11 1JS.

If you have a question about this notice, or you want to exercise any of the rights set out below, email [email protected] and we will come back to you within a month.

What we collect, and why

When you get in touch

If you email us or book a call, we hold your name, email address, employer and whatever you choose to tell us about what you are trying to do. We use it to reply, to work out whether we can help, and to keep a record of the conversation. Our lawful basis is legitimate interests — responding to someone who has approached us about our services — and, where a piece of work follows, taking steps to enter into a contract with you.

When you use the Commercial IQ diagnostic

The diagnostic asks for an email address so we can send you your results. Your answers and your address are used to produce and send that email, and to follow up if the results suggest we could be useful. Our lawful basis is legitimate interests, and you can ask us to delete the record at any time.

When you visit the site

Our hosting provider records standard server information, including your IP address, browser type and the pages requested. This is used to keep the site running and protect it from abuse, on the basis of our legitimate interests in security and reliability.

Analytics

We use Plausible Analytics to count page views and see which pages are read. Plausible does not use cookies, does not store IP addresses, and produces only aggregate figures that cannot be traced back to an individual. Our lawful basis is legitimate interests in understanding how the site is used.

Visitor identification (only if you accept)

If you accept cookies, we use Apollo’s website tracker, which uses your IP address and cookies to estimate which organisation you are visiting from and which pages you looked at. We use it to see which kinds of business are interested in the practice, and occasionally to reach out to a company that has been reading. It runs only with your consent, it does not run at all if you reject or ignore the banner, and you can withdraw consent at any time using the “Cookie settings” link in the footer.

Cookies

The site itself sets no cookies in order to function, and neither the page-view analytics nor the fonts we load place cookies on your device. The only cookies used here are those set by Apollo’s tracker, and they are set only after you press Accept on the cookie banner. We also store your banner choice locally in your browser so we do not ask you again on every page; that record stays on your device and is never sent to us.

If you reject cookies, nothing about the site stops working. To change your mind in either direction, use the “Cookie settings” link at the foot of any page.

Who we share it with

We do not sell personal data, and we do not share it for anyone else’s marketing. We do rely on a small number of service providers who process data on our behalf:

• Cloudflare — hosts the website and serves it to you.
• Plausible Analytics — cookieless, aggregate page-view statistics.
• Apollo — visitor and company identification, only where you have consented.
• Resend — sends the Commercial IQ results email.
• Google — provides the calendar used to book an exploratory call, and our email.

Some of these providers are based outside the UK, principally in the United States. Where data is transferred internationally, it is protected by the safeguards UK data protection law requires, such as the International Data Transfer Agreement or the UK extension to the EU–US Data Privacy Framework.

We will also disclose personal data where the law requires it, or where we need to establish or defend a legal claim.

Client work

Where we are engaged by a client, the client normally remains the controller of any personal data in the material they give us, and we act as their processor under the terms of our engagement contract. We use that data only to do the work, we do not use it for anything of our own, and we return or securely delete it on request at the end of the engagement, apart from one archival copy retained for professional record-keeping and insurance purposes. Wherever the work allows, we ask for data in anonymised or aggregated form.

How long we keep it

Enquiries and diagnostic records are kept for up to two years from our last contact, so that we can pick up a conversation where it left off, and then deleted. Records relating to an engagement are kept for six years after it ends, which is the period during which a claim could still be brought and the period our accountants and insurers expect us to be able to evidence the work. Server logs are kept for a short period by our hosting provider. Aggregate analytics carry no personal data and are kept indefinitely.

Your rights

Under UK data protection law you can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict how we use it, or send it to another provider. Where we rely on legitimate interests, you can object to what we are doing and we will stop unless we have compelling grounds to continue. Where we rely on consent, you can withdraw it at any time, which does not affect anything done before you withdrew it.

Email [email protected] to make any of these requests. There is normally no charge.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling their helpline on 0303 123 1113. We would rather you raised it with us first so we have a chance to put it right.

Changes to this notice

We will update this page when what we do with data changes, and the date at the top will tell you when it last happened.