Last updated: 25/03/2026
This Privacy Notice explains how HewardMills Ltd, its subsidiaries and affiliated entities located globally, including HewardMills Holdings Limited, HewardMills Ireland Limited and HewardMills DPO Ghana (hereinafter “HewardMills”, “we”, “us”, “our”), process and protect personal data about you (“personal data”) when you use our website or our Services.
We are a global provider of data protection and privacy services. We provide regulatory advice and expert support to help organisations comply with global data protection and privacy laws and regulations (collectively our “Services”), including but not limited to the GDPR (EU & UK), the CCPA, ePrivacy Regulations and cybersecurity requirements, as well as legal and regulatory requirements arising from emerging technologies (collectively “applicable data protection laws”). We can be contacted at the DPO address given at the end of this document.
This Privacy Notice explains how we use your personal data when you interact with us directly, including when you visit our website, contact us with an enquiry, subscribe to marketing communications, and engage with us as a client or prospective client
This Privacy Notice may change over time. Changes will be reflected in the “Last Updated” field above.
What personal data do we collect and why?
HewardMills is committed to being transparent about how your personal information is used and will only collect and process the personal information we need for a specified, legitimate purpose. We collect personal information in several ways, including directly from you, and automatically when you use our digital platforms.
The table below outlines the general categories of personal information we collect, the purpose for which we process it, and the legal basis we rely on to do so.
| Categories of personal data | Types of Personal Data | Purpose for processing | Lawful basis |
| Business Contact Information
|
|
|
|
| Website Visitors’ Information
|
|
|
|
| Analytics Data (Google Analytics) |
|
|
|
| Client and Prospect Data
|
|
|
|
| Communications Data |
|
|
|
HewardMills does not knowingly collect or process special categories of personal data.
Disclosure of your personal data
We may sometimes need to disclose personal data for the following purposes:
- Performance of the contract: We may disclose your personal data with our affiliates, business partners, suppliers, contractors, and other third parties when necessary for the performance of a contract we enter into with you. This includes the use of third parties for administrative purposes and to facilitate the provision of our products and services to you. Such third parties may include IT support providers, CRM platforms, hosting services, cloud-based software solutions, and telecommunications equipment providers.
- Direct Marketing: We may disclose your personal data to our business partners for the purpose of direct marketing, but only where you have provided explicit consent. This allows us to send you marketing communications about our products and services that we believe may be of interest to you.
- Legal obligation. We may be required by law or pursuant to a court order to disclose certain personal data to relevant regulatory, law enforcement, and/or other competent authorities.
- Legal claims: We may need to share personal data to exercise or defend legal claims.
- Business transfers: As we continue to develop our business, we might sell or buy other businesses or services. We may need to disclose personal data as part of a merger, acquisition, bankruptcy, or similar process.
Marketing Communications and Third-Party CRM Platform
We may use your personal data to send you communications about news, regulatory updates, events, products, and services that we believe may be of interest to you. These communications may be delivered via email, telephone, or other channels, in accordance with your communication preferences and applicable laws. We rely on your consent to process your personal data for third-party marketing purposes, and our legitimate interest as a business for sending you information where you have previously contacted us. You have the right to withdraw your consent or opt out of receiving marketing communications from us and others at any time by following the unsubscribed instructions provided in our communications or by contacting us directly.
To manage and facilitate these communications, we utilise a Customer Relationship Management (CRM) platform. This platform allows us to store, organise, and analyse your personal data to provide you with personalised and relevant information, including your contact information, track engagements with our messages, and personalise future communications based on your interactions and business profile.
When you engage with our marketing emails or forms (for example, by opening an email, clicking a link, or submitting a form), the CRM platform collects associated data such as your IP address, device and browser information, email open and click behaviour, subscription preferences, communication history and general location data (such as your country) inferred from your IP address. This helps us measure the effectiveness of communications and improve future campaigns. We do not use this data for automated decision-making that produces legal or similarly significant effects.
We ensure that any service provider we engage, including our CRM platform provider, complies with applicable data protection laws and implements appropriate technical and organisational measures to safeguard your personal data. We do not sell, rent, or lease your personal data to third parties for their own marketing purposes.
International Data Transfers
HewardMills operates in many countries around the world. As a global DPO service provider, we may need to transfer personal information outside of the location where such personal information is collected (an “international data transfer”). For transfers outside of the UK or EEA, we may transfer personal information to countries with “adequate” data protection standards as recognised by the European Commission (in the EEA) or the Secretary of State (in the UK).
When conducting an international data transfer to a country without “adequate” data protection standards, we will apply the necessary safeguards to protect personal information as required under law. Such safeguards may include “Standard Contractual Clauses” (SCCs) that require the person receiving the personal information to protect the personal information to a high standard, and any other necessary technical or organisational safeguards.
Minors
HewardMills does not allow anyone under the age of 18 to use HewardMills services and does not knowingly collect personal data from children under the age of 18. Should we mistakenly collect a child’s personal data without appropriate authorization, it would be immediately deleted.
Third-Party Websites?
Our websites and apps may contain links to third-party websites and apps. By clicking on these links, you would leave our website and be directed to third-party websites. We are not responsible for the processing of your personal data taking place on these third-party websites or their content. The terms of this Privacy Notice do not apply to these third-party websites or apps, or to any collection of your Personal data after you click on links to such third-party websites. We encourage you to read the privacy policies of every website you visit.
Cookies and Other Technologies
We use cookies and similar tools to enhance our ability to deliver our services, to understand how clients and customers use our services so we can improve our customer experience. For more information about cookies and how we use them, please read our Cookie Notice. You can manage your cookie preferences here
We use Google Analytics, a web analytics service provided by Google LLC, to understand how visitors use our website and to improve website performance.
Google Analytics uses cookies and similar technologies to collect information such as:
- IP address (with anonymisation enabled where technically available)
- Device and browser information
- Pages visited
- Session duration
- Interaction data
This data helps us analyse website traffic trends and improve user experience.
For users in the UK and EEA, analytics cookies are deployed only with your consent. You may withdraw or manage your consent at any time here.
Data collected via Google Analytics may be transferred to and processed in the United States or other jurisdictions where Google operates. Where personal data is transferred outside the UK or EEA, we implement appropriate safeguards to ensure protection of personal data.
Your Rights
At HewardMills, the satisfaction of our customers is of central importance. We respect your rights concerning the processing of personal data and provide you with the relevant and appropriate choices. Depending on your location and residency, you may have a right to one or more of the following with respect to your personal data we process or control. Details about these rights and how to exercise them are provided below.
We will aim to comply with your request within one month of receiving your request. Depending on the complexity and scope of your request, we may need to extend this period to a maximum of three months. If so, we will notify you via the contact information you have provided, explaining the reason for the extension and the expected timeframe for fulfilling your request.
To exercise any of your rights, please contact our designated privacy contact here: dpo@hewardmills.com providing details of your request.
Note that you may have the right to designate another person to serve as your authorised agent, to exercise any of the rights described below.
- THE RIGHT OF ACCESS
You have the right to access a copy of your personal data and to request information about how we process your personal data. This includes information about the purposes of the processing, the categories of personal data we process, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.
- THE RIGHT TO RECTIFICATION
You have the right to request that we correct any inaccurate personal data we process about you, and to request that we complete any incomplete personal data we process about you.
- THE RIGHT TO ERASURE
You have the right to request that we erase your personal data under certain conditions, e.g., if the information is no longer needed for its intended purposes, if you have withdrawn your consent, if you have made a valid request under the “right to object”, if the information has been processed unlawfully, or to comply with a legal obligation.
- THE RIGHT TO RESTRICT PROCESSING
You have the right to request that we restrict how we process your personal data if:
- You claim that the personal data is inaccurate, and we need time to verify this; or
- The processing is unlawful, but you do not want the personal data erased; or
- The personal data is no longer needed for the purposes for which it was collected, but you still need it to establish, exercise or defend legal claims; or
- You have exercised the right to object, and we need time to determine whether to comply with your objection, under certain circumstances.
If you make a valid request to restrict the processing of your personal data, we will continue to store the information. We will not process the information in any other ways, unless we have your consent; we need the personal data to establish, exercise or defend legal claims; we need to protect the rights of another natural or legal person; or we need to process the personal data for reasons of important public interest.
- THE RIGHT TO OBJECT
You have the right to object to the processing of your personal data under certain conditions. You have the absolute right to object to us using your personal data for direct marketing.
In other circumstances, we might decline your objection, but only if we can demonstrate “compelling legitimate grounds” to continue processing your personal data. The right to object only applies where our legal basis for processing your personal data is for our “legitimate interests” or where we are performing a “public task”. For more information about our legal bases for processing, see the relevant part of our Privacy Notice above.
- THE RIGHT TO DATA PORTABILITY
Under certain conditions, you have the right to request a copy of the personal data you have provided to us in a structured, commonly used, and machine-readable format. Where technically feasible, we will also transmit this personal data to another organization at your request. This right only applies to digital information that we collected from you with your consent, or that we collected as part of a contract or proposed contract with you.
- RIGHTS IN RELATION TO AUTOMATED DECISION MAKING AND PROFILING
You have certain rights relating to “solely automated individual decision-making, including profiling”. A “solely automated individual decision” is a decision made by an automated system that does not involve a human. We are not allowed to make solely automated decisions that affect your legal rights or other similarly important matters unless (I) we need to do so under a contract with you, (ii) we are allowed to do so by law, or (iii) we have your consent. In these cases, you have the right to request a human review of the decision, to challenge the decision, and to request an explanation of the decision.
- RIGHT TO LODGE A COMPLIANT WITH SUPERVISORY AUTHORITY
You have the right to complain to your local supervisory authority if you have concerns about how we are processing your personal data. We encourage you to try and resolve the issue with us first, although you have the right to contact the supervisory authority at any time. The UK Supervisory authority is the Information Commissioner, who can be contacted via their website at https://ico.org.uk. The Irish (EEA) Supervisory authority is the Data Protection Commission, who can be contacted via their website at https://www.dataprotection.ie.
Data security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Data Retention
We will store your personal data for no longer than is necessary to fulfil the purposes described in this Privacy Notice. We may also be legally required to store personal data for a specific period as may be required for tax and accounting purposes, compliance with anti-money laundering laws, or as otherwise communicated to you. When considering retention periods, we first carefully assess whether it is necessary to retain the personal data collected and, if retention is required, we endeavour to retain the personal data for the shortest term permitted by law.
Contact Information
If you wish to leave a comment, raise a question, exercise your rights or learn more about the processing or your personal data by HewardMills, please do not hesitate to contact us at 77 Farringdon Rd London EC1M 3JU UK / dpo@hewardmills.com.
