Privacy Policy
Grieve & Lombard Ltd — United Kingdom
Version: V6
Effective: 20 October 2026
Supersedes: the Online Privacy Notice previously published on this site
This notice explains how Grieve & Lombard Ltd collects and uses personal data. It covers our clients and their people, prospective clients, suppliers and contacts, and visitors to this website.
We update this notice from time to time. Administrative changes are made in place and recorded in the version history at the end. Where a change is significant — a new purpose, a new category of recipient, or a new route by which data leaves the UK — we will bring it to the attention of the people affected rather than rely on this page alone.
Contents
6. Software and AI-assisted tools
8. Sending data outside the UK
1. Who we are
Grieve & Lombard Ltd is a company registered in England and Wales, company number 10934820. Our registered office is 13 Hanover Square, Mayfair, London W1S 1HN and our business address is 7 Alverstoke Gardens, Aldershot GU11 3XA.
We are a data controller within the meaning of the UK General Data Protection Regulation (UK GDPR) and process personal data in accordance with it and with the Data Protection Act 2018.
The person responsible for data protection matters at the firm is Lester Lombard. Write to him at lester@grievelombard.co.uk or at our business address.
Where we act as a data processor on behalf of a controller — for example when running a payroll — we provide a separate schedule as part of that agreement, to be read alongside this notice.
2. What we collect
For clients and their people: identity and contact details, date of birth, national insurance and tax reference numbers, financial and accounting records, information about your business and its ownership, and the identification and verification material we are required to obtain.
For prospective clients and contacts: name, contact details, employer and the content of your enquiry.
For suppliers: contact details and payment information.
For website visitors: technical data about your visit, such as your device, browser, the pages you view and how you reached us. If you accept advertising cookies, we also collect identifiers that let the advertising platforms we use recognise you as a visitor to our site. Our Cookie Policy describes the cookies we use.
3. Why we process it
- To provide professional services and to manage the engagement.
- To meet our legal obligations, including under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
- To meet the professional standards we apply to our work.
- To investigate and defend complaints, claims and legal proceedings.
- To request payment and resolve fee disputes.
- To respond to enquiries and, where you have asked us to, to send you information about our services.
- To protect the forms on our website from spam and abuse.
- Where you accept advertising or analytics cookies, to measure how our website and our advertising perform, and to show our adverts to people who have visited our site.
4. Our legal bases
Performance of a contract — our principal basis for client work, and for taking steps at your request before an engagement begins.
Legal obligation — anti-money laundering, tax administration, statutory filing and record-keeping.
Legitimate interests — practice management, quality and risk review, recovering fees, protecting our own legal position, and protecting our website from spam and abuse. We balance these against your rights and interests.
Consent — for marketing communications you have asked to receive, and for advertising and analytics cookies. You may withdraw consent at any time — for cookies, through the cookie settings on our website — and withdrawal does not affect processing carried out before you withdrew it.
Consent is not the basis on which we carry out client work. Where we ask you for information in the course of an engagement, providing it is a requirement of that engagement; if you do not, we may be unable to act.
5. Who we share it with
- HM Revenue & Customs, Companies House and other regulatory authorities.
- Our anti-money laundering supervisory authority, which may inspect client files as part of a practice review.
- Third parties with whom you ask or permit us to correspond.
- Subcontractors and service providers who support our work, including providers of cloud, email and document systems; accounting, tax and practice-management software; contact-management, marketing and website services, including spam protection for our website forms; identity verification; workflow automation; and AI-assisted tools — see section 6.
- Advertising and analytics platforms, if you accept the relevant cookies — see section 7 and our Cookie Policy.
- Personnel of our South African affiliate, where they perform work on an engagement under our supervision.
- Another practitioner appointed to take over our work in the event of incapacity or death.
- Our professional indemnity insurers and, where instructed, our legal advisers.
- Where the law allows or requires it: the police and other law enforcement agencies, the courts and tribunals, and the Information Commissioner’s Office.
We do not sell personal data. LinkedIn, Meta and Google use what they receive for advertising for their own purposes as well as ours, as section 7 explains. Nobody else receives your personal data for marketing.
6. Software and AI-assisted tools
We use software tools, including AI-assisted tools, to help us prepare, review, analyse and produce work. Some of these are agentic — they act on files and systems to carry out multi-step tasks on our instruction rather than only reading information. Work produced with these tools is directed and overseen by a member of the firm, who remains responsible for it.
Where such a tool processes personal data on our behalf, the provider acts as our processor under a written agreement that restricts use of the data to providing the service to us, and, for our AI-assisted tools, prohibits use of our clients’ content to train the provider’s AI models, and requires appropriate security and, where relevant, international transfer safeguards.
We do not use these tools to make automated decisions about you. We remain responsible for every professional judgement and every piece of advice. These tools work across our own systems — including email, documents and accounting records — to carry out the tasks we give them, and use the information only for the purposes set out in section 3.
7. Advertising and analytics
We use advertising and analytics platforms only where you accept the relevant cookies. The platforms we use at present are LinkedIn, Meta and Google. If we add a platform, we will name it here before we use it.
If you accept advertising cookies, our website passes information about your visit — the pages you view and identifiers stored in your browser — to LinkedIn through our HubSpot account. LinkedIn uses it to tell us how our adverts perform and to show our adverts to people who have visited our site.
We and LinkedIn are joint controllers for collecting that information on our site and passing it to LinkedIn. Once LinkedIn has it, LinkedIn is responsible for what it does with it, including any use for its own purposes, under its own privacy policy. You can exercise your rights against us, against LinkedIn, or both.
We do not upload our contact lists to LinkedIn.
Nothing is passed to LinkedIn unless you accept advertising cookies, and you can withdraw that consent at any time through the cookie settings on our website. LinkedIn also lets you control the adverts you see through your account settings.
Meta and Google work in the same way. If you accept advertising cookies, our website passes information about your visit to Meta, which runs Facebook and Instagram, and to Google, so that we can measure our adverts on their platforms and show them to people who have visited our site. We and each of them are joint controllers for collecting that information on our site and passing it on; once they have it, each is responsible for what it does with it under its own privacy policy, and you can exercise your rights against us, against them, or both.
If you accept analytics cookies, our website also uses Google Analytics to tell us how the site is used. For that service Google acts as our processor.
8. Sending data outside the UK
Your personal data is processed primarily in the United Kingdom. Some of our providers, and our South African affiliate, process personal data outside the UK — including in the United States, the European Economic Area and South Africa.
Where we transfer personal data outside the UK we rely on the mechanisms recognised under UK data protection law: the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses, supported by a transfer risk assessment and appropriate safeguards. Where UK adequacy regulations cover a transfer — for the country concerned, or for a recipient certified under a framework those regulations recognise — we rely on those.
You may ask us for details of the safeguards applying to any specific transfer.
9. How long we keep it
- Tax compliance records — seven years from the end of the tax year to which they relate.
- Ad hoc advisory work — six years from the end of the business relationship.
- Data needed across more than one year, such as capital gains base costs and claims and elections submitted to HMRC — for the duration of the relationship and six years afterwards.
- Enquiries that do not become engagements — 12 months.
- Anti-money laundering records — five years from the end of the business relationship, as the Regulations require, unless a longer period above applies.
- Cookie data — for the cookie lifetimes shown in our cookie consent manager. Advertising platforms keep what they receive under their own policies.
These periods match those in our terms of business and in our engagement letters. Where you ask us to hold something for longer, we will.
You remain responsible for retaining your own records.
10. Your rights
You have the right to ask us for access to your personal data, to have inaccurate data corrected and incomplete data completed, to have data erased, to restrict or object to processing, and to receive certain data in a portable form — in each case subject to the conditions in UK GDPR.
Send requests to Lester Lombard at lester@grievelombard.co.uk. We will respond within one month of receiving your request, extendable by a further two months where the request is complex, and we do not charge for dealing with a subject access request. We may ask you for information to confirm your identity and to help us locate what you are looking for.
Some rights are qualified. Where we are required by law to retain information, or where it is needed to establish or defend a legal claim, we may not be able to erase or restrict it.
11. Automated decision-making
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. If you accept advertising cookies, the advertising platforms we use rely on the information to decide which of our adverts to show you. That is profiling, but it has no such effect.
12. Complaints
If you are unhappy with how we have handled your personal data, please complain to us first — by email to Lester Lombard at lester@grievelombard.co.uk or in writing to our business address. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or at ico.org.uk. We would ask you to raise it with us first so that we have the chance to put it right.
Version history
V6 — 20 October 2026. Recipients described by category rather than by provider, so that a new provider within an existing category does not require a revised notice; the separate HubSpot and Google entries are absorbed into those categories. Description of oversight of software and AI-assisted tools aligned with how the firm works, and their use of information tied to the purposes in section 3. Transfers described without naming providers; reliance on UK adequacy regulations extended to recipients certified under a recognised framework. Advertising and analytics platforms described as a category, with LinkedIn, Meta and Google named in section 7 and the Meta and Google advertising position set out alongside LinkedIn’s; Google Analytics disclosed. Commitment on model training limited to AI-assisted tools.
V5 — 13 October 2026. Advertising on LinkedIn disclosed, with joint-controller position, at new section 7. HubSpot and Google (form protection) added as recipients. US processing by those providers disclosed. Consent extended to advertising cookies. Automated decision-making statement narrowed to decisions with legal or similarly significant effects, as advertising involves profiling. Complaints handling updated for the right to complain to us first. Sections 7 to 11 renumbered 8 to 12.
V4 — Not published. Rewritten for UK GDPR. EEA and EU references replaced with UK equivalents; transfers rely on the UK IDTA or UK Addendum. Disclosure of AI-assisted and agentic tooling added. Retention periods aligned to our terms of business. References to a Data Protection Officer removed; the firm does not meet the appointment criteria and none is appointed. References to a named professional body and to OPBAS removed. South African affiliate processing disclosed. Version history introduced.