Infrastructure AdvisoryLegal
Privacy notice
How Westheath Infrastructure Advisory handles personal data when you use this UK-operated website, contact the practice or send an enquiry by email.
Last updated: 2026-08-27
This notice explains what we do with personal data when you visit this website or contact us. It is short because we do very little with it.
1. Who we are
This website is operated by WESTHEATH MANAGEMENT CONSULTANCIES LIMITED, company number 15808364, registered in England and Wales, whose registered office is 2nd Floor College House, 17 King Edwards Road, Ruislip, London, HA4 7AE, United Kingdom. We are the controller of the personal data described in this notice.
We trade as Westheath Infrastructure Advisory, and we operate this single website from the United Kingdom. Details of all the Westheath companies are on our Company information page.
We have not appointed a Data Protection Officer. We are a small practice and are not required to appoint one.
2. How to contact us
For anything to do with this notice or your personal data, email advisory@westheath.uk, or write to us at our registered office marking your letter for the attention of the principals.
3. What personal data we handle
If you email us or send us an enquiry: your name, your email address, the organisation you work for or represent, any job title or contact details you choose to include, and whatever you tell us about the matter you are enquiring about — including, if you choose to include them, details about other people. We also keep the correspondence itself.
If you visit the site: our web server keeps standard technical records of requests, including IP address, the page requested, the date and time, and basic browser information. These are ordinary server records kept to run the site securely and reliably. We do not use cookies, analytics identifiers or tracking technology of any kind — see our Cookies page.
We do not ask for, and do not want, special category data — health, ethnicity, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation — or details of criminal offences. Please do not include them in an enquiry. If your matter genuinely requires us to discuss such information, tell us and we will agree how to handle it properly before you send it.
4. Why we handle it, and on what basis
| What we do | Why | Lawful basis |
|---|---|---|
| Read, consider and respond to your enquiry | So we can answer you and decide whether we can help | Legitimate interests — responding to enquiries about our services. Where you are yourself the prospective client, also steps taken at your request before entering a contract |
| Keep a record of correspondence | So we know what was said, can pick up a conversation later, and can check for conflicts before taking on work | Legitimate interests — running our practice properly and keeping accurate records |
| Run and secure this website, including server records | So the site works and is protected against misuse | Legitimate interests — operating and securing our own website |
| Meet a legal or regulatory obligation, where one applies to us | Because we have to | Legal obligation |
We do not rely on your consent for any of this, so there is nothing for you to consent to and nothing for you to withdraw. We do not send marketing emails, we do not have a mailing list, and we will not add you to one. If that ever changes we will ask you first, separately, and you will be able to say no.
We do not carry out profiling or automated decision-making. No decision affecting you is made by automated means.
5. Who else sees it
Your enquiry is read by the principals of the practice. It is not sold, rented or shared for anyone else's marketing, and it is not passed to any third party for their own purposes.
We use service providers who handle personal data on our instructions and on our behalf, under contracts that require them to keep it secure and to use it only for the services they provide to us:
- Microsoft, for our email and Microsoft 365 services;
- Replit, Inc., which hosts this website.
We may also disclose personal data where we are required to do so by law, by a court, or by a regulator.
6. Where it is handled
Our email is provided by Microsoft 365, and the Microsoft data location for our mailbox service is the United Kingdom.
This website is hosted by Replit, Inc., which is based in the United States. Website hosting is separate from our email, and hosting and the technical records associated with it may involve processing in the United States and in other countries.
Where personal data is transferred outside the United Kingdom, we rely on the transfer safeguards provided for in our agreement with the provider concerned — for example the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or an applicable adequacy or data-bridge arrangement. You can ask us which safeguards apply and for a copy of them — see section 2.
7. How long we keep it
We keep personal data only for as long as we need it, and no longer. In practice:
- an enquiry we cannot help with, or that goes no further: we keep the correspondence for a short period so that we have a record of what was asked and what we said, and then delete it;
- an enquiry that leads to a discussion but not an appointment: we keep it while the possibility is live, and for a reasonable period afterwards, in case it revives;
- an enquiry that leads to an appointment: it becomes part of the engagement record, and is kept for as long as we keep records for that engagement — which is governed by our professional and legal obligations, not by this notice;
- server records: kept for a short period for security and reliability, then deleted or overwritten.
When we no longer need personal data, we delete it or put it beyond use. If you want to know what we hold about you, or want it deleted sooner, ask us — see section 9.
8. How we keep it safe
Enquiries are held in a business email system with access controls, and are readable only by the principals of the practice. Access is limited to the people who need it. The website is served over an encrypted connection, is a static site with no database, no user accounts and no login, and the contact form does not send, store or transmit anything.
No system is perfectly secure, and email in particular is not a secure channel. Please do not send us confidential or sensitive material in an initial enquiry. Tell us what the matter concerns, and we will agree a secure way to exchange anything sensitive.
9. Your rights
You have the right to:
- ask what we hold about you and get a copy of it;
- have it corrected if it is wrong or incomplete;
- have it deleted, in the circumstances where that right applies;
- ask us to restrict how we use it, in the circumstances where that right applies;
- object to our using it where we rely on legitimate interests — including, always and without needing a reason, to direct marketing;
- ask for it in a portable form, in the circumstances where that right applies.
To exercise any of these, email advisory@westheath.uk. We will respond within one month. We will not charge you, and we will not ask you to justify the request. We may need to check who you are before we act.
10. Complaints
Please tell us first if you are unhappy with how we have handled your personal data — email advisory@westheath.uk. We would rather put something right than have you go elsewhere with it.
You also have the right to complain to a supervisory authority:
- United Kingdom — the Information Commissioner's Office, ico.org.uk, helpline 0303 123 1113;
- Ireland and the EU — the Data Protection Commission, dataprotection.ie, or the supervisory authority in the EU country where you live or work.
Complaining to us first does not affect your right to complain to them.
11. Changes to this notice
We may update this notice. The version published here is the current one, and the date at the top tells you when it last changed. If we change it in a way that materially affects how we use your personal data, we will make that clear on this page.