Privacy Policy

Last updated: 11 October 2026

Hills & Associates UK ("we", "us", "our") respects your privacy and is committed to protecting your personal information. This policy explains what we collect, why we collect it, how we use and share it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

1. Who we are

Hills & Associates UK is the data controller for the personal information described in this policy. You can contact us at:

• Email: [email protected]
• Telephone: +44 20 3807 8443

2. Information we collect

We only collect the information we need to respond to you and to operate our website securely.

Information you give us

When you submit our contact form, or contact us by email or telephone, we may collect:

• your name;
• your email address;
• your telephone number (if you choose to provide it);
• the content of your message and any other details you choose to share.

Information collected automatically

When you visit our website, our web server and our content delivery and security provider record standard technical information. This may include your IP address, the date and time of your visit, the pages you request, your browser and operating system type, and a referring address. This information is used for security, to diagnose faults, and to understand aggregate, anonymised usage of the site.

3. How we use your information

We use your personal information to:

• respond to your enquiry and provide the information or services you request;
• communicate with you about your enquiry, project or engagement;
• keep records of our communications and, where relevant, maintain business and accounting records;
• protect our website against fraud, abuse and security threats; and
• comply with our legal and regulatory obligations.

We do not sell your personal information, and we do not use it for automated decision-making or profiling.

4. Our lawful basis for processing

Under the UK GDPR we must have a lawful basis for using your personal information. We rely on:

• Legitimate interests - to respond to enquiries you send us, to manage our relationship with clients and suppliers, and to keep our website and systems secure. We balance these interests against your rights and expectations.
• Consent - where you have asked us to send you marketing communications. You may withdraw your consent at any time.
• Legal obligation - where we are required to keep or disclose information by law, for example for accounting or tax purposes.

5. Cookies and similar technologies

Our website does not use advertising, analytics or other non-essential cookies, and we do not require a cookie consent banner. We do set, and our security provider may set, a small number of strictly necessary cookies that are essential to keep the site and its forms working and secure. Full details are set out in our Cookie Policy.

6. Who we share your information with

We share personal information only where necessary, and only with organisations that help us run our website and business. These include:

• Cloudflare, Inc. - content delivery, security and privacy-friendly, cookieless website analytics;
• Our hosting infrastructure - the servers on which this website and our contact form are hosted; and
• Professional advisers - such as accountants or legal advisers, where required.

We may also disclose information where we are required to do so by law, or to establish, exercise or defend legal claims. We never sell your personal information.

7. International transfers

Some of our service providers, including Cloudflare, are based outside the United Kingdom and may process your information in other countries, including the United States. Where we transfer personal information outside the UK, we rely on appropriate safeguards recognised by UK law, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

8. How long we keep your information

We keep personal information only for as long as we need it for the purposes described above. As a guide:

• enquiry correspondence is kept for as long as needed to deal with your enquiry and for a reasonable period afterwards, so that we can respond if you contact us again;
• records relating to a contract or financial transaction are kept for up to six years after the relationship ends, to meet accounting and legal requirements; and
• server and security logs are retained for a short period, typically no more than 30 days.

When information is no longer needed, we securely delete or anonymise it.

9. Your rights

Under the UK GDPR you have the right to:

• access the personal information we hold about you and receive a copy of it;
• ask us to rectify information that is inaccurate or incomplete;
• ask us to erase your information in certain circumstances;
• ask us to restrict how we use your information;
• object to processing carried out on the basis of legitimate interests;
• request the portability of information you provided to us; and
• withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month. You will not normally be charged a fee.

If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can contact the ICO at ico.org.uk or on 0303 123 1113. We would appreciate the opportunity to address your concerns first.

10. How we protect your information

We take appropriate technical and organisational measures to protect your personal information against unauthorised access, loss or misuse. These include encrypted connections (HTTPS/TLS) across the site, security filtering and protection provided by Cloudflare, and restricted access to systems that hold personal data.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. The date at the top of this page shows when it was last revised. Any significant changes will be made clear on this page.

12. Contact us

If you have any questions about this policy or about how we handle your personal information, please contact us at [email protected] or +44 20 3807 8443.