How Hartmark Consultancy Limited collects, uses, shares and protects personal information.
HC-LEG-PRIV-001 · Issued 2 November 2026
This notice explains how Hartmark Consultancy Limited (“Hartmark”, “we”, “us”) collects, uses, shares and protects personal information. It applies to people who use our website and online forms, people at the businesses that instruct us or that we work alongside, and people connected with the businesses we pursue or research in the course of our work.
We work only with businesses. We do not accept instructions to recover consumer debts. Even so, much of our work involves information about individuals, such as directors, owners, guarantors, employees and contacts, and that information is protected by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This notice is written to meet those laws.
Separate notices apply to our employees and to people who apply for a job with us. If you are applying to work with us, please ask for our job applicant privacy notice.
Hartmark Consultancy Limited is the controller of the personal information described in this notice. We are a company registered in England and Wales under number 15246416, with our registered office at 6 Corporation Terrace, Criccieth, LL52 0HD, Wales. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB680583.
Hartmark is a specialist cross-border consultancy. We provide international and domestic business-to-business debt recovery, dispute resolution support, credit intelligence, due diligence, asset searches and investigation-led consultancy. Hartmark is not a firm of solicitors; where a matter needs legal action, it is carried out by qualified local counsel.
Our Data Protection Officer is Keith Allmark. You can contact him by email at info@hartmarkconsultancy.com, marked “For the attention of the Data Protection Officer”, or by post at the registered office address above.
Much of our work involves information we have not collected from the person it is about. In particular, when we recover a debt from a business, or carry out due diligence, an asset search or an investigation, we obtain information about that business and the people connected with it from:
The information we obtain in this way usually consists of names, roles and appointments, business and correspondence addresses, contact details, shareholdings and other interests, financial and credit information about the business, information about assets, court and insolvency history, and details of the claim. We do not seek special category information (such as health, religion or ethnicity). Information about criminal allegations or convictions may occasionally appear in public records or be relevant to a fraud; we use it only where the law allows, for example where it is necessary to establish, exercise or defend legal claims.
When you visit our website, our hosting provider’s servers record limited technical information, such as your IP address, browser type and the pages you request, so that the site can be delivered securely. Our website does not use cookies or tracking technologies (see section 12).
We use personal information only where the law allows. The lawful bases we rely on are:
We do not sell personal information, and we do not use the personal information of the businesses and people we pursue or research for marketing.
Our online forms, including the contact form on our website and our intake forms, are provided by Hartmark through our case management provider’s secure intake system. When you complete one of our forms, the information goes directly to Hartmark, and Hartmark is the controller of it. This is so whether you reach the form from our own website or from a form embedded on the website of a business that introduces clients to us.
Where a business has introduced you to us, we may tell that business that you have been in touch, and share the limited information it needs to calculate and receive any commission due to it, such as your business name, our matter reference, the status of the matter and the fees we have received. We do not share the details of your claim, your documents or information about the business you want us to pursue with an introducer, unless you ask us to.
An introducer is responsible for any information it collects from you itself, and its own privacy notice applies to that information.
We share personal information only where it is needed for the purposes described in this notice, and only with:
Where a matter requires work in the People’s Republic of China, we may also share the information needed for that work with Hartmark & Suns Consultancy (Shanghai) Ltd (黑马合讯（上海）企业管理咨询有限公司), a company in which Hartmark holds a majority interest.
Our service providers act only on our instructions and under contracts that require them to keep personal information secure.
Because our work is cross-border, we often need to send personal information outside the United Kingdom, for example to a partner firm or local counsel in the country where a debtor business is based, or to a service provider whose systems are hosted abroad.
Where we transfer personal information outside the UK, we make sure it is protected by one of the safeguards required by UK data protection law. These are: a UK adequacy decision for the destination country; the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment; or, where those are not available, one of the exceptions the law allows, such as where the transfer is necessary to establish, exercise or defend legal claims. Transfers to the People’s Republic of China, including any to Hartmark & Suns Consultancy (Shanghai) Ltd, are made under the UK International Data Transfer Agreement or Addendum and, where it applies, in line with the PRC Personal Information Protection Law.
You can ask us for more information about the safeguards that apply to a particular transfer using the contact details in section 13.
We keep personal information only for as long as we need it for the purposes in this notice, in line with our data retention and disposal schedule. Our standard periods are:
At the end of the relevant period we securely delete or destroy the information, or anonymise it so that it no longer identifies anyone.
We use technical and organisational measures designed to keep personal information secure. These include encryption of information in transit and at rest, multi-factor authentication, access controls that limit information to the people who need it, monitored and audited systems, staff training and confidentiality obligations. Our information security controls are aligned with ISO/IEC 27001. If a personal data breach occurs that is likely to put your rights at risk, we will notify the ICO and, where the law requires, tell you.
Under UK data protection law you have the right to:
To exercise any of these rights, please contact us using the details in section 13. We may need to confirm your identity before we respond. We will respond within one month, and we will tell you if we need more time because a request is complex. There is normally no charge.
Where we obtain information about you from other sources, we will normally provide the information in this notice when we first contact you, or within one month. We may not do so where telling you would be likely to seriously impair the purpose of the work, for example where it would alert a business to an asset search or investigation, or where an exemption in the Data Protection Act 2018 applies, such as where the information is needed to establish, exercise or defend legal rights. The same exemptions can limit some of your other rights. Where we rely on an exemption, we do so case by case, and only for as long as it is needed.
You can object to our use of your information. If you do, we will stop unless we have compelling legitimate grounds to continue, or we need the information to establish, exercise or defend legal claims, which will often be the case while a debt remains owed.
We do not make decisions about people based solely on automated processing, including profiling, that produce legal effects or similarly significant effects. We use software, including credit scoring data and AI-assisted tools, to organise and review information, but decisions about our matters are made by people.
Our website does not set any cookies and does not use analytics, advertising or other tracking technologies, so we do not ask for cookie consent. If we introduce non-essential cookies in future, we will ask for your consent first and update this notice.
Our website loads its typefaces from a third-party font service, which receives your IP address so that it can deliver them. That service does not set cookies on our website.
Our online forms, including the contact form on our website, are hosted by our case management system provider, which may set its own essential cookies so that the forms work securely. You can control cookies through your browser settings.
If you have a question about this notice or how we use personal information, or you want to exercise your rights, please contact our Data Protection Officer:
If you are unhappy with how we have handled your information, please tell us first so that we can try to put things right. We will acknowledge your complaint within 30 days and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection: website ico.org.uk, telephone 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
We review this notice regularly and will update it when our practices or the law change. The current version will always be available on our website, with the date it was last updated.
Hartmark Consultancy Limited · Registered in England and Wales No. 15246416 · Registered office: 6 Corporation Terrace, Criccieth, LL52 0HD, Wales · ICO registration ZB680583