Privacy Policy
This policy explains how Whistlebrook Limited collects and uses personal data through our website. It was last reviewed in October 2026.
1. Who we are
Whistlebrook Limited (“Whistlebrook”, “we”, “us”) is the data controller for personal data collected through this website.
Registered office: Unit 6, The Forum, Icknield Way, Tring, Hertfordshire HP23 4JY. Registered in England, company number 03316558.
2. What we collect, and when
We collect personal data from you when you:
- Submit a general contact or enquiry form
- Request a product demonstration
- Download a whitepaper or other material from the site
- Subscribe to our newsletter or regulatory updates
- Register for access to the Resource Centre
- Register for an event, working group or roundtable
The information we collect is typically your name, job title, company name, email address and telephone number.
We do not collect payment card details, bank details or other financial information through this website. We do not collect job applications or recruitment information through this website. We do not collect special category data, such as health information, through this website.
Our software operates on our clients’ own systems using their own data. That data is not processed through this website and is not covered by this policy; it is governed by the relevant client agreement.
3. How we use your information, and our lawful basis
Under UK data protection law we must have a lawful basis for using your personal data. The table below sets out what we use your information for and the basis we rely on in each case.
| What we use it for | Our lawful basis |
|---|---|
| Responding to your enquiry | Legitimate interests, or steps taken at your request before entering into a contract |
| Providing a demo, whitepaper or other material you asked for | Legitimate interests, or your consent where you asked to hear more from us |
| Sending our newsletter and regulatory updates | Your consent |
| Providing access to the Resource Centre | Legitimate interests, or performance of a contract where you are a client |
| Administering event and working group registrations | Your consent, or legitimate interests where you are attending on behalf of a client |
Where we rely on your consent, you can withdraw it at any time. Where we rely on legitimate interests, our interest is in responding to enquiries about our software and keeping people who have asked to hear from us informed about regulatory developments affecting their business. You can object to this at any time.
4. How long we keep it
We keep your contact details for as long as you remain subscribed to our communications and we have a genuine reason to stay in contact with you. We review our marketing contacts periodically and remove those we no longer have a reason to hold.
If you unsubscribe, we keep a minimal record of your details so that we do not contact you again.
5. Who we share it with
We do not sell or trade your personal data. We share it only in the following circumstances:
- With service providers who process data on our behalf. These include the agency that maintains this website, who also administer our email marketing for us, and the email marketing platform they use to send our newsletter and regulatory updates. These providers act only on our instructions and are bound by contract.
- Where we are required to do so by law, including with law enforcement, government agencies or public bodies.
- If Whistlebrook merges or is subject to a takeover, we may disclose your information to the new business owners.
You can ask us at any time for details of the service providers we use.
6. Where your information is held
Our own systems hold personal data in the United Kingdom, the European Economic Area and Switzerland. The UK recognises the countries of the European Economic Area, and Switzerland, as providing an adequate level of protection for personal data, so no additional safeguards are required for personal data held in these locations.
Our newsletter and regulatory updates are sent on our behalf using an email marketing platform that processes personal data in locations including the United States and Australia. Where you have subscribed to our communications, or asked us to send you material, your contact details are transferred outside the UK in this way.
Where personal data is transferred to a country that the UK has not recognised as providing an adequate level of protection, the transfer is made under the UK Addendum to the European Commission’s Standard Contractual Clauses. This requires your data to receive a standard of protection equivalent to that provided under UK law. You can ask us for details of the safeguards in place by contacting us using the details below.
7. Keeping your information secure
We store information both electronically and in paper form. We have security policies and procedures in place to protect personal information from unauthorised access, improper use or disclosure, unauthorised modification, and unlawful destruction or accidental loss.
8. Cookies
We use cookies and similar technologies on this website. When you first visit, you can choose which categories of cookies to allow, and you can reject all non-essential cookies at that point.
Cookies that are strictly necessary for the site to work are always set. All other categories, including functional, analytics, advertising and social media cookies, are set only where you have given your consent. Third-party scripts in those categories do not load until consent is given.
A full list of the cookies we use, what each one does and how long it lasts is set out in our Cookie Policy, which you can open from the cookie banner or from the Cookie Preferences link in the footer of any page. You can change your preferences there at any time.
We may also collect technical information about your device, including your IP address, operating system and browser type.
9. Your rights
Under UK GDPR you have the right to:
- Ask what personal data we hold about you, and request a copy of it
- Ask us to correct information that is inaccurate or incomplete
- Ask us to delete your personal data
- Ask us to restrict how we use your data, or object to us using it
- Ask us to transfer your data to another organisation
- Withdraw your consent at any time, where we rely on consent
There is no charge for exercising these rights. We will respond within one month of receiving your request. We may ask you to confirm your identity first.
To make a request, contact the Finance and Administration department at finance@whistlebrook.co.uk.
10. Complaints
If you are unhappy with how we have handled your personal data, please contact us using the details above so we can put it right.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.
11. Changes to this policy
We may update this policy from time to time. The date of the most recent review is shown at the top of this page.