Privacy Notice
Last updated: 6 November 2026
1. Who we are
HTT Commercial Advisory Ltd ("HTT", "we", "us" or "our") is an independent procurement and commercial advisory consultancy registered in England and Wales.
We are committed to protecting personal information and handling it responsibly, transparently and in accordance with applicable data protection legislation.
Company details
HTT Commercial Advisory Ltd
Company registration number: 17567169
Registered office: 195-197 Wood Street, London, United Kingdom, E17 3NU
Website: https://httadvisory.co.uk/
Email: harold@httadvisory.co.uk
For the purposes of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, HTT Commercial Advisory Ltd is the data controller for personal information used for its own business operations.
2. What personal information do we collect?
The personal information we collect will depend on how you interact with HTT.
Website enquiries
When you contact us through our website, we may collect:
- Your name.
- Your email address.
- Your organisation's name.
- Information included in your enquiry.
- Any subsequent correspondence.
Our website contact form requests your name, email address, organisation (optional) and details of your enquiry.
Prospective business contacts
We may collect professional contact information when identifying organisations that could benefit from our services. This may include:
- Your name.
- Your job title or professional position.
- Your business email address.
- Your organisation's name and business contact details.
- Relevant publicly available information about your organisation.
- The source from which your professional contact details were obtained.
- Previous communications and business development activity.
Clients and professional contacts
Where we work with your organisation, we may collect:
- Your name and professional contact details.
- Your job title and organisational responsibilities.
- Business correspondence.
- Contractual and engagement information.
- Information necessary to administer and deliver our consultancy services.
Procurement and consultancy assignments
Depending on the nature of an assignment, we may encounter personal information contained within client documents, supplier records, tender submissions or other procurement-related materials.
We will only handle such information where it is necessary for the agreed consultancy work and in accordance with the relevant contractual and data protection arrangements.
Financial and administrative information
We may also process information necessary to administer our business relationships, including invoice details, payment references, transaction records and relevant correspondence.
3. How do we obtain personal information?
We obtain personal information through several routes:
- Directly from you when you contact us or engage our services.
- From organisations that introduce or refer you to us.
- From publicly available business websites and professional directories.
- From Companies House and other official public registers.
- From publicly available charity registers, annual reports and organisational publications.
- Through business correspondence and professional engagement.
Where we obtain professional contact information from publicly available sources, we record the source and use the information only for relevant and proportionate business purposes.
We do not intentionally purchase bulk personal contact lists or collect personal information unrelated to our business activities.
4. Why do we use personal information?
We use personal information for the following purposes:
Responding to enquiries
To respond to questions, arrange introductory conversations, understand prospective requirements and communicate with individuals who contact us.
Providing consultancy services
To manage client relationships, agree assignments, deliver consultancy services, communicate findings and manage ongoing professional relationships.
Business development and marketing
To identify prospective organisations and introduce relevant procurement and commercial advisory services to appropriate professional contacts.
Our marketing activity may involve individually targeted business-to-business emails based on publicly available professional contact information.
We do not intend to send indiscriminate bulk marketing communications.
Business administration
To manage contracts, maintain records, process invoices, administer payments and manage relationships with clients and suppliers.
Legal and regulatory compliance
To meet applicable legal, regulatory, accounting and tax obligations and to establish, exercise or defend legal claims where necessary.
Website operation and security
To operate and maintain our website, prevent unauthorised access, investigate technical problems and protect the security of our systems.
5. Our lawful bases for processing
We process personal information under the lawful bases set out in Article 6 of the UK GDPR.
Depending on the circumstances, these include:
Contractual necessity - Article 6(1)(b)
Where processing is necessary to enter into or perform a contract with an individual, or to take steps requested by that individual before entering into a contract.
Where a business contact is acting on behalf of an organisation rather than contracting personally, we may instead rely on legitimate interests for relevant relationship-management activities.
Legitimate interests - Article 6(1)(f)
We may rely on legitimate interests where processing is necessary for our legitimate business purposes and does not override an individual's rights and freedoms.
These interests include:
- Developing professional business relationships.
- Identifying suitable prospective clients.
- Marketing relevant procurement and commercial advisory services.
- Managing client and supplier relationships.
- Maintaining appropriate business and financial records.
- Protecting our systems and business operations.
Where we rely on legitimate interests, we consider the relevance and proportionality of the processing and the reasonable expectations and rights of individuals.
Legal obligation - Article 6(1)(c)
Where processing is necessary to comply with legal obligations, including applicable company, accounting, tax and regulatory requirements.
6. Business-to-business marketing
HTT may contact relevant professional individuals within organisations to introduce its procurement and commercial advisory services.
Where we use named professional contact details for this purpose, we may rely on legitimate interests under Article 6(1)(f) UK GDPR, subject to the relevant assessment and safeguards.
Our electronic marketing activity is also subject to the Privacy and Electronic Communications Regulations 2003 (PECR).
We will only send unsolicited marketing emails where the applicable PECR requirements permit this.
In particular, the rules distinguish between corporate subscribers, such as limited companies and limited liability partnerships, and individual subscribers, such as sole traders and certain partnerships.
We will not send unsolicited marketing emails to individual subscribers without the required consent or another applicable legal basis for doing so.
Every marketing email will identify HTT and provide a straightforward way to request no further marketing communications.
Your right to object to direct marketing
You have an absolute right to object to the use of your personal information for direct marketing purposes.
If you object, we will stop using your personal information for direct marketing and retain only the minimum information necessary to ensure that we respect your preference.
To object, email harold@httadvisory.co.uk.
7. Who do we share personal information with?
We do not sell personal information or share it with third parties for their own unrelated marketing purposes.
We may share information where necessary with:
Technology and service providers
Providers that support our website, business email, cloud storage, document management and general business administration.
These include Microsoft 365 and Lovable, together with any relevant underlying website hosting, form processing or infrastructure providers.
Professional advisers
Our accountant, legal advisers, insurers and other professional service providers where necessary for the operation of the business.
Financial service providers
Our business banking provider and other relevant financial service providers where necessary to administer payments and company finances.
Clients and suppliers
Where necessary to undertake an agreed consultancy assignment, we may share relevant professional information with the client organisation, its authorised representatives or relevant suppliers.
Regulatory and public authorities
We may disclose information where required by law, regulation, court order or a legitimate request from an appropriate authority.
Where third parties process personal information on our behalf, we will take appropriate steps to ensure suitable contractual and security arrangements are in place.
8. International transfers
Some of our technology and service providers may store or access information outside the United Kingdom.
Where personal information is transferred internationally, we will ensure that the transfer is permitted under applicable UK data protection legislation and that appropriate safeguards are in place where required.
Further information about relevant international transfers and safeguards can be requested by contacting harold@httadvisory.co.uk.
9. How long do we retain personal information?
We only retain personal information for as long as necessary for the purpose for which it was collected, taking account of applicable legal, contractual and business requirements.
Our general retention arrangements are:
Prospective business contacts
Where an individual does not respond to our marketing communications or pursue a business relationship, we will normally remove their active prospect information within six months of the final contact.
Website enquiries
Where an enquiry does not result in an engagement, we will normally retain the relevant correspondence for up to 12 months following the last meaningful communication.
Client and consultancy records
We retain relevant client records for the duration of the engagement and afterwards for as long as reasonably necessary to meet contractual, legal, insurance, accounting and legitimate business requirements.
Financial and accounting records
We retain relevant financial and accounting records in accordance with applicable statutory requirements. These generally need to be kept for six years from the end of the relevant company financial year.
Marketing objections
Where someone objects to further marketing, we retain a limited suppression record for as long as necessary to ensure that their preference is respected.
Once information is no longer required, it will be securely deleted or anonymised.
10. How do we protect personal information?
We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, disclosure, alteration or destruction.
These measures include:
- Restricted access to business information.
- Appropriate password and account security.
- Multi-factor authentication where available.
- Secure business email and cloud storage arrangements.
- Appropriate handling of client and commercially sensitive information.
- Retention and deletion arrangements.
We aim to collect only the information necessary for our business activities and take reasonable steps to keep information accurate and up to date.
11. Your data protection rights
Under applicable data protection legislation, you may have the right to:
- Request access to your personal information.
- Request correction of inaccurate or incomplete information.
- Request erasure of personal information in certain circumstances.
- Request restriction of processing in certain circumstances.
- Object to processing based on legitimate interests.
- Object absolutely to the use of personal information for direct marketing.
- Request the transfer of information you have provided to us, where the right to data portability applies.
- Withdraw consent where processing relies on consent.
These rights are subject to the relevant legal conditions and exemptions.
To exercise your rights, contact us at:
We will respond in accordance with the applicable statutory requirements.
12. Cookies and website technologies
Our website may use cookies and similar technologies to support website functionality, security and performance.
The cookies and technologies used will depend on the website's actual configuration.
Where applicable, we will explain their purposes and obtain consent where required under the Privacy and Electronic Communications Regulations.
Further information about the cookies and technologies used on our website, including how to manage your preferences, will be provided through our website cookie information.
13. Third-party websites
Our website may contain links to external websites and services.
We are not responsible for the privacy practices, content or security arrangements of third-party websites.
We recommend reviewing their privacy notices before providing them with personal information.
14. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, business operations or legal obligations.
The latest version will always be published on our website, together with the date on which it was last updated.
15. Contact us and complaints
If you have any questions about this Privacy Notice or how HTT Commercial Advisory Ltd uses personal information, please contact:
HTT Commercial Advisory Ltd
Email: harold@httadvisory.co.uk
Registered office: 195-197 Wood Street, London, United Kingdom, E17 3NU.
You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator.
Website: https://ico.org.uk/make-a-complaint/
We would welcome the opportunity to address any concerns directly in the first instance.