Privacy notice

Last updated: 12 October 2026

1. Who we are

Pillar Advisory Ltd (Pillar, we, us) is a company registered in England and Wales with company number 17351605. Our registered office is 124–128 City Road, London, EC1V 2NX. We are registered with the Information Commissioner's Office (ICO) under registration number ZC267495.

We are the controller of the personal data described in this notice. That means we decide how and why it is used, and we are responsible for looking after it.

If you have any questions about this notice or how we handle your data, email us at contact@pillaradviser.com.

2. Who this notice covers

This notice explains how we handle personal data about:

visitors to our website and people who contact us or book a call;
our clients' people: founders, directors, employees and other contacts at the businesses we work for;
people whose details appear in the work we do for clients, such as shareholders, employees, investors, counterparties and their advisers;
people in our professional network, including specialist advisers we work with or refer clients to, suppliers and other contacts; and
people who apply to work with us, as employees, contractors or advisers.

It doesn't cover our own employees, who receive a separate notice.

When we act for a client

When we advise a client, we usually decide how the personal data in that work is used, so we act as a controller and this notice applies. If we have signed a data processing agreement with a client under which we act as their processor, we only use that data on the client's instructions, and the client's own privacy notice will explain how it is used.

3. What we collect and where it comes from

Depending on how you deal with us, we may collect:

identity and contact details, such as your name, job title, company and contact details;
information about our work together, such as messages, call notes and transcripts, instructions and advice;
personal data in client matters, such as details of shareholders, employees, investors and counterparties in the documents we work on;
billing information, such as invoices, payment history and bank details for direct debit;
identity verification information, such as copies of ID documents and the results of anti-money laundering and sanctions checks;
professional background, such as your expertise and work history and, if you apply to work with us, your CV and references; and
website and device information, such as your browser, device, pages visited and approximate location.

We receive this information from you, our clients and their advisers, other parties to a transaction, people who introduce or recommend you to us, and public sources such as Companies House, LinkedIn and firm websites. Some technical data is collected automatically when you use our website.

You don't have to give us personal data, but if you are a client and we can't verify your identity or get the information we need, we may not be able to act for you.

Our website and services are aimed at businesses and are not directed at children. We don't knowingly collect personal data from anyone under 18.

4. How we use your data and our lawful bases

We use personal data to:

respond to enquiries and arrange calls;
deliver our services, including advising, drafting, negotiating and managing specialists on our clients' behalf;
build context about our clients' businesses, so that our advice is better informed and we can raise issues early;
keep accurate records of instructions and advice, including by recording and transcribing calls;
carry out identity, anti-money laundering and sanctions checks;
invoice, collect fees and keep accounts;
keep in touch with our professional network and send updates you are likely to find useful;
run, secure and improve our website;
assess people who apply to work with us; and
manage our business, insurance and any disputes, and respond to regulators, courts and authorities.

We rely on the following lawful bases:

Contract: where we need the data to provide our services to you as a client, or to take steps you ask for before you become one.
Legal obligation: where the law requires it, for example tax and accounting rules, anti-money laundering checks where the regulations apply, and right-to-work checks.
Legitimate interests: for most other purposes, including giving well-informed advice, keeping accurate records, managing specialists, preventing fraud and financial crime, keeping in touch with our network, keeping our website secure and running our business. We have balanced these interests against your rights, and you can object using the procedure outlined below.
Consent: for non-essential cookies and, where the law requires it, marketing emails. You can withdraw consent at any time.

We don't sell personal data, use it for profiling or targeted advertising, or make decisions about you based solely on automated processing.

5. Sensitive information

Some of our work, particularly employment matters, may involve special category data (such as health, ethnicity or trade union membership) or information about criminal convictions and offences. Our anti-money laundering checks may also reveal this kind of information.

We only use it where it is necessary for establishing, exercising or defending legal claims, for obtaining or giving legal advice, to meet our legal obligations, or where another condition in the UK GDPR or Schedule 1 of the Data Protection Act 2018 applies. We limit who can see it and handle it with extra care.

6. Calls, transcripts and AI

We record and transcribe some calls, including introductory calls, client calls and calls with specialists, so that we can build context about our clients' businesses, so that our advice is better informed, and we can raise issues early.

We tell you before the call. The meeting confirmation will say the call may be recorded and direct you to this notice.
You can say no. Recording is part of how we work and enables us to provide a better service. If you have concerns about a particular call, let us know before it starts.
What we keep. A written transcript, the names of participants, the date and time, and an AI-generated summary and action list. The audio is used only to create the transcript and is not kept. Transcripts are kept securely for the same period as the matter file.
Accuracy. Transcripts and summaries can contain mistakes. Formal advice is always confirmed in writing.

We use business AI tools to help deliver our services, under terms that don't allow the providers to train their models on our data. A person at Pillar checks all AI-generated work, and we don't use AI to make decisions about you.

We share personal data only where we need to, and only with:

service providers who host, store or process data for us, such as providers of email, document storage, practice management, AI, messaging, video call, time tracking, accounting, banking, payment, identity verification and website software. They act on our instructions under data processing terms and can't use your data for their own purposes. We can give you a current list on request;
specialist advisers we bring in at your request, such as other law firms, barristers, accountants or tax advisers. You'll usually engage them directly and they will usually act as controllers in their own right;
the other side of a transaction and their advisers, where that is part of the work;
our own professional advisers, including accountants, lawyers and insurers;
banks and payment providers, to collect fees;
regulators, courts, law enforcement and tax authorities, where the law requires it; and
a buyer or investor, if we sell or restructure our business, under confidentiality obligations.

8. International transfers

Several of our service providers are based in, or process data in, the United States. When personal data is transferred outside the UK, we make sure it is protected by one of the following:

the country has been found by the UK government to provide adequate protection, including the UK Extension to the EU-US Data Privacy Framework where the US provider is certified under it; or
the transfer is covered by the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for more information about the safeguards for a particular transfer.

9. How long we keep your data

We keep personal data only as long as we need it for the purposes in this notice, including to meet legal, accounting and insurance requirements and to deal with any claims. At the end of the retention period, we delete or anonymise the data.

Client and matter files, including call transcripts and summaries, will be kept for 7 years after our engagement ends, or longer if there is a claim or the law requires it.

Marketing preferences are kept until you unsubscribe, which you can do at any time using the link in any of our emails or by emailing us. We keep a record of the opt-out so we don't contact you again.

10. How we keep your data secure

We use technical and organisational measures to protect personal data, including business-grade tools with encryption, two-factor authentication, access controls that limit who can see client information, and data processing terms with our providers. No system is completely secure, but if a breach happens that is likely to put your rights at risk, we will tell you and the ICO as the law requires.

11. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you and get a copy;
have inaccurate or incomplete data corrected;
have your data erased, in some circumstances;
restrict how we use your data, in some circumstances;
object to us using your data based on our legitimate interests, and to direct marketing at any time;
receive data you gave us in a portable format and have it transferred to someone else, in some circumstances; and
withdraw your consent at any time where we rely on it. This doesn't affect anything we did before you withdrew it.

To exercise any of these rights, email contact@pillaradviser.com. We may need to confirm your identity first. We'll respond within one month, or tell you within that month if we need longer.

Some rights are limited by law. For example, we may not be able to disclose information that is protected by legal professional privilege or confidential to a client, and we may need to keep data to meet a legal obligation or deal with a claim. If that applies, we'll explain why.

12. Cookies

Our website doesn't use advertising or tracking cookies. Our hosting provider may set a small number of cookies that are strictly necessary to keep the site secure, for example to tell people apart from bots. We measure visits using analytics that doesn't use cookies or store anything on your device. Because we only use strictly necessary cookies, we don't ask for consent or show a cookie banner. If that changes, we'll update this notice and ask for your consent first.

13. Complaints

If you're unhappy with how we've handled your personal data, please tell us first so we can put it right. Email contact@pillaradviser.com. We'll acknowledge your complaint promptly and tell you what we're doing about it.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed. If we make significant changes, we'll highlight them on our website and, where appropriate, tell our clients directly.

15. Contact us

Pillar Advisory Ltd
124–128 City Road, London, EC1V 2NX
Email: contact@pillaradviser.com