For your family.
For your home.
For peace of mind.

Privacy Notice

How McGowan Advisory uses personal information

Owner: Frank McGowan   |   Version 2.0   |   Effective date: 11 October 2026   |   Review date: 11 October 2027

Frank McGowan, trading as McGowan Advisory, is committed to handling personal information lawfully, fairly and securely. This notice explains how personal information is used when you enquire about or receive independent security, risk or crisis-management advice. It should be read with the engagement terms where you become a client.

1. Who is responsible

The data controller is Frank McGowan trading as McGowan Advisory. Correspondence address: 68 Leman Street, London, E1 8EU. Email: frank@mcgowanadvisory.co.uk. ICO registration ZC264373; registered 1 October 2026, expires 30 September 2027. Registration does not signify ICO approval of these policies.

2. Information collected

• Contact and identification information, such as name, email address, telephone number, role and correspondence details.
• Engagement and billing information, including service scope, communications, invoices and payment status.
• Information needed to provide advice, which may include residence details, household arrangements, travel plans, online exposure, publicly available information, security concerns and photographs or notes supplied for the agreed service.
• Website and enquiry information, including information submitted through an enquiry form and technical logs needed to operate and secure the website.

3. Why information is used

Enquiries, proposals and engagement administration: steps at your request before contract, and performance of a contract.

Delivering the agreed advisory service and keeping a service record: performance of a contract and legitimate interests in operating a professional advisory practice.

Protecting clients, systems and records; managing complaints, legal claims and professional obligations: legitimate interests and, where applicable, legal obligation.

Keeping in touch about services: consent where required, or legitimate interests for relevant business-to-business contact. You may opt out at any time.

4. Sensitive information and information about others

McGowan Advisory does not routinely request sensitive information, criminal-offence data or detailed information about children. Before necessary collection, assess the lawful basis and any additional condition, individual authority, minimisation, access and retention. Client permission does not itself approve AI processing. Any AI/provider use and overseas transfers require assessment and approval for the specific purpose and data. Consent may be withdrawn where relied on.

5. Sources and sharing

Information normally comes from you, your authorised household members or professional advisers. Where agreed in scope, relevant public sources may also be reviewed. Information is shared only where needed: with approved technology, accounting or professional-service providers; authorised client contacts; and authorities or professional advisers where required by law or necessary to protect rights, safety or property. McGowan Advisory does not sell personal information.

6. Security and retention

Information is protected through proportionate access controls, named sharing, multi-factor authentication and encrypted devices. These controls must be verified in practice. Personal information is handled under the Privacy Notice, Information Security and Data Handling Procedure, and Data Retention and Secure Disposal Policy, all version 2.0 dated 11 October 2026. Enquiries that do not proceed are normally deleted six months after last meaningful contact. Keep only the minimal core engagement record: signed terms, scope and authority, material instructions, final advice, key acknowledgements, decision log and closure note. Review necessity annually and delete or anonymise when no longer needed, normally no later than seven years after closure. This is a business review ceiling, not an ICO-prescribed minimum. Retain longer only for a recorded legal, contractual or insurer requirement or a claim hold, with scope, reason and next review date. Delete unnecessary working notes, photographs, search captures and client-supplied material as soon as their purpose ends. Review at the end of the agreed follow-up; normally delete within 90 days after the final report. Any justified extension must be recorded and reviewed, normally no later than twelve months after the final report unless a documented hold applies. Delete live itinerary, location and routine details when their immediate purpose ends, normally within 30 days after the event. Keep only a necessary concise summary in the core record. Financial records are normally kept seven years after the relevant tax year, subject to applicable HMRC requirements. Necessary complaints are reviewed annually and normally deleted within seven years of resolution. Backups follow source deletion plus recorded purge lag; holds are reviewed six-monthly.

7. Your rights

• You may ask for access to your personal information, correction of inaccurate information, deletion, restriction or objection in the circumstances set out by data-protection law.
• You may ask to receive information you provided in a portable form where this right applies.
• You may withdraw consent at any time where consent is the basis for processing.
• You may complain to the Information Commissioner’s Office at ico.org.uk if you are unhappy with how your information is handled.

8. Changes and contact

This notice is reviewed annually and when services or processing changes. To exercise a right or ask a privacy question, email frank@mcgowanadvisory.co.uk.

This notice is approved by Frank McGowan, trading as McGowan Advisory, and is reviewed at least annually, after a material incident, or when services, systems, suppliers, personnel or applicable law change.