Privacy notice
Version 1.0 · effective 20 September 2026 · issued under Articles 13 and 14 of the UK General Data Protection Regulation
This notice is issued by AEVIX ADVISORY LTD, a private company limited by shares incorporated in England and Wales under company number 17468089, whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ (“Aevix”, “we”, “us”). Aevix is the controller of the personal data described in this notice for the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
Enquiries concerning this notice, and requests to exercise the rights described in section 9, should be addressed to hello@aevixadvisory.com or in writing to the registered office above.
This notice applies to personal data processed by Aevix in the course of operating this website, corresponding with individuals, marketing its services to businesses, and administering its client engagements. It applies to visitors to this website, individuals who contact us, individuals whom we contact in a business capacity, and individuals at client organisations with whom we deal in the course of an engagement.
It does not apply to personal data that Aevix processes on behalf of a client as that client’s processor. Such processing is governed by the client’s own privacy notice and by the data processing terms of the relevant engagement, as described in section 6.
This website does not set cookies, does not deploy analytics or tracking technologies, and does not cause your browser to make any request to a third party. All fonts, images, stylesheets and scripts are served from this domain. No consent is sought for the use of cookies or similar technologies because none are used.
Our hosting provider maintains standard server logs, which may include the Internet Protocol address of the requesting device, the resource requested, the time of the request and the user-agent string of the browser. Those logs are processed for the purposes of delivering the website, maintaining its security and integrity, and defending against abuse. Aevix does not use them to identify individual visitors and does not combine them with any other data.
| Category | Data | Source |
|---|---|---|
| Correspondents | Name, business email address, telephone number, employer, job title, and the content of any correspondence you send us | Provided by you |
| Business prospects | Name, employer, job title, business contact details, and professional background relevant to your role | Professional networking platforms, company websites, public registers and other publicly available business sources |
| Client contacts | Name, role, business contact details, and records of decisions, meetings and correspondence arising in the course of an engagement | Provided by you or by your organisation |
| Website visitors | Server log data as described in section 3 | Generated automatically by your browser |
| Suppression list | Name and email address of individuals who have asked not to be contacted | Provided by you |
Aevix does not process special category personal data within the meaning of Article 9 UK GDPR, or personal data relating to criminal convictions and offences, for the purposes described in this notice, and asks that you do not include such data in correspondence with us.
Aevix processes personal data for the purposes set out below. The lawful basis for each is stated by reference to Article 6(1) UK GDPR.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and correspondence | Legitimate interests (Article 6(1)(f)): responding to business correspondence addressed to us |
| Approaching individuals in a business capacity to introduce our services | Legitimate interests (Article 6(1)(f)): marketing professional services to organisations in our target market, where the individual’s role is relevant to those services. Aevix has documented a legitimate interests assessment for this processing, which is available on request |
| Scoping, negotiating, entering into and performing an engagement | Performance of a contract, or steps taken at your request prior to entering into one (Article 6(1)(b)); and, where the contracting party is your employer, legitimate interests (Article 6(1)(f)) in administering that contract |
| Maintaining accounting, tax and company records | Compliance with a legal obligation (Article 6(1)(c)) |
| Establishing, exercising or defending legal claims | Legitimate interests (Article 6(1)(f)) |
| Operating, securing and maintaining this website | Legitimate interests (Article 6(1)(f)): network and information security |
| Maintaining a suppression list | Legitimate interests (Article 6(1)(f)) and compliance with a legal obligation (Article 6(1)(c)): giving effect to your objection to direct marketing |
Where Aevix sends unsolicited electronic communications to individuals in a business capacity, it does so in accordance with the Privacy and Electronic Communications (EC Directive) Regulations 2003. Every such communication identifies Aevix and provides a means of objecting. An objection is given effect immediately and permanently by entry on the suppression list.
Aevix does not make decisions producing legal or similarly significant effects concerning individuals by solely automated means, and does not carry out profiling.
Where Aevix delivers services to a client, the client is ordinarily the controller of any personal data that Aevix accesses in the course of the engagement, and Aevix acts as the client’s processor. Such processing is carried out only on the client’s documented instructions and under written terms satisfying Article 28 UK GDPR, which govern the purposes and duration of the processing, the security measures applied, the engagement of any sub-processor, the location from which data may be accessed, and the return or deletion of data at the end of the engagement.
Aevix is the controller of its own engagement records, including records of the advice given, decisions taken and correspondence exchanged, which it retains for the period stated in section 8.
Aevix does not sell personal data, and does not disclose it to advertising networks, data brokers or lead-generation services. Personal data may be disclosed to the following categories of recipient:
Personal data is stored in the United Kingdom and the European Economic Area. Operational logs generated by our hosting provider may be processed in the countries in which that provider operates its network. Where personal data is transferred outside the United Kingdom, the transfer is made on the basis of adequacy regulations made under section 17A of the Data Protection Act 2018 or, in their absence, subject to appropriate safeguards recognised under Article 46 UK GDPR, including the International Data Transfer Agreement, the UK Addendum to the European Commission’s standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it.
The director of Aevix may access the company’s own systems from outside the United Kingdom. Such access is by the controller and not a transfer to a third party; it is made through company-managed devices and accounts protected by multi-factor authentication. Where a client requires that its data be accessed only from within the United Kingdom, that requirement is agreed in writing before the engagement commences.
| Category | Retention period |
|---|---|
| Enquiries and correspondence that do not lead to an engagement | Twelve months from the date of the last communication |
| Business prospects who have not responded | Twelve months from the date of the last communication, after which the record is deleted |
| Engagement records, including contracts, correspondence and records of advice | Six years from the end of the engagement, being the limitation period for contractual claims under the Limitation Act 1980 and the period for which tax and company records must be retained |
| Accounting records | Six years from the end of the financial year to which they relate |
| Website server logs | Determined by the hosting provider; not retained by Aevix |
| Suppression list | Indefinitely, for so long as necessary to give effect to the objection |
On expiry of the applicable period, personal data is deleted or irreversibly anonymised, save where its continued retention is required by law or is necessary in connection with actual or anticipated legal proceedings.
Subject to the conditions and exemptions set out in the UK GDPR and the Data Protection Act 2018, you have the right:
To exercise any of these rights, contact us at the address in section 1. Aevix may require you to verify your identity before responding. Requests are answered without undue delay and in any event within one month of receipt; that period may be extended by a further two months where a request is complex or numerous, in which case you will be informed of the extension and the reasons for it within the first month. No fee is charged unless a request is manifestly unfounded or excessive.
If you consider that Aevix has processed your personal data in a manner that infringes data protection law, you have the right to lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or at ico.org.uk/make-a-complaint. Aevix would welcome the opportunity to address any concern before a complaint is made to the Commissioner.
Aevix may amend this notice from time to time. The version number and effective date at the head of this page identify the notice in force. Where an amendment materially affects the processing of personal data already held, Aevix will take reasonable steps to bring the amendment to the attention of the individuals concerned.