Privacy notice

1. Who we are

Walmer Finance Ltd, trading as Walmer Group, is the data controller for the information described in this notice. We are a UK advisory firm working on R&D tax relief, HMRC enquiry support, innovation grants, lending introductions and investment readiness.

We are not required to appoint a Data Protection Officer. Data protection questions are handled by the address above and reach a senior member of the firm.

2. What this notice covers

This notice covers personal information we collect through this website, through enquiries and correspondence, and in the course of providing our services. It does not cover other websites we link to, which have their own notices.

Cookies and similar technologies are dealt with separately in our cookie notice.

3. The information we collect

When you submit an enquiry. Our contact form records your name, company, work email address, phone number if you give one, the category of your enquiry, and whatever you write in the message field. Please do not put sensitive details in that box: it is a first point of contact, not a secure channel.

When you subscribe to updates. We record your email address and the date you subscribed. Nothing else.

When we work with you. Delivering an engagement means handling contact and role details for the people we deal with, correspondence, and the financial, technical and project information needed to prepare a claim, application or review, together with records of what we advised and when.

When you browse. Aggregate page-view measurement that does not identify you, described in the cookie notice. Our hosting provider also processes standard server logs, including IP addresses, to deliver the site and protect it from abuse.

When you send a form or sign in. To stop automated spam and password guessing, we keep a one-way scrambled version (a salted hash) of your IP address alongside the time of each submission or failed sign-in. It cannot be turned back into your address, is used only to limit how often the same visitor can submit, and is deleted after 24 hours.

We do not seek special category data (such as health or political opinions) and do not use personal information for automated decision-making or profiling that produces legal or similarly significant effects.

4. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and concluded it is not, because the processing is what you would reasonably expect from a firm you have contacted or engaged. You can object, and we will stop unless we have compelling grounds to continue.

5. Information about other people

Preparing an R&D claim or grant application often means handling details of a client’s staff, such as names, roles, time spent on a project and salary costs. Where a client provides that information to us, we handle it on that client’s instructions and under a written engagement, and we do not use it for anything else.

If you are an employee whose details have been included in a claim and you have questions, contact your employer in the first instance. You can also contact us and we will help.

6. Who we share it with

We share personal information only where there is a reason to:

• HMRC, where a claim or enquiry response requires it, or where we act as your agent.
• Grant bodies and funding organisations, where you have asked us to prepare or submit an application.
• Lenders, investors and partners, only where you have asked us to make an introduction. Introductions are made on a non-advisory basis and we tell you before anything is shared.
• Our service providers, who process information on our instructions under contract. These are listed in section 7.
• Professional advisers, insurers and auditors, where needed, and law enforcement or regulators where we are legally required to.

We do not sell personal information, and we do not share it with third parties for their own marketing.

7. Where your information is held

Information submitted through this site is processed and stored in London. The companies providing our hosting and database are based in the United States, so they may access it from outside the UK, for example to support or maintain their services.

If you message us on WhatsApp, the conversation is carried by WhatsApp (part of Meta) under its own terms and privacy policy. We see what you send us there, and treat it like any other enquiry.

Any transfers outside the UK are made under the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, which is the safeguard UK law provides for this. You can ask us for details of the safeguards that apply.

We keep where your information is held under review, and would tell you here if the location changed.

8. How long we keep it

Where we no longer need information, we delete it or make it anonymous. If deletion is not immediately possible, for example in a backup, we isolate it until deletion is.

9. How we protect it

Access is limited to people who need it. Our website and database run over encrypted connections, database credentials are held in an encrypted store rather than in our code, and the staff dashboard is behind an authenticated session. We review these arrangements as the firm grows.

10. Your rights

Under UK data protection law you can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct it if it is wrong or incomplete.
• Delete it, where we no longer have a good reason to keep it.
• Restrict how we use it, while a question about it is resolved.
• Object to our using it, including for direct marketing, which we will always stop on request.
• Receive it in a portable format, where we rely on your consent or a contract and process it by automated means.
• Withdraw consent at any time, where consent is what we rely on. This does not affect anything done beforehand.

Write to hello@walmergroup.com. We respond within one month, and will tell you if we need longer because a request is complex. There is no charge in ordinary circumstances. We may need to confirm your identity first.

11. Complaining to us

If you think we have handled your personal information badly, you have a statutory right to complain to us directly, and we would rather hear it than not.

• By email to hello@walmergroup.com, marked for the attention of the data protection contact.
• Through our contact form, selecting “Something else” and telling us it is a data protection complaint.
• By post to the registered office address in section 1.

We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

12. Complaining to the regulator

You can also complain to the Information Commissioner’s Office, the UK data protection regulator, at any point. Raising it with us first is usually quicker, but you do not have to.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. ico.org.uk

13. Changes to this notice

We update this notice when what we do changes. The date at the top shows the current version, and we will tell you directly if a change materially affects how we use information you have already given us.