Privacy Policy
Last updated: 9 September 2026
This notice explains how Supreme Business Advisory Ltd (company number 17025531) (“we”, “us”, “Supreme Advisory”) collects and uses your personal data through this website, and your rights under UK data protection law — the UK GDPR and the Data Protection Act 2018.
Who is responsible for your data
The data controller is Supreme Business Advisory Ltd, registered in England & Wales, company number 17025531. Registered office: 4 Bellwood Court, Rochester, United Kingdom, ME3 8RT.
For anything in this notice, write to [email protected]. We have not appointed a statutory Data Protection Officer; we are not required to.
What we collect
When you send us an enquiry
The contact form on this site asks for your name, email address, company and a short message describing what you need. All four go to us and nowhere else.
When you use the capital allowances calculator
The estimate tool at /capital-allowances/ asks for your name, email address, company or property name and company number, along with the property figures you enter to produce the estimate. We keep the identity details and the figures so we can follow the estimate up and so the free run is only used once per company.
When you visit any page
We run our own analytics rather than a third-party advertising network. On each page view we record the page path, the type of event (page view, button click, form submission), the referring address if your browser sends one, any campaign parameters in the link you followed, your screen width, and a random session identifier stored in your browser. That identifier is a random string. It is not your name, it is not your email address, and it is not linked to any account.
When you use the partner portal
The portal at /portal/ is a signed-in area. Signing in creates a session held in your browser and identifies you to the account whose records you are entitled to see.
When you email or call us
We keep the correspondence, and the contact details in it, so we can pick the thread back up.
Why we use it, and our lawful basis
| What we do | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Reply to your enquiry and arrange a call | You asked us to | Legitimate interests — responding to a genuine enquiry; and steps taken at your request before entering a contract |
| Produce and follow up a capital allowances estimate | It is the thing you asked the tool to do | Steps taken at your request before entering a contract; legitimate interests in following the estimate up |
| Provide services you have engaged us for | To perform our agreement with you | Performance of a contract |
| Run and secure the partner portal | To show you your own records and keep others out | Performance of a contract; legitimate interests in securing the service |
| Measure how the site is used | To see which pages work and fix the ones that do not | Consent — nothing is measured until you allow it in the cookie banner, and you can withdraw at any time |
| Send you marketing about our services | Only where you have asked for it, or you are an existing client | Consent, or legitimate interests under the soft opt-in in PECR |
| Keep records for tax, accounting and legal defence | We are obliged to, or need to | Legal obligation; legitimate interests in establishing or defending legal claims |
Where we rely on legitimate interests, we have weighed our interest against your rights, and we do not use your data in ways you would not reasonably expect. You can object — see your rights below.
What we do not do
- We do not sell your personal data, and we do not rent or trade mailing lists.
- We do not run advertising or cross-site tracking pixels on this site — no Google Analytics, no Google Tag Manager, no advertising network tags. See the cookie policy for exactly what does run.
- We do not make decisions about you by automated means alone, and we do not profile you in any way that produces a legal or similarly significant effect.
- We do not knowingly collect data from children. This site is aimed at businesses.
Who we share it with
We share your data with a small number of suppliers who process it on our written instructions, as processors. We do not give them permission to use it for their own purposes.
| Processor | What it handles | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting and content delivery for this website; edge security and bot protection. Sees the requests your browser makes, including your IP address. | Global edge network, incl. UK/EU |
| Supabase, Inc. | The database and server functions behind the contact form, the calculators, the portal and our analytics. Enquiry and estimate records are stored here. | EU region |
| Google (Google Fonts) | Serves the typefaces this site uses. Google's servers receive your IP address when a font loads. No cookie is set and no font request is used to identify you. | Global |
| Our email provider | Hosts the mailbox that receives your enquiry and holds the reply thread. | UK / EU |
We may also disclose data where the law requires it, to our professional advisers, or to a buyer if the business is sold. Where we introduce you to a specialist partner — for example a capital allowances specialist — we tell you who they are first, and they act as their own controller from that point.
International transfers
Some of these suppliers are outside the UK. Where personal data is transferred outside the UK we rely on the UK's adequacy regulations where they apply, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the supplier's own technical safeguards. You can ask us for details of the safeguard used for any particular transfer.
How long we keep it
| Record | Retention |
|---|---|
| Enquiries that do not become work | 24 months from the last contact, then deleted |
| Calculator estimates and the identity attached to them | 24 months from the run, then deleted |
| Client records and correspondence | For the engagement, then 6 years from its end (limitation and tax records) |
| Portal accounts | For as long as the account is open, then 12 months |
| Website analytics events | 25 months, then deleted |
| Marketing consent records | Until you withdraw consent, plus a suppression record so we do not contact you again |
Your rights
Under UK GDPR you have the right to:
- Be informed — which is what this notice is for.
- Access a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected or incomplete data completed.
- Erasure — have your data deleted where we no longer have a good reason to keep it.
- Restrict processing while a dispute about accuracy or legitimate interests is resolved.
- Object to processing based on legitimate interests. If you object to direct marketing we will stop, without exception.
- Data portability — receive data you gave us in a structured, machine-readable form, where we process it by consent or under a contract by automated means.
- Withdraw consent at any time, where consent is what we relied on. Withdrawing it does not make earlier processing unlawful.
To exercise any of these, email [email protected]. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm who you are before we release anything.
Complaining to the ICO
If you are not happy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to complain to the UK supervisory authority at any time:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk/make-a-complaint
Security
The site is served over HTTPS with a strict content security policy, and the data behind it sits in access-controlled databases. No system is perfect; if a breach ever put your rights at risk we would notify the ICO within 72 hours and tell you where we are required to.
Cookies
What this site stores in your browser, and for how long, is set out in full in our cookie policy.
Changes to this notice
We may update this notice. The current version is always the one on this page, and the date at the top tells you when it last changed.