Last Updated: 2 December 2025

This Privacy Policy explains how Compliant Growth Advisors LLP (“CGA”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data in connection with:

• our website at CompliantGrowth.com and any related microsites (the “Site”); and

• our diagnostics, audits, tools, advisory services, and other engagements (together, the “Services”).

This Privacy Policy is primarily intended for professional users at regulated firms (e.g., RIAs, broker-dealers, multi-family offices, legal and trust professionals, fund sponsors, administrators) and their teams.

If you have a separate written agreement with us (e.g., MSA, Statement of Work, SaaS terms), that agreement will prevail to the extent of any inconsistency with this Privacy Policy.

1. Who We Are

Compliant Growth Advisors LLP
Registered in England & Wales
Company No.: OC457435
Registered Address: London, United Kingdom

For most processing described in this Privacy Policy, CGA acts as a “controller” under the UK GDPR and the UK Data Protection Act 2018 – meaning we decide how and why your personal data is processed.

In some circumstances, we may act as a processor for our clients (for example, when we operate systems strictly under a client’s documented instructions). In those cases, the client’s privacy notice and contract will govern.

Contact for privacy matters:
Email: privacy@compliantgrowth.com

2. Personal Data We Collect

We apply data minimisation and collect only what we reasonably need. The personal and professional data we collect depends on how you interact with us, but may include:

2.1 Identity & Professional Data

• Name and professional title

• Firm name and type (e.g., RIA, broker-dealer, multi-family office, legal or trust firm, fund manager)

• Seniority or role (e.g., principal, partner, CCO, COO, CIO)

2.2 Contact Data

• Work email address and phone number

• Business address

• Professional social profiles you choose to share (e.g., LinkedIn URL)

2.3 Firmographic & Platform Data

• Firm AUM range, registration type, and regulatory jurisdiction(s)

• Firm size, structure, and business lines

• Current systems and tech stack where you share that with us (e.g., CRM, marketing tools, compliance tools)

2.4 Interaction & Usage Data

• Pages visited, forms completed, buttons clicked, and navigation paths on the Site

• Email engagement (opens, clicks, replies, unsubscribes)

• Webinar/event registrations, attendance, and follow-up interactions

• Log and device information such as IP address, browser, operating system, and time of access (collected via cookies and similar technologies)

2.5 Service & Diagnostic Data

When you engage us for an audit, diagnostic, growth sprint, or similar Service, we may collect:

• Questionnaire responses and diagnostic inputs

• Configuration details, workflows, and campaign variants

• Performance metrics and reporting outputs

• Compliance notes, approvals, comments, and audit trails related to your use of our systems

• Internal identifiers we assign to assets, tests, and “growth audit” outputs

2.6 Public & Third-Party Source Data

We may complement the above with information from:

• Public registers and regulatory filings (e.g., corporate registries, regulatory records)

• Publicly accessible professional websites and profiles

• Third-party data and enrichment providers that support B2B outreach and compliance-first prospecting, under contract and in accordance with law

2.7 Sensitive Personal Data

We do not intentionally seek to collect special categories of personal data (such as health data, religious beliefs, political opinions) through the Site or ordinary Services. If you choose to provide such information (for example in free-text responses), you do so at your discretion, and we will handle it in line with this Privacy Policy and applicable law.

3. How We Use Personal Data

We process personal data only where we have a lawful basis. Typical uses include:

3.1 Providing and Improving the Site and Services

• Operating, maintaining, and securing the Site

• Delivering diagnostics, audits, sprints, tools, and advisory Services you request

• Configuring and supporting compliant, audit-ready marketing and communication systems

• Running quality assurance, testing, and optimisation of our frameworks and tools

3.2 Personalising Your Experience

• Tailoring content, communications, and offers based on your role, firm type, and prior interactions

• Suggesting relevant resources, case studies, or events

• Remembering preferences where appropriate (e.g., region, cookie choices, content interests)

3.3 Communicating With You

• Responding to enquiries and scheduling calls

• Sending briefings, event invitations, updates, and thought leadership (with your consent where required)

• Sending notices about changes to this Privacy Policy, the Terms of Use, or material updates to our Services

3.4 Supporting Audit-Ready Processes

• Maintaining documentation of approvals, workflows, and campaign history to support audit-ready oversight

• Maintaining internal logs to evidence system configurations and changes

3.5 Fulfilling Legal and Regulatory Obligations

• Complying with accounting, tax, and record-keeping requirements

• Responding to lawful requests from regulators, courts, and public authorities

We do not sell your personal data. We also do not “share” your data for cross-context behavioural advertising as those terms are defined in certain privacy laws.

4. Legal Bases for Processing

Where UK GDPR or similar laws apply, our primary legal bases are:

• Legitimate Interests – Providing and improving tailored B2B Services for regulated firms, ensuring security, auditability, and appropriate outreach in a proportionate way

• Contractual Necessity – Processing necessary to enter into or perform a contract with you or your firm (for example, an audit or growth sprint)

• Consent – Where required, for certain marketing communications, cookies, or optional information you choose to provide

• Legal Obligations – Processing necessary to comply with legal, tax, or regulatory duties

You may have the right to object to processing based on legitimate interests and to withdraw consent at any time (without affecting the lawfulness of prior processing).

5. How We Share Personal Data

We share personal data only as needed and with appropriate safeguards:

5.1 Service Providers

We engage third-party service providers to support our operations, including:

• Hosting and infrastructure

• CRM and communication systems

• Analytics and business intelligence

• Project management and operational tools

These providers act under written contracts that include confidentiality and data protection obligations.

5.2 Clients and Authorised Stakeholders

Where we are engaged by your firm or a related entity, we may share relevant outputs and logs (e.g., analysis, performance reports, documentation trails) with the contracting entity and its authorised stakeholders.

5.3 Professional Advisors

We may share limited data with professional advisors (such as legal counsel or consultants) where reasonably necessary for advice, dispute management, or risk management.

5.4 Legal and Transactional

We may disclose personal data:

• When required to do so by law or regulation, or in response to valid legal processes

• To protect the rights, property, or safety of CGA, our clients, or others

• In connection with a corporate transaction such as a merger, reorganisation, or business transfer, subject to appropriate confidentiality protections

We do not allow third parties to use your personal data for their own independent marketing purposes without your consent.

6. International Transfers

CGA is based in the United Kingdom and may process or store personal data in, or transfer it to, other countries (including countries outside the UK and European Economic Area).

Where personal data is transferred outside of the UK or EEA, we implement appropriate safeguards that may include:

• Standard contractual clauses approved by relevant authorities

• Technical and organisational measures designed to protect confidentiality and integrity

• Contractual obligations on recipients to maintain suitable data protection standards

You may contact us if you would like more information about the safeguards applied to international transfers.

7. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, including:

• The duration of active relationships and a reasonable period afterwards for support, auditability, and potential disputes

• Periods required by law, such as accounting and tax record-keeping requirements

Where data is no longer required, we will delete or anonymise it in accordance with our retention procedures.

8. Security

We apply privacy-by-design and security-by-default principles. Measures include:

• Encryption in transit and, where appropriate, at rest

• Access controls and role-based permissions

• Vendor due diligence and contractual security obligations

• Staff training and internal policies aligned with a compliance-first environment

No system can be guaranteed 100% secure, but we work to maintain a security posture commensurate with the sensitivity, volume, and regulatory context of the data we handle.

9. Cookies and Similar Technologies

We use cookies and similar technologies on the Site to:

• Enable core functionality (e.g., page navigation, session management)

• Analyse Site traffic and performance

• Support measuring and improving campaigns that lead to the Site

You can manage cookies through:

• Any on-Site consent tools or banners (where used), and

• Your browser settings (e.g., blocking or deleting cookies)

Disabling some cookies may affect how the Site functions.

10. Your Data Protection Rights

Depending on where you are located and which laws apply, you may have rights to:

• Access – request a copy of the personal data we hold about you

• Rectification – correct incomplete or inaccurate data

• Erasure – request deletion of your personal data in certain circumstances

• Restriction – ask us to limit processing in certain situations

• Objection – object to processing based on legitimate interests or to direct marketing

• Portability – receive personal data you provided to us in a structured, commonly used format and/or have it transmitted to another controller where technically feasible

To exercise these rights, contact us at privacy@compliantgrowth.com. We may need to verify your identity and, where you act on behalf of a firm, your authority.

If you are in the UK or another relevant jurisdiction, you may also have the right to lodge a complaint with your local data protection authority.

11. Children’s Data

The Site and Services are not directed to children, and we do not knowingly collect personal data from individuals under 16 via the Site. If you believe we have collected such data, please contact us so that we can investigate and delete it where appropriate.

12. Third-Party Sites

The Site may contain links to third-party websites and resources. We are not responsible for the privacy or security practices of those third parties. Their policies will govern their use of any data you provide to them.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top of this page. For material changes, we may provide additional notice (for example, via the Site or by email if appropriate).

Your continued use of the Site or Services after an update constitutes acceptance of the revised Privacy Policy.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or our handling of personal data, you can contact:

Compliant Growth Advisors LLP
London, United Kingdom
Email: privacy@compliantgrowth.com