Wykeham Strategy respects your privacy. This policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
Who we are
Wykeham Strategy Ltd, registered in England and Wales (company number 17436251, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom), and Wykeham Strategy LLC, registered in Delaware, United States, are the controllers of personal data collected through this website and in the course of our business.
Wykeham Strategy Ltd is the controller for all personal data collected through this website, including contact form enquiries. Where an enquiry leads to an engagement, the contracting entity becomes the controller for that engagement: Wykeham Strategy Ltd for UK and European clients, Wykeham Strategy LLC for United States clients. Both are referred to as "we" and "us" in this policy.
For any question about this policy or your data, email privacy@wykehamstrategy.com, use the contact form on this site, or write to us at our registered office above.
Scope
This policy applies when you visit this website, submit an enquiry through our contact form, or correspond with us as a client, prospective client, or professional contact. Enquiries about working with us, including those sent through the contact form, are covered by this policy. Applications for roles with us are covered by our Candidate Privacy Notice.
What we collect
Enquiry data. When you use our contact form we collect your first and last name, business email address, company, country or region, the reason for your enquiry, the industry it relates to, and the content of your message. You may also give us a phone number, which is optional. If you reach the form from a particular Partner’s page, we also record which Partner you were contacting.
Correspondence. Emails and other communications you send us, and our replies.
Website usage data. If you consent to analytics cookies, we collect pages viewed, approximate location, device and browser information, and how you arrived at the site. We do not collect this if you decline.
Security data. Our contact form uses Cloudflare Turnstile to distinguish human visitors from automated traffic. This processes your IP address and browser characteristics.
We do not collect special category data through this website, and we do not sell personal data.
Why we use it, and our lawful basis
- Responding to your enquiry — legitimate interests, or steps towards a contract
- Delivering our services — performance of a contract
- Business development with private equity and corporate contacts — legitimate interests
- Operating and securing the website — legitimate interests
- Analytics — consent, which you may withdraw at any time
- Legal and regulatory compliance — legal obligation
Objecting to business development contact
Where we contact you about our services on the basis of legitimate interests, you may object at any time. Every marketing email we send includes an unsubscribe link, and you may also object by emailing privacy@wykehamstrategy.com. We will stop contacting you for that purpose on receipt.
Automated decision-making
We do not make decisions about you by automated means, and we do not carry out profiling.
Who processes it on our behalf
We do not sell personal data. We use the following processors under contract:
- Cloudflare, Inc. — website hosting, form processing, enquiry storage, and bot protection
- Resend (Plus Five Five, Inc.) — delivery of contact form notifications, processed in Ireland
- Google LLC — business email (Google Workspace) and website analytics (Google Analytics 4)
- Cookiebot (Usercentrics A/S) — cookie consent management
- Anthropic PBC and OpenAI — AI tools used to review and respond to enquiries
We may disclose personal data to regulators, law enforcement, or professional advisers where we are legally required to do so or where necessary to establish or defend legal claims.
International transfers
Cloudflare, Google, Anthropic and OpenAI are established in the United States. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an adequacy decision where one applies.
How long we keep it
- Contact form enquiries — 90 days in our form storage. Where an enquiry leads to correspondence or an engagement, the email record is retained under the periods below.
- Business development correspondence — up to 3 years from last contact
- Client engagement records — 7 years after completion, to meet professional, contractual and tax obligations
- Analytics data — up to 14 months in Google Analytics, reported in aggregate
Your rights
You have the right to request access to your personal data, to have it corrected or erased, to restrict or object to our processing of it, and to receive it in a portable format. Where we rely on consent, you may withdraw it at any time — for analytics, through the cookie settings on this site.
To exercise any of these rights, email privacy@wykehamstrategy.com, use the contact form on this site, or write to us at our registered office above.
If you are not satisfied with how we have handled your data, you may complain to the Information Commissioner's Office at ico.org.uk. Our ICO registration number is ZC254497.
Security
We apply appropriate technical and organisational measures to protect personal data. The website is served over HTTPS with a strict content security policy, and access to enquiry data is limited to those who need it.
Third-party links
This website may link to other sites. We are not responsible for their privacy practices.
Changes
We will update this policy when our practices change, and will note material changes on this page.