01Who we are
CMNC Associates Limited is the data controller for the personal data described in this notice. We are a company registered in England and Wales, number 10735302, with a registered office at 167-169 Great Portland Street, London, W1W 5PF.
We are supervised by HMRC for anti-money-laundering purposes. Our CFO, Christina Christoforou, is a member of the Association of Chartered Certified Accountants and acts as our head of privacy.
We collect very little from website visitors and a great deal from clients, because we cannot do the work without it. This notice separates the two, so you can find the part that applies to you.
02If you only visit the website
You can read every page on this site without giving us anything. We set no cookies and run no advertising or analytics trackers on our public pages. There is no consent banner because there is nothing to consent to.
The Cash Health Check
If you complete the 5-Minute Cash Health Check, your browser stores your answers and results in session storage so the tool can show them back to you. That is held on your own device, is not sent anywhere by itself, and disappears when you close the tab.
If you then choose to give us your details to receive your results, we record:
- Your name, email address and company name, as you enter them
- Your score and calculated results from the tool
- Whether you consented to hear from us
- The date and time, the country your request came from, and your browser user-agent string
This is stored in Cloudflare Workers KV and a notification is emailed to us. Lawful basis: consent, which you can withdraw at any time by emailing us.
Anti-abuse
To stop automated abuse of the form, we count submissions per IP address. Your IP address is held for roughly one hour for that purpose and then deleted automatically. It is not stored against your enquiry and is not used to identify you. Lawful basis: legitimate interests, being the security of our systems.
Booking a call
Our booking links go to Calendly. If you book, Calendly processes your name, email and chosen time under its own privacy notice, and passes those details to us.
03If you become a client
Delivering the Control Method means working inside your finances. That involves more personal data, and some of it is not yours.
| What we process | Why | Lawful basis |
|---|---|---|
| Contact and business details for you and your team | To deliver the engagement and communicate | Contract |
| Bank transaction data, which may identify directors, employees, suppliers and payees | Cash allocation, categorisation, reporting and review | Contract, and legal obligation for AML |
| Identity documents and verification results | Customer due diligence we are required to carry out | Legal obligation |
| Correspondence and meeting notes | Running the engagement and keeping a record of advice | Legitimate interests |
Where you are a client, you and we are each independent data controllers for client personal data, unless a Statement of Work expressly appoints us as your processor. Your engagement terms set this out in full and take precedence over this notice for engagement matters.
You are responsible for having a lawful basis to share other people's data with us, and for telling those people how their data will be used. You may refer them to this notice.
04How we use AI
We use AI tools to help categorise transaction data and to draft documents. Where personal data is involved in that processing, it is carried out in line with this notice, the relevant data protection law, and the terms of the AI provider. For client engagements, we only do this with your written consent, as set out in your engagement terms.
We do not use client data to train public AI models.
06How long we keep it
| Record | Retention | Reason |
|---|---|---|
| Financial and transaction records | 6 years | Aligned with HMRC requirements |
| AML and due diligence records | 5 years from the end of the relationship | Money Laundering Regulations |
| General correspondence | 3 to 6 years | Business and legal need |
| Website enquiries and Cash Health Check results | 24 months from your last contact with us | To follow up on your enquiry |
| IP addresses used for rate limiting | Approximately 1 hour | Deleted automatically |
07How we protect it
We maintain administrative, physical and technical safeguards proportionate to the sensitivity of the data we hold. In practice that means encrypted transfer, access limited to the people who need it, password management, and contractual confidentiality obligations on everyone who touches client data, including subcontractors.
If a personal data breach occurs, we will notify affected clients without undue delay and report to the Information Commissioner's Office where the law requires it.
08Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Erase data, where we have no overriding legal reason to keep it
- Restrict or object to processing carried out under legitimate interests
- Portability, receiving your data in a machine-readable format
- Withdraw consent at any time, where consent is the basis we rely on
To exercise any of these, email us. We will respond within one month. Some records we are legally required to retain, in particular AML records, and we will tell you plainly if that applies to your request.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would prefer the chance to put it right first.
09How to contact us
We review this notice at least annually and whenever our processing changes. The date at the top of this page is the date of the current version.