GCA Altium holds data to meet its business obligations and to market its services. This is a mix of personal (relating to an identifiable person) and corporate data.

We are centralising our applications and where data solutions are common across our offices the data is held in the EU or countries with equivalent protection (Switzerland and UK). Otherwise data is retained within the jurisdiction of the relevant office or that of the data processors appointed by them (e.g. cloud services may hold data in jurisdictions separate to our office but with security standards sufficient to meet the requirements of GDPR).

We review and enhance the security that surrounds confidential data on a periodic basis. The process continues rather than reaches a conclusion, as a risk-based approach needs to adapt as threats increase in sophistication. Clients, suppliers and staff receive separate more detailed notifications; however, if you need us to re-supply a notice please advise your regular contact at GCA Altium. The main categories of data we are required to hold include those relating to clients, suppliers and staff.

Clients and potential clients – contact, terms of engagement and deal related information.

Suppliers – records to maintain proper book and records and VAT and other tax obligations. This includes contractual terms, contact information, payment details and related historical data.

Applicants for employment – CVs and other information provided by the applicant, information for the recruitment agent, references and other background checks undertaken with consent;

Staff – information to meet HR obligations and provide the benefits due to staff under the terms of their contract of employment. This data typically includes details of family members.

With the data subject’s consent, we retain marketing data to provide relevant information. Should you wish to receive information, please subscribe via our website.

If you wish to update or remove your information, please contact our marketing team at or reply to their communications.

In general you will receive a separate notice that details whom to contact should you wish to make a subject access request. If you cannot find this, please ask your usual contact at GCA Altium.