Privacy Policy

Torham Law is a payment consulting firm headquartered in the United Kingdom, with physical presence in Europe and the Middle East. For the purposes of applicable data protection law, including the UK GDPR, we act as a data controller for personal data collected through this website and during client engagements.

You can reach us about any privacy matter at counsel@torhamlaw.com or by telephone at +44 7447 184322.

• Enquiry data — your name, work email, industry, jurisdiction of interest and the content of your message when you submit a consultation request or other form on this website.
• Engagement data — identity documents, corporate records, proof of address, beneficial-ownership information, source-of-funds documentation and other materials needed for due diligence, company formation, account opening or licensing work.
• Correspondence data — records of emails, calls and meetings with you.
• Technical data — standard web-server information such as IP address, browser type and pages visited.

• To respond to enquiries and provide the advisory services you request.
• To carry out anti-money-laundering, counter-terrorist-financing, sanctions and know- your-client checks required by law.
• To introduce or submit applications on your behalf to banks, payment institutions, registries, licensed agents and regulators.
• To keep business records, issue invoices and comply with tax and legal obligations.
• To protect the website and our business against fraud and misuse.

We process personal data because it is necessary to perform our contract with you or to take steps at your request before entering a contract; because we have a legal obligation, including AML and record-keeping duties; because we have a legitimate interest in running and protecting our business; and, where relevant, because you have given consent — for example when you choose to hear about new services.

We share personal data only where it is necessary to deliver the services or meet legal duties. Recipients may include:

• Banks, payment institutions and correspondent-account providers you ask us to approach.
• Company registries, registered agents, notaries and regulators in relevant jurisdictions.
• Trusted service providers — such as secure hosting, document storage and email-delivery partners — acting under contract.
• Professional advisers, auditors, and public authorities where the law requires or permits disclosure.

We never sell personal data, and we do not use it for unrelated third-party marketing.

Because we work across the United Kingdom, Europe, the Middle East and offshore jurisdictions, your data may be transferred to and processed in countries other than your own. Where data leaves the UK or EEA, we use safeguards such as adequacy decisions or contractual clauses to protect it.

We keep enquiry data for as long as needed to handle it, and engagement records — including due-diligence files — for the periods required by AML and professional rules, which are typically five years or longer after the end of the engagement. Data that is no longer needed is securely deleted or anonymised.

We apply technical and organisational measures appropriate to the sensitivity of client material, including access controls, encryption in transit, and confidentiality duties binding our personnel. No transmission over the internet is entirely secure, so please avoid sending unnecessary highly sensitive documents through the website forms before an engagement is opened.

Subject to legal limits, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased or restricted in certain circumstances, to object to certain processing, to data portability, and to withdraw consent where consent is our basis. You may also complain to the UK Information Commissioner's Office or your local supervisory authority.

To exercise any right, contact us at counsel@torhamlaw.com. We will respond within the statutory period. Note that AML legislation requires us to retain certain records even if you ask us to delete them.

We may update this policy from time to time. The current version is always published on this page.