Strategic Counsel for Non-Standard,
High-Exposure Situations
Scylla Advisory is a boutique strategic advisory practice engaged in non-standard, high-exposure situations both before impact and after disruption has already occurred.
We act for individuals, groups, and companies, operating beyond established playbooks who may encounter high-risk situations around the world and domestically because of changing political circumstances and a need to get ahead of the competition.
We engage where your situation resists classification: politics, business, law, communications or an inextricable combination of them. Our team is ready to jump on board and assist, whether your situation arises before the ship hits the rocks and can be sailed to calmer waters or after impact, where your value needs to be salvaged and a route to your destination must be navigated.
Where we have operated
INTERPOL Red Notice proceedings
Political imprisonment & unlawful detention
Assassination attempts & personal security threats
State representation before international bodies
High-value corruption & financial crime cases
Abduction & cross-border hostage situations
Presidency & heads of state advisory
Fact-finding & independent investigations
HNWI reputation & narrative defence
Extreme crisis communications strategy
Privacy Policy
1. Introduction and Identity of the Data Controller
This Privacy Policy explains how Scylla Advisory Ltd ('Scylla Advisory', 'we', 'us', 'our') collects, uses, stores, and
protects personal data in connection with our website located at www.scyllaadvisory.com and our advisory
services.
Scylla Advisory Ltd is a company registered in England and Wales. Our registered details are as follows:
• Company name: Scylla Advisory Ltd
• Registered number: 17471468
• Registered office: 12 Old Bond Street, Mayfair, London, W1S 4PW, United Kingdom
• ICO registration number: ZC255422
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018,
Scylla Advisory Ltd is the Data Controller in respect of personal data collected through this website and in
connection with our services.
Contact details for all data protection matters:
• Email: info@scyllaadvisory.com
• Telephone: +44 204 577 3909
• Address: 12 Old Bond Street, Mayfair, London, W1S 4PW, United Kingdom
We take the privacy and confidentiality of all individuals who contact us with the utmost seriousness. Given the
sensitive nature of the matters on which we advise, data protection is not merely a legal obligation for Scylla
Advisory Ltd — it is fundamental to the integrity of everything we do.
2. Scope of This Policy
This Privacy Policy applies to:
• All visitors to www.scyllaadvisory.com regardless of location
• All individuals who submit enquiries via our contact form
• All individuals who contact us by email, telephone, or any other means
• All prospective and current clients of Scylla Advisory Ltd
This policy does not apply to third-party websites linked from our website. We are not responsible for the privacy
practices of any third party.
3. Legal Framework
As a company registered in England and Wales, Scylla Advisory Ltd processes personal data in accordance
with the following legislation:
• The UK General Data Protection Regulation (UK GDPR) — as retained in UK law by the European Union
(Withdrawal) Act 2018
• The Data Protection Act 2018
• The Privacy and Electronic Communications Regulations 2003 (PECR)
Where we process personal data of individuals located in the European Economic Area, we also comply with the
EU General Data Protection Regulation (EU GDPR, Regulation 2016/679) to the extent applicable.
Where we process personal data of California residents, we also comply with the California Consumer Privacy
Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
We are registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration
number is: ZC255422 .
4. Personal Data We Collect
4.1 Data You Provide Directly
When you submit an enquiry via our contact form or contact us directly, we may collect the following personal
data:
• Full name
• Email address
• Company or organisation name (if provided)
• Telephone number (if provided)
• The content of your message or enquiry
• Any additional personal data you choose to include in your communications with us
We collect only the minimum personal data necessary to respond to your enquiry and assess whether we are
able to assist you.
4.2 Data Collected Automatically
When you visit our website, certain technical data is collected automatically, subject to your consent via our cookie consent banner. This may include:
• Anonymised IP address — we apply IP anonymisation and your full IP address is never stored
• Browser type and version
• Device type (mobile, desktop, tablet)
• Operating system
• Pages visited and time spent on each page
• Referring website or traffic source
• Geographic location at city and country level only
We do not collect full IP addresses. All analytics data is anonymised before processing.
4.3 Special Category Data
Given the nature of our advisory services, individuals who contact us may voluntarily disclose sensitive personal
data including information relating to political opinions, religious beliefs, criminal proceedings, health matters, or
racial or ethnic origin. Such data is treated as special category data under Article 9 of the UK GDPR and is
handled with the highest level of protection and discretion.
We process special category data only where you have provided explicit consent pursuant to Article 9(2)(a) UK
GDPR, or where processing is necessary for the establishment, exercise, or defence of legal claims pursuant to
Article 9(2)(f) UK GDPR.
5. How We Use Your Personal Data
5.1 Responding to Enquiries
Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) — our legitimate interest in assessing and
responding to potential client enquiries.
We use personal data submitted via our contact form or provided directly to respond to your enquiry, assess
whether we are able to assist with your situation, and communicate with you in connection with a potential or
existing engagement.
5.2 Providing Advisory Services
Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR) or Legitimate interests (Article 6(1)(f) UK
GDPR).
Where an engagement is established, we use personal data to deliver our advisory services, fulfil our
contractual obligations, and maintain appropriate records of our work.
5.3 Analytics and Website Improvement
Legal basis: Consent (Article 6(1)(a) UK GDPR).
Where you have consented via our cookie consent banner, we use Google Analytics 4 (Measurement ID:
G-QB7GLXP5DX) to understand how visitors use our website. This data is anonymised and aggregated. IP
anonymisation is applied in all cases.
5.4 Advertising
Legal basis: Consent (Article 6(1)(a) UK GDPR).
Where you have consented via our cookie consent banner, we use Google Ads conversion tracking to measure
the performance of our advertising. No personally identifiable data is transmitted to Google without your
consent.
5.5 Legal Compliance and Anti-Money Laundering
Legal basis: Legal obligation (Article 6(1)(c) UK GDPR).
We may process personal data where necessary to comply with applicable legal obligations, including
obligations under the Proceeds of Crime Act 2002, the Money Laundering, Terrorist Financing and Transfer of
Funds (Information on the Payer) Regulations 2017, the Terrorism Act 2000, professional regulations, and court
orders.
6. Cookies and Tracking Technologies
Our website uses cookies in compliance with the Privacy and Electronic Communications Regulations 2003 (PECR). A cookie is a small text file placed on your device when you visit a website.
We obtain your consent before placing any non-essential cookies on your device through our cookie consent management platform (Usercentrics). You may accept all cookies, reject all non-essential cookies, or manage your preferences by category at any time.
6.1 Strictly Necessary Cookies
These cookies are essential for the website to function and do not require consent under PECR.
• Provider: Wix.com Ltd | Purpose: Core website functionality and security | Duration: Session
6.2 Analytics Cookies
These cookies are placed only with your consent and allow us to analyse website traffic.
• Cookie: _ga | Provider: Google LLC | Purpose: Distinguishes unique users | Duration: 2 years
• Cookie: _ga_QB7GLXP5DX | Provider: Google LLC | Purpose: Session state for GA4 | Duration: 2 years
6.3 Marketing Cookies
These cookies are placed only with your consent and are used to measure advertising performance.
• Cookie: _gcl_au | Provider: Google LLC | Purpose: Advertising conversion tracking | Duration: 90 days
• Cookie: IDE | Provider: Google LLC (doubleclick.net) | Purpose: Ad measurement | Duration: 13 months
6.4 Google Consent Mode
Our website operates Google Consent Mode v2. This ensures that Google Analytics and Google Ads tracking
technologies operate strictly in accordance with the consent choices you make through our cookie banner.
Where consent is withheld, no personally identifiable data is transmitted to Google.
6.5 Managing Cookies
You may update your cookie preferences at any time by clicking the cookie settings option on our website. You
may also control cookies through your browser settings. Further guidance is available at www.aboutcookies.org
or ico.org.uk/cookies.
7. Disclosure of Personal Data
Scylla Advisory Ltd does not sell, rent, trade, or otherwise disclose personal data to third parties for commercial
purposes.
We may share personal data with the following categories of recipients, strictly as necessary and subject to appropriate contractual safeguards including Data Processing Agreements where required by UK GDPR:
• Google LLC — for website analytics (Google Analytics 4) and advertising measurement (Google Ads),
subject to Google's Data Processing Terms. Google is certified under the EU-US Data Privacy Framework.
• Wix.com Ltd — as our website hosting provider. Wix's Privacy Policy is available at support.wix.com.
• Usercentrics GmbH — as our cookie consent management platform, Usercentrics processes consent
records on our behalf.
• Professional advisors — including legal counsel, accountants, and compliance advisors, subject to
professional duties of confidentiality.
• HM Revenue and Customs (HMRC) — where we are required to disclose information in connection with our
tax obligations.
• The National Crime Agency and other law enforcement authorities — where we are required to make
disclosures under the Proceeds of Crime Act 2002, the Terrorism Act 2000, or other applicable legislation. In
certain circumstances we may be prohibited by law from informing you that such a disclosure has been
made.
• Courts, tribunals, and regulatory authorities — where disclosure is required by applicable law or court order.
All third-party data processors are required to process personal data only on our documented instructions and in
accordance with applicable data protection law.
8. International Transfers of Personal Data
Some of our third-party service providers, including Google LLC, are based outside the United Kingdom. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with Chapter V UK GDPR, including:
• UK International Data Transfer Agreements (IDTAs) or UK Addenda to EU Standard Contractual Clauses, approved by the Secretary of State
• Transfers to countries with UK adequacy regulations in force
• Certification under the EU-US Data Privacy Framework where applicable
Details of the specific safeguards in place for any international transfer of your personal data are available on request by contacting us using the details provided in Section 1.
9. Data Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, subject to
any legal, regulatory, or professional obligations requiring retention for longer periods.
Our standard retention periods are as follows:
• General enquiries via the contact form: 2 years from the date of receipt, unless an engagement is established.
• Data relating to an engagement: 7 years from the conclusion of the engagement, in accordance with the
Limitation Act 1980 and applicable professional obligations
• Anti-money laundering records: 5 years from the end of the business relationship, as required by the Money Laundering Regulations 2017
• Analytics data: up to 14 months, in accordance with Google Analytics 4 default retention settings
• Cookie consent records: 3 years, as evidence of compliance with PECR
• Marketing and advertising data: for the duration of the relevant campaign plus 90 days
On expiry of the applicable retention period, personal data is securely deleted or permanently anonymised.
10. Security of Personal Data
We implement appropriate technical and organisational measures to protect personal data against unauthorised
access, accidental loss, destruction, alteration, or disclosure, in accordance with Article 32 UK GDPR.
Our security measures include:
• SSL/TLS encryption for all data transmitted between your browser and our website
• Access to personal data restricted exclusively to the co-founders of Scylla Advisory Ltd on a strictly
need-to-know basis
• No other members of staff have access to personal data submitted through our website or received in
connection with client enquiries
• Secure encrypted email communications
• Regular review of our security measures and data protection practices
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO
within 72 hours of becoming aware of the breach in accordance with Article 33 UK GDPR, and will notify affected individuals without undue delay where required by Article 34 UK GDPR
11. Your Rights as a Data Subject
11.1 Rights Under UK GDPR and the Data Protection Act 2018
If you are located in the United Kingdom, you have the following rights under the UK GDPR and the Data Protection Act 2018:
• Right of access (Article 15 UK GDPR) — you may request a copy of the personal data we hold about you
(Subject Access Request). We will respond within one calendar month.
• Right to rectification (Article 16 UK GDPR) — you may request correction of inaccurate or incomplete personal data.
• Right to erasure (Article 17 UK GDPR) — you may request deletion of your personal data in certain circumstances.
• Right to restriction of processing (Article 18 UK GDPR) — you may request that we restrict the processing
of your personal data in certain circumstances.
• Right to data portability (Article 20 UK GDPR) — you may request your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract.
• Right to object (Article 21 UK GDPR) — you may object to processing based on legitimate interests or for
direct marketing purposes.
• Right to withdraw consent (Article 7(3) UK GDPR) — where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Rights in relation to automated decision-making (Article 22 UK GDPR) — you have the right not to be subject to decisions based solely on automated processing that produce significant legal or similarly significant effects.
11.2 Rights Under CCPA/CPRA (California Residents)
If you are a resident of California, you have the following additional rights:
• Right to know what personal information we collect, use, share, or sell
• Right to delete personal information we hold about you
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information for cross-context behavioural advertising
• Right to limit our use of sensitive personal information to that which is necessary to perform our services
• Right to non-discrimination for exercising your privacy rights
To exercise your right to opt out, please use the 'Do Not Sell or Share My Personal Information' link in the footer
of our website, or contact us directly using the details in Section 1.
11.3 How to Exercise Your Rights
To exercise any of your rights, please contact us using the details in Section 1. We will acknowledge your
request within 5 business days and respond substantively within one calendar month. In complex cases we may extend this period by a further two months, notifying you within the first month.
We may need to verify your identity before processing your request. We will not charge a fee for responding to reasonable requests.
11.4 Right to Lodge a Complaint
If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint
with the relevant supervisory authority. We would ask that you contact us first so that we have the opportunity to
address your concerns.
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk — 0303 123 1113
• European Union: Your local national data protection supervisory authority — edpb.europa.eu
• California: California Privacy Protection Agency (CPPA) — cppa.ca.gov
12. Children's Privacy
Our website and services are not directed at children under the age of 13 (or 16 where applicable under local
law). We do not knowingly collect personal data from children under these ages. If we become aware that
personal data has been submitted by a child without appropriate parental or guardian consent, we will delete
such data promptly.
13. Third-Party Links
Our website may contain links to third-party websites. We are not responsible for the privacy practices, content,
or security of any third-party website. The inclusion of a link on our website does not constitute endorsement of
that website or its privacy practices.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or our
services. We will update the Last Updated date at the top of this policy whenever we make material changes.
We encourage you to review this policy periodically.
15. Contact Us and Data Protection Queries
All data protection enquiries, Subject Access Requests, and complaints are handled exclusively by the
co-founders of Scylla Advisory Ltd. No other members of staff have access to, or involvement in, the processing
of personal data submitted through our website or received in connection with any enquiry.
Contact details:
• Email: info@scyllaadvisory.com
• Telephone: +44 204 577 3909
• Address: 12 Old Bond Street, Mayfair, London, W1S 4PW, United Kingdom
We aim to respond to all data protection enquiries within 5 business days. Subject Access Requests will be
responded to within one calendar month as required by UK GDPR.