Last updated: 16 October 2026

1. Introduction

Cope Whiterock Limited (“Whiterock”, “we”, “our” or “us”) respects the privacy of individuals who visit our website, contact our organisation or engage with our professional services.

We recognise the importance of protecting personal information and handling it responsibly.

This Privacy Policy explains how we collect, use, store and protect personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.

This policy applies to personal information processed through our website, business enquiries, professional correspondence and associated communications.

Additional privacy information may be provided where appropriate in connection with specific professional engagements.

2. Who We Are

Cope Whiterock Limited is a UK company providing specialist Technical Surveillance Countermeasures (TSCM), Physical Information Security Assurance (PISA) and related security consultancy services.

For the personal information covered by this policy, Cope Whiterock Limited generally acts as the data controller.

Website: www.whiterock.world

Contact: contact@whiterock.world

Registered office: 167–169 Great Portland Street, London W1W 5PF United Kingdom

Company registration number:  03063360

3. Information We Collect

Depending on how individuals interact with us, we may collect and process:

• Names and professional contact details.
• Business email addresses and telephone numbers.
• Organisation names and professional positions.
• Information submitted through website enquiries.
• Business correspondence and meeting communications.
• Requests concerning WHITE Papers and Whiterock NEWS.
• Technical information associated with website access, where collected by our website provider.

We may also receive professional contact information from organisations, business representatives and publicly available professional sources.

We seek to limit the collection of personal information to what is reasonably necessary for legitimate business purposes.

4. How We Use Personal Information

Personal information may be processed for the following purposes:

Business enquiries and communications

To respond to enquiries, arrange meetings and communicate with individuals regarding our services.

Professional services

To establish, administer and fulfil contractual or professional engagements.

Business administration

To maintain appropriate business records, manage commercial relationships and comply with applicable legal obligations.

Publications and professional information

To respond to requests concerning WHITE Papers, Whiterock NEWS and related professional publications.

Where we operate an email subscription service, we will explain how subscription information is used and provide an appropriate method of unsubscribing.

Website operation and security

To maintain the availability, functionality and security of our website.

5. Lawful Basis for Processing

We process personal information only where an appropriate lawful basis applies.

Depending on the circumstances, these may include:

Legitimate interests

Where processing is necessary for our legitimate business interests, including responding to professional enquiries, maintaining business relationships and protecting our systems, provided those interests are not overridden by individuals’ rights and freedoms.

Contractual necessity

Where processing is necessary to enter into or fulfil a contract with an individual.

Legal obligations

Where processing is required to comply with applicable legal, regulatory or statutory requirements.

Consent

Where consent is required, including certain electronic marketing activities and website technologies.

Where processing relies on consent, individuals may withdraw that consent at any time.

6. Sharing Personal Information

We do not sell personal information.

We may share personal information with trusted service providers where reasonably necessary for legitimate business operations.

These may include:

• Website hosting and technical service providers.
• Email and communications providers.
• Professional advisers.
• IT and information security service providers.
• Relevant authorities where disclosure is legally required.

Where third parties process personal information on our behalf, we seek to ensure that appropriate contractual and security arrangements are in place.

Information relating to confidential client engagements is subject to additional contractual and operational safeguards where applicable.

7. Information Security

We recognise that the confidentiality, integrity and availability of information are important considerations in our business activities.

We apply organisational and technical measures appropriate to the nature of the information being processed and the associated risks.

Access to personal information is restricted according to legitimate business requirements.

No method of electronic communication, transmission or storage can be guaranteed to be completely secure.

Individuals should avoid submitting highly sensitive or confidential operational information through general website enquiries unless an appropriate communication method has been agreed.

8. Information Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods are determined by factors including:

• The nature and purpose of the information.
• Applicable legal and regulatory obligations.
• Contractual requirements.
• Legitimate business and record-keeping needs.
• The establishment, exercise or defence of legal claims.

Information that is no longer required will be securely deleted, anonymised or otherwise disposed of as appropriate.

9. International Data Transfers

Where personal information is transferred outside the United Kingdom, we will ensure that an appropriate lawful transfer mechanism or applicable exemption is in place.

This may include transfers to countries covered by UK adequacy regulations or transfers protected by appropriate contractual safeguards.

Further information about applicable safeguards may be requested using the contact details provided in this policy.

10. Cookies and Website Technologies

Our website may use cookies and similar technologies to support website operation, security and functionality.

Where cookies or comparable technologies require consent under applicable UK legislation, we will provide appropriate information and obtain consent before using them.

Further details of the technologies used, their purposes and available choices will be provided through our website’s cookie information or consent controls, as applicable.

11. Individual Data Protection Rights

Under applicable UK data protection legislation, individuals may have rights concerning their personal information.

These include the right to:

• Request access to personal information.
• Request correction of inaccurate information.
• Request erasure in certain circumstances.
• Request restriction of processing.
• Object to certain processing activities.
• Request data portability where applicable.
• Withdraw consent where processing relies on consent.

Individuals have the right to object to processing based on legitimate interests in applicable circumstances. They also have the right to object to the processing of their personal information for direct marketing at any time.

These rights are subject to applicable legal conditions and exemptions.

Requests may be submitted using the contact details provided below.

12. Automated Decision-Making

We do not currently intend to use personal information collected through general website enquiries to make solely automated decisions that produce legal or similarly significant effects on individuals.

13. External Websites

Our website may contain links to external websites, publications and professional organisations.

We are not responsible for the privacy practices of independent third-party websites.

Visitors should review the relevant privacy information published by those organisations.

14. Privacy Enquiries and Complaints

Questions, concerns or requests relating to the processing of personal information should be directed to:

Cope Whiterock Limited
Email: contact@whiterock.world

We will consider and respond to privacy enquiries and complaints in accordance with applicable legal requirements.

Individuals also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information Commissioner’s Office
Website: ico.org.uk

We encourage individuals to contact us directly where possible so that concerns can be considered and addressed.

15. Changes to This Policy

We may review and update this Privacy Policy to reflect changes in legislation, regulatory guidance, business operations or website functionality.

The latest version will be published on this website with its date of revision.

Where changes materially affect how personal information is processed, we will provide additional information where required by law.

Cope Whiterock Limited
Independent Technical Surveillance Countermeasures and Physical Information Security Assurance