Privacy Policy
T&H Holdings Limited (trading as T&H Consulting)
Last updated: 18/07/2026
1. Who we are
T&H Holdings Limited (“we”, “us”, “our”) provides blockchain investigations, evidence preparation, research, and consulting services for businesses and individuals.
- Company registration number: 12747126 (England and Wales)
- VAT number: GB367205104
- ICO Data Protection Registration number: ZB144566
- Registered address: 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom
- Phone: +44 20 4630 0041
- Email: info@tandhconsult.com / support@tandhconsult.com
- Website: https://tandhconsult.uk/
Data Protection Officer: Hanna Adynets — support@tandhconsult.com
We are the “data controller” of the personal data described in this policy, which means we decide how and why your personal data is processed.
This policy applies to personal data we collect through our website, when you enquire about or purchase our services, and in the course of delivering our investigation and consulting services.
2. The personal data we collect
Data you provide to us
- Identity data — name, title, and (where relevant to a case) date of birth and identification documents
- Contact data — email address, telephone number(s), postal address
- Financial and transaction data — payment details, billing information, and records of services purchased (card payments are processed by our payment provider; we do not store full card numbers)
- Case, investigation, and fraud report data — information you submit in connection with an investigation or when reporting a suspected fraud or scam to us, including details of the suspected fraud and the parties involved, cryptocurrency wallet addresses, transaction records, correspondence with third parties, and supporting evidence
- Communications data — the content of your enquiries, complaints, reviews, and correspondence with us
- Recruitment data — CVs and application details if you apply for a job or secondment with us
Data we collect automatically
- Technical data — IP address (truncated for analytics), browser type and version, device information, operating system
- Usage data — how you use our website, pages visited, and interaction patterns, collected via cookies and Google Analytics (see Section 8)
Special category and criminal offence data
Because of the nature of our investigation services, case files may include information relating to actual or alleged criminal offences (for example, details of a fraud you have reported). We process this data under Article 10 UK GDPR and Schedule 1 of the Data Protection Act 2018, on the basis that processing is necessary for the establishment, exercise or defence of legal claims, or for the prevention or detection of unlawful acts. We do not seek to collect special category data (such as health or ethnicity data) and ask that you do not send it to us unless it is essential to your case.
3. How we collect your data
Most of the personal data we process is provided directly by you, when you:
- Request a quote or free consultation
- Purchase or use our services
- Report a suspected fraud or scam to us
- Make an enquiry or complaint
- Subscribe to our newsletter
- Leave a review
- Apply for a job or secondment
- Represent your organisation in dealings with us
We may also collect data from third parties in the course of an investigation, including publicly available sources (open-source intelligence), blockchain records (which are public by design), and, where lawful, information provided by law enforcement agencies, banks, and cryptocurrency exchanges.
4. Why we use your data and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing our investigation, research, and consulting services, including through partner investigation firms working on our behalf | Art. 6(1)(b) — performance of a contract |
| Providing customer support, whether directly or through our partners | Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interests |
| Responding to enquiries and quotes | Art. 6(1)(b) — steps prior to a contract; Art. 6(1)(f) — legitimate interests |
| Processing payments and maintaining accounting records | Art. 6(1)(b) — contract; Art. 6(1)(c) — legal obligation (tax and accounting law) |
| Preparing investigative reports and liaising with law enforcement, banks, and exchanges on your behalf | Art. 6(1)(b) — contract; Art. 6(1)(f) — legitimate interests |
| Retaining case files, fraud reports, and evidence to prevent and detect fraud and to defend or establish legal claims | Art. 6(1)(f) — legitimate interests; Art. 10 and DPA 2018 Sch. 1 Pt 2 (prevention or detection of unlawful acts) for offence data |
| Sending our e-newsletter and marketing communications | Art. 6(1)(a) — consent (you may withdraw at any time) |
| Website analytics and optional cookies | Art. 6(1)(a) — consent |
| Website security, fraud and spam prevention, IT system integrity | Art. 6(1)(f) — legitimate interests |
| Complying with legal obligations, court orders, and regulatory requirements (including anti-money-laundering checks where applicable) | Art. 6(1)(c) — legal obligation |
| Protecting someone’s vital interests (e.g. preventing serious harm) | Art. 6(1)(d) — vital interests |
| Recruitment | Art. 6(1)(b) — steps prior to a contract; Art. 6(1)(f) — legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded that our processing is proportionate. You may object at any time (see Section 9).
5. Who we share your data with
We do not sell your personal data. We share it only where necessary, with:
- Partner companies that deliver services on our behalf, including partner investigation firms that carry out investigative work and provide customer support in connection with your case. These partners process your data (including case and fraud report data) only on our instructions, under written data processing agreements, and must keep it confidential and secure to the same standard we do.
- Service providers acting on our instructions under contract, including website hosting, payment processing, email, IT support, blockchain analytics platforms, and anti-spam services. They may only use your data to provide services to us and must keep it confidential and secure.
- Law enforcement agencies, banks, and cryptocurrency exchanges, where this is part of the service you have engaged us for (for example, submitting an investigative report in support of a fund-recovery effort), or where we are legally required to disclose.
- Professional advisers — lawyers, auditors, accountants, and insurers, where necessary.
- Regulators and authorities — including HMRC, the ICO, or courts, where required by law.
- A buyer or successor in the event of a sale, merger, or reorganisation of our business, in which case this policy will continue to apply to your data.
6. International transfers
Some of our partner companies and service providers (for example, partner investigation firms, analytics providers, and blockchain intelligence platforms) may process data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure an adequate level of protection through one or more of the following: a UK adequacy decision for the destination country; the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or other safeguards permitted by UK GDPR. You may contact us for details of the safeguards applied to any specific transfer.
7. How long we keep your data (retention)
We retain personal data only for as long as necessary for the purposes it was collected, and to comply with legal, accounting, and regulatory requirements. Our standard retention periods are:
| Category of data | Retention period | Reason |
|---|---|---|
| Client contracts, case files, investigation reports, and related correspondence | 6 years from the end of the client relationship or closure of the case | Limitation period for contractual claims (Limitation Act 1980); defence of legal claims |
| Fraud reports and submission data (details of suspected frauds, wallet addresses, evidence, and associated parties) | Up to 10 years from submission, subject to periodic review, after which the data is deleted or anonymised | Prevention and detection of fraud and other unlawful acts (DPA 2018 Sch. 1 Pt 2, para 10); supporting future investigations; defence of legal claims |
| Invoices, payment, and accounting records | 6 years from the end of the financial year they relate to | Companies Act 2006 and HMRC requirements |
| Enquiries and quotes that do not become a client engagement | 12 months from last contact | Follow-up and business administration |
| Newsletter and marketing data | Until you unsubscribe or withdraw consent, then suppressed | Consent-based processing |
| Website analytics data | 14 months from your last visit | Service improvement (consent-based) |
| Cookie consent records | 11 months | Demonstrating consent |
| Recruitment data (unsuccessful applicants) | 6 months from the end of the recruitment process | Defence of discrimination claims |
| Complaint records | 6 years from resolution | Defence of legal claims |
Fraud report data. We retain data submitted to us about suspected frauds and scams for an extended period because it serves an ongoing fraud prevention and detection purpose: patterns, wallet addresses, and entities identified in one case frequently assist in preventing or investigating others. This retention is reviewed periodically to ensure it remains necessary and proportionate.
In limited cases we may keep data longer than the periods above — for example, where litigation or a regulatory investigation is ongoing or reasonably anticipated, or where we are legally required to preserve records. When personal data is no longer needed, we securely delete or anonymise it. Anonymised data (which can no longer identify any individual) falls outside data protection law and may be retained indefinitely for statistical and fraud intelligence purposes.
8. Cookies and analytics
Our website uses cookies. Cookies that are strictly necessary for functionality, security, and accessibility are always set. All other cookies (functional, performance, analytics, and advertisement) are set only with your consent, which you can give or refuse via our cookie banner and change at any time via “Cookie Settings”.
We use Google Analytics to understand visitor numbers and behaviour patterns. This runs only if you opt in. We have configured it to limit the data collected (including truncating IP addresses), we restrict access to the analytics data, and we do not attempt — and do not permit Google to attempt — to identify individual visitors. Analytics data is retained for 14 months from your last visit.
We also use an anti-spam service (CleanTalk) to protect our forms from automated abuse; this processes technical data such as IP address on the basis of our legitimate interest in site security.
9. Your data protection rights
Under UK data protection law, you have the right to:
- Access — request copies of your personal data
- Rectification — ask us to correct inaccurate data or complete incomplete data
- Erasure — ask us to delete your data in certain circumstances
- Restriction — ask us to restrict processing in certain circumstances
- Objection — object to processing based on legitimate interests, and object at any time to direct marketing
- Data portability — receive the data you gave us in a machine-readable format, or have it transferred to another organisation, in certain circumstances
- Withdraw consent — where processing is based on consent (e.g. marketing, analytics), withdraw it at any time without affecting the lawfulness of processing before withdrawal
You will not be charged for exercising your rights. We will respond within one month of receiving your request (extendable by up to two further months for complex requests, in which case we will tell you).
Please note that some rights are limited where we must retain data to comply with legal obligations or to establish, exercise, or defend legal claims — for example, we may be unable to delete a case file that is subject to a litigation hold or statutory retention period. Where this applies, we will explain the reason in our response.
To exercise any right, contact us at info@tandhconsult.com or +44 20 4630 0041.
10. How to complain
If you have concerns about our use of your personal data, please contact us first so we can try to resolve the issue. You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 Website: https://www.ico.org.uk
11. Data security
We have implemented appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, alteration, and destruction, including access controls, encryption in transit, and confidentiality obligations for staff and service providers. Access to case files is restricted to authorised personnel on a need-to-know basis. While we take these precautions seriously, no system can be guaranteed 100% secure; if a data breach occurs that is likely to result in a risk to your rights, we will notify the ICO and, where required, notify you without undue delay.
12. Children
Our services and website are directed at adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
13. Changes to this policy
We may update this policy from time to time. The latest version will always be available on our website with the “Last updated” date shown at the top. Significant changes will be highlighted on the website or notified to you directly where appropriate.
14. Contact us
T&H Holdings Limited 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom
Email: info@tandhconsult.com / support@tandhconsult.com
Phone: +44 20 4630 0041
Data Protection Officer: Hanna Adynets (support@tandhconsult.com)
