Privacy policy

Last updated: 25 September 2026

LATITUDE provides private client operations and concierge services to principals, families and their representatives. This website is operated by LATITUDE and is powered by Shopify.

This Privacy Policy explains how LATITUDE collects, uses, shares, stores and protects personal information when you visit our website, make an enquiry, engage our services or otherwise interact with us.

LATITUDE follows a principle of data minimisation. We only collect, use and share personal information where it is necessary for a legitimate purpose, including understanding, arranging and delivering the services you request.

LATITUDE operates in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who is responsible for your information

Depending on the circumstances, LATITUDE may act as a data controller or as a data processor.

Where LATITUDE determines why and how personal information is processed, LATITUDE acts as the data controller.

Where LATITUDE processes personal information solely on the documented instructions of a client, principal, family office or other organisation acting as controller, LATITUDE may act as a data processor.

For website enquiries and the administration of LATITUDE's own business, LATITUDE will ordinarily act as the data controller.

Personal information we may collect

The information we collect depends on how you interact with LATITUDE and the nature of the requirement you ask us to handle.

We may collect:

• your name, email address, telephone number and other contact details;
• information you provide when making an enquiry or communicating with us;
• information concerning a principal, family member, authorised representative, household employee or other person involved in a requirement;
• travel, accommodation, transportation, reservation and itinerary information;
• addresses, locations, vehicle information and other logistical information where required;
• invoices, receipts, budgets, authorised expenditure, payment instructions and transaction information;
• information required to arrange or coordinate services with suppliers or specialists;
• technical information associated with use of our website, such as device, browser, IP address and website usage information; and
• other information reasonably necessary to understand, arrange or deliver an authorised requirement.

We do not seek to collect personal information merely because it may be available.

Sensitive personal information

Certain requirements may make it necessary for LATITUDE to process more sensitive information.

This could include health or medical information, allergies, dietary requirements, children's information, passport or identity documentation, security-related information or, in limited circumstances, information relating to criminal or investigative matters.

We only process such information where it is genuinely necessary and where an appropriate lawful basis and any additional condition required by UK data protection law applies.

Sensitive information is subject to more restrictive collection, access, disclosure and retention controls.

How we collect personal information

We may receive personal information:

• directly from you;
• through an enquiry submitted through our website;
• through communications with LATITUDE;
• from a principal, family member, authorised representative, family office, household or other person acting on your behalf;
• from suppliers, specialists or professional advisers involved in an authorised requirement;
• from service providers supporting LATITUDE's operations;
• from publicly available sources where appropriate; or
• automatically when you interact with our website, including through cookies and similar technologies.

Where we receive personal information about someone from another source, we handle any applicable transparency obligations in accordance with data protection law.

How we use personal information

We may use personal information to:

• understand and respond to enquiries;
• assess and arrange private client requirements;
• provide and coordinate LATITUDE services;
• identify, assess and coordinate appropriate suppliers, specialists and other resources;
• make or facilitate reservations, travel arrangements, transportation, events and other requested services;
• communicate with clients, representatives, suppliers and other relevant parties;
• administer contracts, invoices, payments and business records;
• maintain appropriate operational and compliance records;
• protect LATITUDE, our clients and others against security threats, fraud or misuse;
• establish, exercise or defend legal rights;
• respond to lawful requests from courts, regulators, law enforcement or other competent authorities;
• comply with legal and regulatory obligations; and
• operate, maintain and secure our website and business systems.

LATITUDE does not quietly reuse personal information for materially unrelated purposes. If a materially new purpose arises, we assess the purpose, lawful basis and transparency requirements before beginning that processing.

Our lawful bases for processing

The lawful basis we rely upon depends on the particular processing activity.

These may include:

Contract — where processing is necessary to take steps at your request before entering into a contract or to provide services under a contract.

Legal obligation — where we need to process or retain information to comply with a legal requirement.

Legitimate interests — where processing is necessary for a legitimate business or operational purpose and those interests are not overridden by your rights and interests. This may include proportionate business administration, supplier management, security, record keeping and protecting or establishing legal rights.

Consent — where consent is the appropriate lawful basis and has been obtained.

Where special-category or criminal-offence information is processed, LATITUDE will also identify and apply any additional condition required under the UK GDPR and Data Protection Act 2018.

Sharing personal information

LATITUDE follows a minimum-necessary-disclosure principle.

Being part of LATITUDE's supplier or specialist network does not automatically give anyone access to client information.

Where necessary to deliver a requirement, we may share relevant information with:

• suppliers and specialist service providers;
• travel, hospitality, transport, aviation or accommodation providers;
• event and private-service providers;
• professional advisers;
• technology, hosting, storage and communications providers;
• payment and financial service providers;
• authorities, regulators, emergency services, law enforcement or other organisations where disclosure is lawfully required or justified; and
• other parties where you direct or authorise us to make the disclosure.

We seek to provide recipients only with the information reasonably necessary for their role in the particular requirement.

Depending on the arrangement, a supplier or specialist may process information under their own privacy terms and legal responsibilities.

Relationship with Shopify

Our website is hosted by Shopify.

Shopify collects and processes certain personal information concerning your access to and use of this website in order to provide its platform and related services.

Information submitted through this website may therefore be processed by Shopify and its authorised service providers, including in countries outside the United Kingdom.

Shopify may also process information about interactions with Shopify-powered services for purposes for which Shopify is independently responsible.

You can find further information about Shopify's processing and privacy practices in the Shopify Consumer Privacy Policy and through Shopify's Privacy Portal.

Cookies and website technology

Our website may use cookies and similar technologies required to operate the website, remember preferences, understand website use, maintain security and provide functionality made available through Shopify or other approved service providers.

Where applicable law requires consent for particular cookies or technologies, they will not be used until the appropriate consent has been obtained.

You can manage available cookie choices through the cookie controls provided on our website.

Third-party websites and services

Our website or communications may contain links to websites or services operated by third parties.

LATITUDE is not responsible for the privacy practices of independent third-party websites or services. Where you provide information directly to another organisation, its own privacy notice and terms may apply.

International transfers

LATITUDE may coordinate requirements internationally. This means that, where necessary, personal information may be transferred to or accessed by recipients outside the United Kingdom.

Before making a restricted international transfer, LATITUDE considers whether the transfer is covered by applicable UK adequacy regulations or whether another lawful transfer mechanism is required.

Where appropriate, safeguards may include the UK International Data Transfer Agreement, the UK Addendum to recognised standard contractual clauses, or another mechanism permitted by UK data protection law.

We do not design routine processing around exceptional transfer provisions where an appropriate ordinary transfer mechanism should instead be used.

Information about safeguards relevant to a particular transfer can be requested from LATITUDE.

Security

LATITUDE takes proportionate technical and organisational measures to protect personal information against unauthorised access, disclosure, alteration, loss or misuse.

Our approach includes data minimisation, need-to-know access, access controls, approved storage locations, appropriate encryption and authentication, secure credential management, supplier and technology-provider assessment, and controlled retention and deletion.

No method of electronic transmission or storage can guarantee absolute security. We therefore also limit the information we collect and retain wherever reasonably possible.

Sensitive documents should not be sent through insecure channels where a secure method of transfer has been provided.

How long we keep personal information

LATITUDE keeps personal information only for as long as it remains necessary for the purpose for which it was collected, or where another legitimate or legal requirement justifies retention.

Retention depends on the type and purpose of the information.

As a general approach:

• task-specific operational information is normally removed after the requirement has closed and any short operational buffer has expired;
• particularly sensitive information may be deleted sooner once the operational need ends;
• prospective-client information is normally reviewed or deleted 12 months after the last substantive interaction;
• active client information is periodically reviewed for continued necessity and accuracy;
• temporary credentials are revoked or deleted promptly when they are no longer required;
• contracts, invoices, accounting records and other legally or evidentially necessary records may be retained for longer periods in accordance with applicable legal, contractual and business requirements; and
• information subject to an active legal, regulatory, complaint or rights-related hold may be retained for as long as that hold remains necessary.

Where LATITUDE acts solely as a processor, retention and deletion may instead be governed by the instructions of the relevant controller and the applicable agreement.

Children's information

LATITUDE's website and services are not directed at children acting independently.

However, because LATITUDE provides private client services to families, an authorised requirement may legitimately involve personal information relating to a child, for example in connection with travel, childcare, medical arrangements or other family requirements.

Children's information is treated with heightened care. LATITUDE seeks to collect and disclose only the information necessary for the authorised purpose, with particularly sensitive information deleted promptly when it is no longer required.

Your data protection rights

Depending on the circumstances and the lawful basis for processing, UK data protection law may give you rights including:

• the right to request access to personal information we hold about you;
• the right to ask us to correct inaccurate or incomplete information;
• the right to request erasure of personal information in certain circumstances;
• the right to request restriction of processing in certain circumstances;
• the right to object to certain processing;
• the right to receive or transfer certain information in a portable format where the right to data portability applies;
• the right to withdraw consent where processing relies on consent; and
• rights relating to solely automated decision-making where applicable.

These rights are not absolute and may depend on the circumstances and the lawful basis for processing.

LATITUDE may take proportionate steps to verify identity before acting on a rights request where necessary to protect personal information.

Your right to object

Where LATITUDE relies on legitimate interests as the lawful basis for processing, you may have the right to object to that processing based on your particular circumstances.

Where personal information is processed for direct marketing, you have the right to object to that processing at any time.

Automated decision-making

LATITUDE does not currently use solely automated decision-making that produces legal or similarly significant effects on individuals.

Technology may be used to support administration, security and compliance, but decisions concerning significant individual rights or interests are not intended to be made solely by automated systems without appropriate assessment and safeguards.

Complaints

If you have concerns about how LATITUDE handles your personal information, we encourage you to contact us so that we can investigate and respond.

You also have the right to complain to the UK's independent data protection regulator, the Information Commissioner's Office (ICO).

Information Commissioner's Office

Changes to this Privacy Policy

We may update this Privacy Policy where our services, systems, processing activities or legal obligations change.

Where we make changes, we will update the date shown at the top of this policy and provide any additional notice required by applicable law.

We will not use a change to this Privacy Policy as a means of quietly introducing materially different processing without considering the applicable lawful basis and transparency requirements.

Contact LATITUDE

If you have questions about this Privacy Policy, want further information about how LATITUDE handles personal information, or wish to exercise a data protection right, please contact:

LATITUDE
Email: john@latitudeprivate.com

For the processing activities where LATITUDE determines the purposes and means of processing, LATITUDE is the data controller.