Introduction
Edward Nash LLP (trading as “Nash Partnership”) is committed to protecting your privacy and handling your personal data fairly, lawfully and transparently.
This Privacy Notice explains how we collect, use, store, share and protect personal data when you:
- Visit our website
- Contact us
- Engage our services
- Apply for employment or work experience opportunities
- Attend our offices, events or meetings or
- Otherwise interact with us
We process personal data in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (“PECR”), the Data (Use and Access) Act 2025 (“DUAA”), and other applicable data protection legislation.
Who We Are
Edward Nash LLP (trading as Nash Partnership) is the data controller responsible for your personal data.
Contact details:
- Registered address: 23a Sydney Buildings, Bath, BA2 6BZ
- Email: mail@nashpartnership.com
- Telephone: 01225 442424
- Company registration: OC301974
If you have any questions about this privacy notice or how we handle your data, please contact us using the details above.
It is very important that the information we hold about you is accurate and up to date. Please let us know if at any time your personal information changes by emailing us at mail@nashpartnership.com.
Personal data we collect
Depending on your relationship with us, we may collect and process the following categories of personal data.
Contact information: Name, employer or organization, job title, email address, telephone number, postal address
Client and project information: Project-related information, instructions and correspondence, meeting notes, contractual information, billing and payment information, records relating to services provided
Website information: IP address, browser type, device information, operating system, website usage data, cookie identifiers, analytics information
Recruitment information (Where you apply for employment, work experience or other opportunities with us): CV and employment history, qualifications, professional memberships, references, interview notes, recruitment communications
Supplier information: Contact details, contract information, payment and financial information
Office visitor information: Visitor sign-in records
How we collect personal data
We collect personal data:
- Directly from you
- Through our website
- Through email, telephone and meetings
- Through project and business relationships
- From publicly available sources
- From recruitment agencies and referees
- Through cookies and analytics technologies
- From suppliers, consultants and professional advisers
Why we use personal data
1. Providing professional services
We use personal data to:
- Deliver architectural, heritage, placemaking and planning consultancy services
- Manage projects and client relationships
- Communicate regarding projects and instructions
Legal basis: Performance of a contract and legitimate interests.
2. Managing our business
We use personal data to:
- Maintain business records
- Manage suppliers and consultants
- Obtain professional advice
- Protect legal rights and interests
- Meet regulatory obligations
Legal basis: Legitimate interests and legal obligations.
3. Responding to enquiries
We use personal data to:
- Respond to enquiries;
- Arrange meetings and consultations;
- Provide requested information.
Legal basis: Legitimate interests.
4. Recruitment
We use personal data to:
- Assess applications;
- Conduct interviews;
- Verify qualifications and references;
- Assess suitability for employment;
- Comply with legal obligations relating to employment.
Legal basis: Legitimate interests, legal obligations and taking steps prior to entering into an employment contract.
5. Marketing and business development
We may use personal data to:
- Send information about our services;
- Share project updates and practice news;
- Invite contacts to events and networking opportunities.
Legal basis: Legitimate interests or consent where required under PECR.
You may opt out of marketing communications at any time.
6. Website analytics and improvement
We use analytics technologies to:
- Understand how visitors use our website;
- Improve website performance and functionality;
- Monitor website reliability and security;
- Evaluate the effectiveness of content and communications.
Koko Analytics: We use Koko Analytics, a privacy-focused analytics platform, to generate aggregated website statistics. Koko Analytics is designed to minimise the collection of personal data and does not track users across websites or create advertising profiles. Information collected through Koko Analytics is used solely to understand website usage and improve our services.
Google Analytics: We also use Google Analytics to understand how visitors interact with our website. Google Analytics may collect information including:
- Pages viewed;
- Time spent on pages;
- Device and browser information;
- Approximate geographic location;
- Website navigation behaviour.
Google Analytics uses cookies and similar technologies to collect this information. Where required by law, Google Analytics cookies are only activated after you have provided consent through our cookie management system. For information about how Google processes personal data, please see: https://policies.google.com/privacy
Legal basis: Legitimate interests and consent where required.
Cookies and similar technologies
Our website uses cookies and similar technologies to:
- Enable website functionality;
- Improve website performance;
- Understand website usage;
- Remember user preferences;
- Support website security.
Strictly necessary cookies
These cookies are essential for the operation and security of the website and do not require consent.
Analytics cookies
We use:
- Koko Analytics; and
- Google Analytics.
Google Analytics cookies are only deployed where consent is required and has been provided.
Managing cookies
You can manage your cookie preferences through your browser settings. You may also delete cookies already stored on your device.
Marketing communications
We may send communications relating to:
- Our services
- Practice news
- Projects and case studies
- Events and industry updates
You may unsubscribe from marketing communications at any time by:
- Following the unsubscribe instructions included in communications or
- Contacting us directly
We do not sell personal data to third parties for marketing purposes.
Sharing personal data
We may share personal data with:
- Professional advisers
- Accountants and auditors
- Legal advisers
- IT support providers
- Cloud hosting providers
- Website and analytics providers
- Recruitment providers
- Consultants, contractors and project partners
- Regulatory authorities
- Courts, law enforcement agencies and government bodies where required by law
All third parties are required to process personal data securely and only for legitimate purposes.
International transfers
Some of our service providers may process personal data outside the UK.
Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including:
- UK adequacy regulations
- The UK International Data Transfer Agreement (IDTA)
- The UK Addendum to Standard Contractual Clauses
- Other lawful transfer mechanisms recognised under UK data protection law
Google may process information outside the UK. Appropriate safeguards are applied where required. Where Koko Analytics is self-hosted, analytics information may remain within the UK or EEA.
You may contact us for further information about international transfer safeguards.
Data retention
We retain personal data only for as long as necessary for the purposes for which it was collected.
Typical retention periods
| Category | Retention period |
| General enquiries | Up to 24 months |
| Marketing contacts | Until consent is withdrawn or an objection is received |
| Recruitment records (unsuccessful applicants) | Up to 12 months |
| Recruitment records (successful applicants) | Whilst employed and up to 6 years after employment ends |
| Client project records | Typically 6 years after project completion unless longer retention is required |
| Supplier records | 6 years after the end of the relationship |
| Financial records | As required by applicable law |
| Visitor records | Up to 12 months |
Retention periods may be extended where necessary to comply with legal, insurance or regulatory requirements.
Security
We implement appropriate technical and organisational measures designed to protect personal data against:
- Unauthorised access
- Accidental loss
- Alteration
- Disclosure
- Destruction
These measures include:
- Access controls
- Password protection
- Secure cloud services
- Staff training
- Cybersecurity measures
- Supplier safeguards
Automated decision-making
We do not use personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on individuals.
Your rights
Under UK data protection law, you may have the right to:
- Access your personal data
- Correct inaccurate personal data
- Request deletion of personal data
- Restrict processing
- Object to processing
- Request transfer of your personal data
- Withdraw consent where processing relies on consent
Where we rely on legitimate interests as a legal basis, we have considered and balanced any potential impact on your rights and freedoms before carrying out the processing activity. To exercise any of these rights, please contact: privacy@nashpartnership.com
Data Protection Complaints Procedure
If you have concerns about how we process your personal data, please contact us first so that we can investigate and attempt to resolve the matter.
Data protection contact: privacy@nashpartnership.com
We will:
- Acknowledge receipt of your complaint (within 30 days)
- Investigate the matter fairly and impartially
- Respond within a reasonable timeframe (target date of 3 months)
- Inform you of any actions taken
If you are unsatisfied with this outcome, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) using our case reference.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: https://www.ico.org.uk
Telephone: 0303 123 1113
Third-party websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy notices separately.
Changes to this privacy notice
We may update this Privacy Notice from time to time. The latest version will always be available on our website.
Last reviewed: June 2026