How Momentum Advisory collects, uses and protects personal information.
Momentum Advisory (“Momentum”, “we”, “us”) is a Jersey-based management consultancy serving regulated financial services businesses. Momentum Advisory is the trading name of Andy Mallet, a sole trader based in Jersey.
This statement explains what personal information we collect, why we collect it, how we look after it and the rights you have. It applies if you:
It does not cover personal information we handle on behalf of our clients while delivering an engagement. In that situation the client decides how the information is used, and the client’s own privacy notice applies. Section 8 explains how we handle that information.
Momentum is the controller of the personal information described in this statement. We comply with the Data Protection (Jersey) Law 2018 and, where they apply to the people we deal with, the UK General Data Protection Regulation and the EU General Data Protection Regulation.
We are registered with the Jersey Office of the Information Commissioner as a controller, under registration number 104183.
Andy Mallet, our Founder and Principal Consultant, is responsible for data protection at Momentum. You can contact him at info@momentumjersey.com.
We collect only what we need for the purposes set out in section 4.
| Who you are | What we collect | Where it comes from |
|---|---|---|
| Website visitors and resource downloads |
| You, and our website host |
| Clients and prospective clients |
| You, your colleagues, introducers, and public sources such as LinkedIn and company websites |
| Introducers, referral partners and professional contacts |
| You, mutual contacts and public professional sources |
| Meeting participants | A written transcript and notes of what is said in meetings where you agree to our AI note-taker being used (see section 6) | The meeting itself |
| Associates, subcontractors and suppliers |
| You, and referees you nominate |
We do not intend to collect special category information (such as health data) about our contacts, and our services are not aimed at children.
Data protection law requires us to have a lawful basis for each use of personal information. Ours are set out below.
| Why we use it | Lawful basis |
|---|---|
| To send you a resource you have requested and respond to your enquiries | Our legitimate interests in responding to requests made to us, and taking steps at your request before entering into a contract |
| To send you occasional insights, updates and invitations relevant to your professional role | Our legitimate interests in promoting our services to business contacts. You can opt out at any time using the link in our emails or by contacting us |
| To prepare proposals, deliver engagements and manage our relationship with clients | Performance of our contract with the client; where you are an employee of a client, our legitimate interests in delivering that contract |
| To keep notes of meetings using an AI transcription tool | Our legitimate interests in keeping accurate records. We ask everyone present before using it and do not use it if anyone objects |
| To engage and pay associates, subcontractors and suppliers | Performance of a contract |
| To keep accounting and tax records | Compliance with our legal obligations |
| To keep our systems secure and to establish, exercise or defend legal claims | Our legitimate interests, and compliance with our legal obligations |
Where we rely on legitimate interests, we have considered your interests and rights and concluded they are not overridden. You can ask us for details of that assessment.
Momentum is an AI-native consultancy. We use a small number of approved AI tools to support research, analysis, drafting and note-taking. We govern this through our AI Acceptable Use Policy, which is available on request. In particular:
With your agreement, we may use an AI note-taking tool to transcribe meetings so that we can keep accurate notes. The tool we use runs on our own device and does not join the meeting as a visible participant. It does not keep an audio recording: audio is deleted once transcription is complete, and the transcript and notes are stored in Europe.
We will always ask at the start of a meeting before using it. If anyone present objects, we will not use it. Transcripts and notes are kept with the related client or prospect record and deleted in line with section 11.
Our website does not use advertising, analytics or tracking cookies.
Our website host records technical information such as IP addresses to keep the site secure and running. When you submit a form, the details you provide are processed by our website host and, for resource downloads, the resource is sent to you by our email delivery provider.
To display our pages, your browser loads fonts from Google Fonts and some images from an external image hosting service. These providers receive your IP address when your browser requests these files.
If we introduce analytics or other non-essential cookies in future, we will update this statement and ask for your consent where required.
During engagements we may see personal information that belongs to our clients, such as information about their staff, customers or, for some clients, other individuals connected with their business. In these cases the client is the controller and Momentum acts as its processor. We:
If you want to exercise your rights over that information, please contact the client organisation. If you contact us, we will pass your request to them promptly.
We never sell personal information. We share it only with the service providers we use to run our business, and only as far as they need it to provide their service.
| Provider | What they do for us | Where data is held |
|---|---|---|
| Microsoft | Email, document storage, collaboration and Microsoft 365 Copilot | European Union, United Kingdom and United States |
| Anthropic | Claude AI assistant for research, analysis and drafting | United States |
| Jamie (meetjamie.ai) | AI meeting transcription and notes | European Union |
| Netlify | Website hosting and form handling | United States |
| Resend | Delivery of resources requested through our website | United States |
| Revolut | Business banking and payments | United Kingdom and European Economic Area |
| Professional networking and messaging | Ireland and United States |
We may also share information with our professional advisers (such as lawyers, accountants and insurers), with associates working on an engagement under confidentiality obligations, and with regulators, courts or law enforcement where the law requires it.
Some of our providers hold information outside Jersey. Transfers to the United Kingdom and the European Economic Area are permitted because those jurisdictions are recognised as providing adequate protection. Where information is transferred elsewhere, including to the United States, we rely on an approved safeguard such as the EU–US Data Privacy Framework (and its UK Extension) or standard contractual clauses. You can ask us for details of the safeguard that applies.
| Information | How long we keep it |
|---|---|
| Client engagement records and correspondence | Six years after the engagement ends, then securely deleted |
| Personal information processed on behalf of clients | Returned or deleted at the end of the engagement, unless the client’s contract or the law requires otherwise |
| Financial and accounting records | As long as the law requires |
| Website enquiries and marketing contacts | Until you unsubscribe or ask us to delete your details. We review inactive contacts periodically. If you opt out, we keep a minimal record so that we do not contact you again |
| Meeting transcripts and notes | With the related client or prospect record, and deleted in line with it |
| Associate, subcontractor and supplier records | Six years after the relationship ends |
We use appropriate technical and organisational measures to protect personal information, including multi-factor authentication on our business accounts, encrypted devices, access limited to those who need it, and the security controls of our business platforms. Associates who work with us are bound by confidentiality obligations and our data protection and AI policies.
If a personal data breach occurs that is likely to put your rights at risk, we will notify the Jersey Office of the Information Commissioner within 72 hours and tell you without undue delay where required.
You have the right to:
To exercise any of these rights, contact us at info@momentumjersey.com. We will respond within four weeks. In some circumstances the law allows us to extend this period, and we will tell you if so. We do not normally charge a fee.
If you have a concern about how we handle your information, please contact us first so we can try to put it right. You also have the right to complain to the Jersey Office of the Information Commissioner at jerseyoic.org. If you live in the United Kingdom or the European Union, you can complain to the Information Commissioner’s Office or your local supervisory authority.
We review this statement at least once a year and whenever our use of personal information changes. The current version will always be available on this page.