Privacy notice
Last updated: 14 September 2026
This notice explains how North West Support Group Ltd, trading as Ghosthawk, handles personal information in connection with this website, enquiries, client and partner relationships, and our investigation and operational services.
It describes processing for which North West Support Group Ltd is responsible as controller. A client or other organisation may provide additional privacy information where it is also responsible for particular processing.
Who we are
North West Support Group Ltd is a company registered in England and Wales under company number 17195023. Ghosthawk is a trading name of North West Support Group Ltd.
This notice covers the personal information we use in operating Ghosthawk, including information connected with enquiries, instructions, investigations, asset work, suppliers, specialists and commercial relationships. More specific privacy information may be provided where a particular service or relationship requires it.
Information we process
The information we process depends on the reason we are dealing with you and the nature of any instruction. It may include:
- Names, contact details, job titles, organisations and other identity or relationship information.
- Enquiries, correspondence, instructions, contracts, authority records and case-management information.
- Asset and location information, including vehicle registrations, VINs, serial numbers, possession, location, movement or authorised telematics information.
- Investigation and evidential material such as statements, notes, chronologies, photographs, video, documents, records, observations and information lawfully obtained through enquiries.
- Employment, professional, business, association or transaction information where relevant to a defined instruction.
- Financial or payment information required for our own client, supplier and accounting administration, and financial or transactional information relevant to an investigation where lawfully obtained.
- Criminal-offence information and special-category information where it is genuinely necessary for a lawful purpose and the additional legal requirements for that processing are met.
- Website and security information such as IP address, browser or device information, timestamps, requested pages and technical or security logs.
We aim to collect only information that is relevant and proportionate to the purpose for which it is required.
Where information comes from
We may receive personal information directly from you or obtain it from other sources where this is lawful and relevant to a defined purpose. Sources may include:
- The person concerned, an instructing client, employer, insurer, solicitor, business or other organisation.
- Witnesses, customers, employees, contractors, associates and other people with relevant information.
- Publicly accessible records, registries, websites and open-source material.
- Client-held business, contract, asset, vehicle, communications or incident records supplied with appropriate authority.
- Authorised tracking, telematics, asset-location or other technical information.
- Field enquiries, inspections, observations and proportionate surveillance or covert activity where separately justified and authorised.
- Investigators, specialist practitioners, recovery operators, technical providers and other delivery partners involved in an instruction.
- Professional advisers, public authorities, regulators or law-enforcement bodies where information may lawfully be obtained or shared.
Where information is obtained from a publicly accessible source, that fact may form part of the privacy information provided for the relevant processing.
How and why we use information
We may use personal information to:
- Respond to enquiries and discuss possible instructions, accounts or partnerships.
- Check authority, scope, conflicts, risk, proportionality and whether an instruction can be accepted.
- Provide Asset Operations and Investigation & Intelligence services, including investigation, tracing, verification, authorised recovery, surveillance and other properly authorised work.
- Establish facts, develop intelligence, test accounts, locate or verify assets and prepare reports or evidential records.
- Manage client relationships, instructions, suppliers, specialists, billing, complaints and quality assurance.
- Protect Ghosthawk, our clients and others against fraud, unlawful activity, security threats and misuse of systems.
- Establish, exercise or defend legal rights and obtain professional advice.
- Meet legal, regulatory, insurance, accounting and record-keeping requirements.
Ghosthawk does not make decisions about individuals that produce legal or similarly significant effects solely by automated means.
Lawful bases and sensitive data
The lawful basis depends on the processing activity. We may rely on:
Contract
Where processing is necessary to take requested steps before entering into an agreement or to perform an agreement with you.
Legal obligation
Where processing is necessary to meet a legal or regulatory requirement.
Legitimate interests
Where necessary for legitimate business, investigative, security or legal interests and those interests are not overridden by the rights and interests of the person concerned.
Recognised legitimate interest
Where the statutory conditions are met, including necessary and proportionate processing for qualifying crime-prevention, detection or investigation purposes.
Consent may be used where it is genuinely appropriate, but it is not treated as the default basis for investigation activity simply because consent would be convenient.
Special-category and criminal-offence information
Some instructions may involve information that has additional legal protection, including health or other special-category information, or information relating to alleged or proven offences. Ghosthawk will only process that information where an Article 6 lawful basis and any additional condition required by the UK GDPR and Data Protection Act 2018 are available. Required safeguards, records and policy documentation must also be in place.
Investigation and operational data
Investigation and asset work can involve personal information about people who have not contacted Ghosthawk directly. We may therefore receive or develop information about subjects of enquiries, witnesses, employees, vehicle users, associates, customers or other relevant people.
Where personal information is obtained from another source, we consider the transparency requirements that apply to that processing. In some circumstances the law permits privacy information to be delayed or not provided, for example where providing it would be impossible, involve disproportionate effort, seriously impair the purpose of the processing, or where a specific exemption or restriction applies.
Where Article 14 applies and no exception or exemption is available, we provide the required privacy information within the applicable period, normally no later than one month after obtaining the information, or earlier where required by law.
Those circumstances are assessed case by case. We do not treat the fact that work is described as an investigation as a blanket reason to withhold privacy information.
Who we share information with
Where necessary and lawful, relevant information may be shared with:
- The client or instructing organisation and people authorised to receive the output of an instruction.
- Vetted investigators, associates, specialist practitioners, forensic or technical providers and other delivery partners.
- Recovery, transport and storage providers where required for an asset instruction.
- Website, hosting, email, communications, IT, cybersecurity and other business-system providers acting on our behalf.
- Accountants, lawyers, insurers and other professional advisers.
- Courts, regulators, public authorities or law-enforcement bodies where disclosure is required or permitted by law.
We limit disclosure to what is reasonably necessary for the purpose and use contractual, confidentiality or other controls where appropriate. We do not sell personal information.
International transfers
Some service providers may store or process information outside the United Kingdom. Where a restricted transfer is made, it will be covered by UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or Addendum together with any required transfer-risk assessment, or another transfer mechanism permitted by law. You can contact privacy@ghosthawk.co.uk for information about the safeguards relevant to your personal information.
How long we keep information
We do not keep personal information for longer than is reasonably necessary for the purpose for which it is held.
- Routine enquiries that do not become instructions are generally retained for up to 24 months after the last meaningful contact.
- Client and case information is retained according to the nature of the instruction, contractual requirements, insurance and legal obligations, potential claims or disputes, evidential need and applicable limitation periods.
- Financial and company records are retained for the periods required by law and normal business-accounting requirements.
- Special-category and criminal-offence information is subject to additional necessity, minimisation and retention controls where applicable.
Information that is no longer reasonably required is deleted, anonymised or securely disposed of.
Security
Ghosthawk uses technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Access is limited according to role and need, and specialist providers are expected to meet appropriate security, confidentiality and handling requirements.
No system can remove every risk, so security controls are reviewed as the business, systems and services develop.
Your rights
Depending on the circumstances and the legal basis being used, you may have rights to:
- Request access to personal information held about you.
- Ask for inaccurate or incomplete information to be corrected.
- Ask for information to be erased or for its use to be restricted.
- Object to particular uses of your information.
- Receive certain information in a portable format.
- Withdraw consent where consent is the basis for processing.
Data-protection rights are not absolute. The law may limit or restrict a right in particular circumstances, including some investigative, legal-claims and crime-related contexts.
Right to object
Where we rely on legitimate interests or a recognised legitimate interest, you may have the right to object to that processing based on your particular circumstances. This right is not absolute in every case.
Requests should be sent to privacy@ghosthawk.co.uk. We may need enough information to verify identity and locate the relevant records.
Complaints
You can make a data-protection complaint by emailing privacy@ghosthawk.co.uk. We will acknowledge a complaint within 30 days, take appropriate steps to investigate it, keep you informed where necessary and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.
Changes to this notice
This notice will be reviewed as Ghosthawk's services, systems and legal requirements develop. The latest version will be published on this page with the date of the most recent update.