Privacy Policy

NB-19 LTD (Company Number 13231427), trading as Barnveil. Basecamp Liverpool, 49 Jamaica St, Liverpool, L1 0AH.

1. Who We Are

Barnveil is a trading name of NB-19 LTD ("we", "us", "our"), a company registered in England and Wales (Company Number 13231427), operating from Basecamp Liverpool, 49 Jamaica St, Liverpool, L1 0AH. We are the data controller for personal data collected through our website and services.

2. What Data We Collect

We may collect the following categories of personal data:

• Contact information: name, email address, phone number, when you contact us or purchase a service
• Payment information: processed securely through our payment provider; we do not store card details
• Assessment subject data: personal information you provide about yourself (or a consenting third party) for the purpose of a Digital Exposure Assessment, including name and known variations, email addresses, phone numbers, online usernames, current and previous addresses and the duration of address links, and social media profiles
• Exposure data: information about you identified through licensed data providers, public online sources, and known breach databases in the course of delivering the service
• Usage data: anonymised analytics data about how visitors interact with our website (e.g. page views, browser type)
• Communications: records of correspondence when you contact us by email or through our website

3. How We Use Your Data

We use your personal data for the following purposes:

• To deliver the services you have requested, including mapping your digital exposure and submitting removal requests on your behalf
• To process payments and send service-related communications
• To respond to enquiries and provide customer support
• To improve our website and services using aggregated, anonymised analytics
• To comply with legal obligations, including fraud prevention and anti-money laundering requirements

We do not use your personal data for marketing, advertising, credit decisions, or profiling. We do not hack accounts or access private systems.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases for processing your data:

• Contract: processing is necessary to deliver services you have purchased
• Consent: you give explicit consent, via our Data Protection & Consent Agreement, for us to investigate your digital exposure and to act on your behalf in contacting third parties to remove your data
• Legitimate interests: to improve our services, prevent fraud, and maintain security
• Legal obligation: where we are required to process data to comply with UK law

5. Data Sharing

We do not sell, rent, or trade your personal data. We may share data with:

• Third parties for removal requests: where you have authorised us to act on your behalf, we submit removal, suppression, or restriction requests to data brokers, marketing providers, website operators, and other third parties holding your data. Each request includes only the minimum information needed to identify and remove your records.
• Service providers: third-party tools and platforms used to deliver our services (e.g. payment processors, email platforms, licensed data providers), bound by data processing agreements
• Legal authorities: where we are required to do so by law or court order

All third-party processors are required to handle your data in accordance with UK GDPR and our instructions.

6. Data Retention

We retain your personal data only for as long as needed to complete your service and any agreed follow-up period. After that, your data is securely deleted or anonymised unless we are required to retain it by law.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right to withdraw consent: you may withdraw consent at any time, which stops further processing
• Right of access: to obtain a copy of the personal data we hold about you
• Right to rectification: to correct inaccurate or incomplete data
• Right to erasure: to request deletion of your data in certain circumstances
• Right to restriction: to limit how we process your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests

To exercise any of these rights, please contact us at hello@barnveil.co.uk. We will respond within 30 days.

8. Cookies

Our website may use essential cookies to ensure functionality. We do not use tracking or advertising cookies without your explicit consent. You can control cookie settings through your browser preferences.

9. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. However, no method of transmission over the internet is completely secure.

10. International Transfers

Where any of our service providers are based outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data in accordance with UK GDPR.

11. Complaints

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the effective date above. We encourage you to review this policy periodically.

13. Contact Us