Privacy Policy

NB-19 LTD (Company Number 13231427), trading as Barnveil. Basecamp Liverpool, 49 Jamaica St, Liverpool, L1 0AH.

1. Who We Are

Barnveil is a trading name of NB-19 LTD ("we", "us", "our"), a company registered in England and Wales (Company Number 13231427), operating from Basecamp Liverpool, 49 Jamaica St, Liverpool, L1 0AH. We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZB532432.

For services purchased directly from us, we are the data controller for personal data collected through our website and services. Where our services are delivered through a partner organisation, our role may differ — see section 6.

2. What Data We Collect

We may collect the following categories of personal data:

• Contact information: name, email address, phone number, when you contact us or purchase a service
• Payment information: processed securely through our payment provider; we do not store card details
• Assessment subject data: personal information you provide about yourself (or a consenting third party) for the purpose of a Digital Exposure Assessment, including name and known variations, email addresses, phone numbers, online usernames, current and previous addresses and the duration of address links, and social media profiles
• Exposure data: information about you identified through licensed data providers, public online sources, and known breach databases in the course of delivering the service
• Usage data: anonymised analytics data about how visitors interact with our website (e.g. page views, browser type)
• Communications: records of correspondence when you contact us by email or through our website

Special category data

Because our service maps what information about you is publicly exposed, exposure data may incidentally include special category data — for example, records held by data brokers that reveal or suggest information about your health, political opinions, religion, or sexual orientation. We do not seek this data out, we do not use it for any purpose other than reporting your exposure to you and, where instructed, requesting its removal, and we process it on the basis of your explicit consent given in our Data Protection & Consent Agreement. It is deleted in line with section 7.

3. How We Use Your Data

We use your personal data for the following purposes:

• To deliver the services you have requested, including mapping your digital exposure and submitting removal requests on your behalf
• To process payments and send service-related communications
• To respond to enquiries and provide customer support
• To improve our website and services using aggregated, anonymised analytics
• To comply with legal obligations, including fraud prevention and anti-money laundering requirements

We do not use your personal data for marketing, advertising, credit decisions, or profiling. We do not hack accounts or access private systems.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases for processing your data:

• Contract: processing is necessary to deliver services you have purchased
• Consent: you give explicit consent, via our Data Protection & Consent Agreement, for us to investigate your digital exposure and to act on your behalf in contacting third parties to remove your data
• Legitimate interests: to improve our services, prevent fraud, and maintain security
• Legal obligation: where we are required to process data to comply with UK law

5. Data Sharing

We do not sell, rent, or trade your personal data. We may share data with:

• Third parties for removal requests: where you have authorised us to act on your behalf, we submit removal, suppression, or restriction requests to data brokers, marketing providers, website operators, and other third parties holding your data. Each request includes only the minimum information needed to identify and remove your records.
• Service providers: third-party tools and platforms used to deliver our services (e.g. payment processors, email platforms, licensed data providers), bound by data processing agreements
• Legal authorities: where we are required to do so by law or court order

All third-party processors are required to handle your data in accordance with UK GDPR and our instructions.

6. Services Delivered Through Partners

Some of our services are delivered in partnership with, or on the instructions of, other organisations — for example, security, executive protection, or professional services firms who engage us on behalf of their own clients. In those cases:

• The partner organisation is typically the data controller for its client's personal data, and Barnveil acts as a data processor on the partner's documented instructions
• The partner's own privacy notice applies to how your data is collected and used, alongside this policy
• We process the data only to deliver the agreed service, under a written data processing agreement with the partner, and we do not use it for any other purpose

If you are unsure who the controller of your data is for a service you have received, contact us and we will tell you.

7. Data Retention

We keep personal data only as long as it is needed, and we apply the following retention periods:

• Assessment and exposure data: deleted or anonymised no later than 30 days after your final report is delivered, unless you have engaged ongoing monitoring or removal follow-up, in which case data is retained for the duration of that service and deleted no later than 30 days after it ends
• Correspondence and enquiries: retained for up to 24 months from last contact
• Contractual, invoicing and financial records: retained for 6 years, as required for tax and company law purposes
• Records retained under anti-money laundering or fraud prevention obligations: retained for 5 years from the end of the relevant relationship, as required by law

Where services are delivered through a partner (section 6), retention follows the partner's documented instructions and the applicable data processing agreement.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right to withdraw consent: you may withdraw consent at any time, which stops further processing
• Right of access: to obtain a copy of the personal data we hold about you
• Right to rectification: to correct inaccurate or incomplete data
• Right to erasure: to request deletion of your data in certain circumstances
• Right to restriction: to limit how we process your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests

To exercise any of these rights, please contact us at aaron@barnveil.co.uk. We will respond within one month, as required by UK GDPR.

9. Cookies

Our website may use essential cookies to ensure functionality. We do not use tracking or advertising cookies without your explicit consent. You can control cookie settings through your browser preferences.

10. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure, including encryption in transit and at rest, access controls, and vetting of service providers. However, no method of transmission over the internet is completely secure.

11. International Transfers

Where any of our service providers are based outside the UK or EEA, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or Standard Contractual Clauses with the UK Addendum, to protect your data in accordance with UK GDPR.

12. Complaints

If you have concerns about how we handle your personal data, please contact us first and we will do our best to resolve the issue. You also have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the effective date above. We encourage you to review this policy periodically.

14. Contact Us