We never hold your data
The safest data is data we never touch. Here's exactly how a licence works.
De-identified before it leaves
A vetted vendor works inside your environment (or the estate's). Names, contact details, account numbers and rare identifying details are removed or replaced, and a "motivated intruder" test is documented, in line with the ICO's 2025 anonymisation guidance. Pseudonymised data is still personal data, so we don't stop there.
What always stays out
Customer personal data unless genuinely anonymised; payment and bank numbers; data about children; health records; privileged legal material; direct messages and HR or grievance threads.
Buyers are vetted
We check who the legal entity is and where, what it does with data it already holds, and its confirmed customers. Every licence names the licensee, bans resale and re-identification (a criminal offence under DPA 2018 s.171), limits retention and ends with a deletion certificate.
National security checks
In 2025 the UK government asked for evidence on data brokers and national security, including how brokers make sure data reaches only trusted actors. No new rules have been set yet. We already work as if they had:
- Who really owns the buyer: we check the buyer's ultimate owners and controllers, not just the company that signs.
- Sanctions screening: buyers and their owners are screened against the UK, US, EU and UN sanctions lists before any data room opens.
- Where it goes: no licences to organisations linked to states that pose a threat to the UK. Transfers outside the UK use an adequacy decision or the ICO's international data transfer agreement.
- No sensitive bulk data: we don't aggregate data across clients, and special category data is never licensed.
- Misuse detection: datasets can carry unique marker records, so any copy that turns up where it shouldn't can be traced to the licence it came from.
- Secure delivery: encrypted transfer, time-limited access and a signed deletion certificate at the end.
People can object
Staff, former staff and customers can ask to be left out through our objection page, and we honour it.
Insolvency practitioners
We know the 2020 FCA/ICO/FSCS warning about selling clients' personal data. Our model is different: de-identified operational data only, assessment first, sensitive categories excluded, purchaser warranties, and commission on realisations disclosed to creditors.