Data Protection & GDPR

Aquifert processes personal data principally of business contacts, but we apply the UK GDPR and the Data Protection Act 2018 in full. The controller is Aquifert Ltd (company number [●]), whose registered office is at [●], United Kingdom (“Aquifert”, “we”, “us”, “our”).

Data protection is designed into the Platform rather than added on: data minimisation, purpose limitation, role-based access and audit logging are built into how the product works.

• Data protection lead: reachable at privacy@aquifert.com (DPO function).
• Records of processing activities (ROPA) maintained under Article 30 UK GDPR and reviewed at least annually.
• Staff confidentiality obligations and data protection training on induction and annually.
• Data protection impact assessments (DPIAs) conducted for higher-risk processing, including AI-assisted features and compliance screening, before launch and on material change.
• A standing privacy-by-design checkpoint in our engineering review process.

Our compliance and matching systems use automated screening (sanctions lists, document checks, risk scoring). No decision with legal or similarly significant effect is made solely by automated means: the engine flags; a human clears. Every flagged transaction or account is reviewed by a trained member of our compliance or operations team, and you may request human review of any decision affecting you by emailing privacy@aquifert.com.

A core data-minimisation control is structural: the Platform is architected so that nothing that could reveal a Supplier reaches a buyer — ever. Quotations, shipping documents and certificates are re-issued or redacted before a buyer can see them. This limits the personal and commercial data any counterparty ever receives to the minimum needed to perform the contract.

Categories of sub-processors we engage (each under a written data processing agreement with Article 28 terms):

• Cloud hosting and managed database (EU/UK regions where available);
• Payment processing and billing;
• Transactional email and customer communications;
• Customer support and ticketing;
• Product analytics (subject to cookie consent);
• KYC/AML and sanctions screening providers.

Where personal data is transferred outside the UK, we rely on UK adequacy regulations, the UK IDTA, or the UK addendum to EU Standard Contractual Clauses, and assess transfer risk with supplementary measures (encryption, access controls) where required.

We handle access, rectification, erasure, restriction, objection and portability requests free of charge and within one month of receipt (extendable by two further months for complex requests, with notice). Requests: privacy@aquifert.com. We may need to verify your identity first.

We maintain a breach response procedure. Breaches likely to risk individuals’ rights and freedoms are reported to the ICO within 72 hours of becoming aware, and affected individuals are notified without undue delay where there is a high risk.

Retention periods are set out in our Privacy Policy (section 6). Data is deleted or irreversibly anonymised at the end of its retention period, subject to legal holds.

Data protection lead, Aquifert Ltd — privacy@aquifert.com. Supervisory authority: UK Information Commissioner’s Office (ico.org.uk).