4.4 Financial and transaction information

​

We may collect:

​

• billing address;

• payment status;

• transaction amount;

• payment method;

• invoice and receipt information;

• refund information;

• bank-account details where required;

• accounting and bookkeeping records;

• source-of-funds information;

• source-of-wealth information; and

• transaction history.

​

Payment-card information may be collected and processed directly by our payment provider. We may not receive or retain complete payment-card details.

​

4.5 AML, KYC and compliance information

​

We may collect:

​

• identity-verification results;

• proof of address;

• source-of-funds and source-of-wealth evidence;

• beneficial-ownership information;

• sanctions and politically exposed person screening results;

• fraud-risk indicators;

• adverse-media screening results;

• risk assessments;

• information concerning the intended nature and purpose of a business relationship;

• information about expected business activities and transactions;

• copies of supporting documents;

• records of compliance reviews; and

• information required by Companies House, HMRC, our AML supervisor or another competent authority.

​

Where required and lawful, compliance information may include information relating to criminal allegations, offences, convictions, sanctions or suspected financial crime.

​

We process this type of information only where we have a lawful basis and any additional condition required by the Data Protection Act 2018.

​

4.6 Service and account information

​

We may collect:

​

• username and account details;

• services purchased;

• order history;

• application information;

• account settings;

• uploaded documents;

• customer-support records;

• mail-handling and forwarding instructions;

• scanned mail;

• renewal information;

• complaints;

• refund and cancellation requests; and

• records concerning the performance of our services.

​

4.7 Communications

​

We may retain:

​

• emails;

• telephone notes or recordings where lawful and notified;

• website enquiries;

• live-chat conversations;

• messages;

• complaint correspondence;

• customer-service requests;

• feedback and survey responses; and

• records of instructions and approvals.

​

4.8 Technical and website information

​

When you use our website, we may collect:

​

• IP address;

• browser type and version;

• device type;

• operating system;

• time-zone and approximate location;

• pages visited;

• referring website;

• links selected;

• dates and times of visits;

• account log-in activity;

• session information;

• cookie identifiers;

• security and fraud-prevention information; and

• information about how you interact with our website.

​

4.9 Marketing information

​

We may collect:

​

• marketing preferences;

• consent records;

• unsubscribe requests;

• email engagement information;

• campaign interaction information;

• services that may interest you; and

• records of when and how consent was obtained or withdrawn.

​

5. How we collect personal information

​

We may collect personal information:

​

5.1 Directly from you

​

This includes information provided when you:

​

• complete a website form;

• create an account;

• place an order;

• upload documents;

• contact us by email, telephone, post, live chat or social media;

• request customer support;

• complete identity verification;

• use our address or mail-handling services;

• subscribe to marketing;

• make a complaint; or

• otherwise communicate with us.

​

5.2 From a customer or authorised representative

​

A customer may provide information about directors, shareholders, members, partners, persons with significant control, beneficial owners, employees or other persons connected with an order.

​

If you provide another person’s information, you confirm that you have lawful authority to do so and, where required, that you have provided that person with this Privacy Policy.

​

5.3 From public sources

​

We may obtain information from:

​

• Companies House;

• HMRC and other government bodies;

• electoral or official registers where lawful;

• court and insolvency records;

• professional and regulatory registers;

• company websites;

• publicly available online sources; and

• sanctions, politically exposed person and adverse-media databases.

​

5.4 From service providers and other third parties

​

We may receive information from:

​

• identity-verification providers;

• fraud-prevention agencies;

• credit-reference agencies where lawful;

• payment providers;

• banks and financial institutions;

• professional advisers;

• accountants and bookkeeping providers;

• address and mail-handling providers;

• website, analytics and security providers;

• business partners and referral partners; and

• regulators or law-enforcement authorities.

​

6. Purposes and lawful bases

​

We only process personal information where we have a lawful basis.

​

Depending on the circumstances, we may rely on one or more of the following bases.

​

6.1 Performance of a contract

​

We process personal information where necessary to:

​

• provide a quotation;

• accept and administer an order;

• form a company;

• prepare or submit a filing;

• provide company-secretarial services;

• provide registered-office, service-address or virtual-office services;

• process and forward mail;

• prepare documents;

• manage an account;

• process payments and refunds;

• communicate about an order;

• provide customer support; and

• otherwise perform a contract with you.

​

This basis also applies where processing is necessary to take steps at your request before entering into a contract.

​

6.2 Legal obligation

​

We process information where necessary to comply with legal and regulatory obligations, including:

​

• identity-verification requirements;

• anti-money laundering and counter-terrorist financing obligations;

• sanctions compliance;

• fraud prevention;

• tax and accounting obligations;

• record-keeping requirements;

• Companies House requirements;

• responding to court orders or lawful requests;

• reporting suspected criminal or unlawful conduct; and

• responding to data-protection rights and complaints.

​

Where a legal obligation prevents us from deleting or disclosing certain information, that obligation will take priority.

​

6.3 Legitimate interests

​

We may process information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and freedoms.

​

Our legitimate interests may include:

​

• operating and improving our business;

• managing customer relationships;

• protecting our systems, website, staff and customers;

• preventing and investigating fraud or misuse;

• maintaining accurate records;

• enforcing contractual rights;

• recovering unpaid fees;

• handling legal claims;

• monitoring service quality;

• understanding how our website and services are used;

• carrying out proportionate business-to-business marketing;

• maintaining network and information security; and

• conducting internal administration, reporting and audits.

​

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and its potential effect on you.

​

6.4 Consent

​

We may rely on your consent for:

​

• optional cookies and similar technologies;

• certain electronic marketing communications;

• collecting or using information for an optional purpose explained when consent is requested; and

• any other processing where consent is the appropriate lawful basis.

​

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

​

6.5 Legal claims and substantial public interest

​

Where applicable, we may process information necessary to:

​

• establish, exercise or defend legal claims;

• prevent or detect unlawful acts;

• protect the public against dishonesty;

• meet regulatory requirements;

• prevent fraud;

• comply with anti-money laundering obligations; or

• fulfil another substantial-public-interest condition recognised by law.

​

7. If you do not provide information

​

Certain information is required to enter into or perform a contract or to comply with legal obligations.

If you do not provide requested information, we may be unable to:

​

• verify your identity;

• accept or continue an order;

• form your company;

• submit a filing;

• provide an address service;

• process or forward mail;

• provide accounting or compliance services;

• process a payment or refund; or

• continue the business relationship.

​

We may also be required to suspend or terminate services.

​

8. Identity verification and compliance screening

​

We may use electronic systems and specialist providers to verify identities, documents, addresses, beneficial ownership and other information.

Checks may include:

​

• document-authenticity checks;

• facial comparison or liveness checks where lawful;

• address verification;

• sanctions screening;

• politically exposed person screening;

• fraud screening;

• adverse-media screening; and

• comparison with public or commercial databases.

​

The results may be used to determine whether we can accept or continue a customer relationship.

​

We may be unable to explain certain compliance decisions where doing so is prohibited by anti-money laundering, sanctions, fraud-prevention or other legislation.

​

9. Companies House and public information

​

When you instruct us to form a company or submit a filing, information may be disclosed to Companies House and placed on the public register.

Depending on the filing, public information may include:

​

• company name and number;

• registered-office address;

• director and secretary details;

• service addresses;

• month and year of birth;

• nationality;

• occupation;

• shareholder information;

• share-capital information;

• person with significant control information; and

• filed documents.

​

Companies House determines what information is published and how long it remains available.

​

Information on the public register may remain permanently accessible, even after a company is dissolved or a person ceases to be involved.

You should not provide a residential address for public use unless it is necessary and you understand the consequences. Where eligible, you may purchase or use an appropriate service address.

​

We are not responsible for Companies House’s independent processing of information after it has been submitted.

​

10. Sharing personal information

​

We do not sell personal information.

​

We may share information where necessary with:

​

10.1 Government and regulatory bodies

​

These may include:

​

• Companies House;

• HMRC;

• our AML supervisor;

• law-enforcement agencies;

• the National Crime Agency;

• courts and tribunals;

• tax authorities;

• local authorities; and

• other competent regulators or public bodies.

​

10.2 Service providers

​

These may include providers of:

​

• website hosting and e-commerce services;

• cloud storage;

• customer-relationship management systems;

• email and communications;

• identity verification;

• sanctions and fraud screening;

• payment processing;

• accounting and bookkeeping software;

• document generation and electronic signatures;

• postal, courier and mail-handling services;

• IT support;

• cybersecurity;

• analytics;

• marketing tools; and

• professional advice.

​

Service providers may process information only for agreed purposes and subject to appropriate contractual and security requirements.

​

10.3 Professional advisers

​

We may share information with solicitors, accountants, auditors, insurers, consultants and other professional advisers where necessary.

​

10.4 Banks and business partners

​

Where you request or agree to an introduction, we may share relevant information with banks, payment providers, insurers, finance providers or other business partners.

​

Those organisations may act as independent controllers and provide their own privacy information.

​

10.5 Business transfers

​

If IBA Limited or part of its business is sold, transferred, merged, reorganised or acquired, relevant information may be disclosed to prospective purchasers, advisers and the new owner, subject to appropriate confidentiality and data-protection safeguards.

​

11. Payment information

​

Payments may be processed by independent payment providers.

​

Payment providers may collect:

​

• cardholder name;

• billing address;

• card details;

• bank information;

• device information;

• transaction information; and

• fraud-prevention information.

​

We generally receive confirmation of payment, transaction references and limited billing details rather than complete payment-card information.

​

Payment providers may act as independent controllers for some processing. Their privacy notices will apply to their use of personal information.

​

12. International transfers

​

Some service providers or their technical systems may be located outside the United Kingdom. This may result in personal information being transferred to or accessed from another country.

​

Where required, we will use an appropriate transfer safeguard, such as:

​

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved standard contractual clauses;

• another legally recognised transfer mechanism; or

• a permitted statutory exception.

​

Where required, we will also assess whether the destination and safeguards provide appropriate protection.

​

You may contact us for further information about the safeguards used for relevant international transfers.

​

13. Data retention

​

We retain personal information only for as long as reasonably necessary for the relevant purpose, including legal, regulatory, tax, accounting, fraud-prevention and dispute-resolution requirements.

Typical retention periods include:

​