Privacy policy in London

Company information COLIBRIX LIMITED, registration number: 12578874, legal address: Warnford Court, 29 Throgmorton Street, London, England, EC2N 2AT. You can contact us at: info@colibrix.uk

Contact information for personal data protection issues: If you have questions regarding this notice or the processing of your personal data, contact us using the channels above or: data@colibrix.uk

General characteristics of our personal data processing: This statement describes how we process the personal data of customers, customer representatives/contact persons, cooperation partners, website visitors and other persons whose data may be at our disposal as part of our commercial activities. We assume that before using our website or becoming our customer, you have read this statement and accepted its terms. We reserve the right to amend and update this notice as necessary.

The purpose of this statement is to give a general insight into our personal data processing activities and purposes; other documents (e.g., service contracts, cooperation agreements, website or portal use rules) may contain additional information. The personal data processing rules contained in this notice apply only to the processing of personal data of natural persons. In addition to these regulations, you can familiarize yourself with the following notices. We are aware that personal data is valuable and we will process it in compliance with confidentiality requirements and take care of the security of your personal data in our possession.

For what purposes do we process your personal data and what is the legal basis for processing? We will process your personal data only for clearly defined legitimate purposes, including:

• Processing of services and for the fulfilment and provision of obligations under the contract (including cooperation agreements). We may identify you, provide payment calculations, ensure the payment process, contact you regarding the provision of the service and/or execution of the contract (including sending invoices), and in some cases collect unpaid payments. We may process the following personal data: name, surname, personal identification number, address(es), bank account number, contact person, telephone number, email address.
• The main legal bases are: conclusion and execution of the contract with the data subject (Article 6(1)(b) of GDPR); fulfilment of legal obligations (Article 6(1)(c)); the controller's legitimate interests (Article 6(1)(f)) include identifying you as a customer, client and/or contact person and ensuring communication.
• Fulfilment of regulatory requirements: We may need to comply with financial, accounting and archiving requirements and other regulatory acts. We may process: name, surname, personal identification number, address. The main legal bases: fulfilment of legal obligations (Article 6(1)(c)).
• We may also identify, examine, prosecute and prevent crime and fraud, verify eligibility for services, manage risks, and provide information to authorities. We may process: name, surname, personal identification number, date of birth, nationality, address, financial information, risk assessment data. The main legal bases: fulfilment of legal obligations (Article 6(1)(c)); conclusion and execution of the contract (Article 6(1)(b)); the controller's legitimate interests (Article 6(1)(f)); the public interest (Article 6(1)(e)).
• Provision of marketing activities: We may send commercial communications, publish materials from events organized by us. We may process: name, surname, telephone number, email address of the customer or partner. Legal bases: consent (Article 6(1)(a)); conclusion and execution of the contract (Article 6(1)(b)); the controller's legitimate interests (Article 6(1)(f)).
• Prevention of threats to security and other interests: We may conduct video surveillance, record telephone conversations, use data processors, disclose information to authorities, exchange information within the group, and exercise rights under regulatory acts to protect legitimate interests. We may process: contact name, surname, personal identification number, address, residents at the address, appearance (picture), location and time, and other data as needed. Main legal bases: the controller's legitimate interests (Article 6(1)(f)).
• To ensure proper provision of services: Legal bases: the controller's legitimate interests (Article 6(1)(f)).

Who could access your personal data? We take measures to ensure processing in accordance with law and prevent access by parties without a legal basis. If necessary, your personal data could be accessed by: our employees or authorized persons; personal data processors (auditors, financial management, legal consultants, IT personnel, etc.); authorities such as law enforcement, tax authorities; third parties with a legitimate basis for transfer (e.g., debt collectors, courts, registers).

Which cooperation partners or processors do we use? We carefully select data processors and transfer data in compliance with confidentiality and secure processing requirements. Current categories include outsourcing accountants, auditors, IT infrastructure, and other service providers. Data processors may change over time; we update this document accordingly.

Are data transferred outside the EU/EEA? We may process data globally and transfer it to countries where we or our partners operate as permitted by law.

How long will we store your personal data? Data is stored as long as necessary for processing purposes and in accordance with legal requirements. Retention periods depend on contractual obligations, regulatory acts, and specific legal acts. Common retention periods include:

• Data needed to fulfil contractual obligations stored until contract is fulfilled and any applicable storage terms;
• Data required by law stored per regulatory acts; for example, documents may need to be kept for 6 years from the end of the financial year;
• For proving obligations, retention according to general claim limitation periods under applicable laws (e.g., Six years for simple contracts, Three years for tort, Twelve years for specialty contracts);
• Consumer Rights Act 2015 periods (e.g., six years for breach of contract, five years for faulty goods).

Your rights as a data subject: Renewal of personal data: If your data changes, contact us to update.

Your right to access and correct: You have rights to access, rectify, delete, restrict processing, object to processing, and data portability under GDPR/UK GDPR. We will respond within regulatory time limits (usually within one month). You can exercise rights by: mail to Warnford Court, 29 Throgmorton Street, London, EC2N 2AT; email data@colibrix.uk (secure electronic signature recommended). On submission, we may request additional identification to protect your data.

Withdrawal of consent: You may withdraw consent at any time; however, processing based on consent may already have occurred or be necessary for regulatory or contractual purposes. You may also object to data processing based on legitimate interests or marketing.

Where to submit a complaint: If questions or objections remain unresolved, you may file a complaint with the Information Commissioner's Office. See ico.org.uk/make-a-complaint/ for guidance.

Why we need your personal data: We collect data to fulfil contractual and legal obligations and to pursue legitimate interests. Some data collection is voluntary; however, non-provision may affect business relations or contract performance. Regulatory references include the Data Protection Act 2018, UK GDPR, and ICO guidance.

How do we obtain your personal data? Data may be obtained via mutual agreements, third-party contracts naming you as contact, direct submissions, online sign-ups, third-party databases (e.g., credit assessment), or video surveillance where relevant.

Are personal data used in automated decision-making? We do not use data for automated decision-making.