Privacy Notice

This notice explains how Shenberg Data Ltd ("Shenberg", "we", "us" or "our") handles personal information in connection with its website, business administration and its role as a commercial, contractual and financial intermediary for data-related services.

1. Our role and the scope of this notice

Shenberg arranges services, coordinates specialist suppliers, manages commercial relationships, administers contractual documentation, supports invoicing and reconciliation and coordinates payment flows. This notice concerns the personal information Shenberg processes for those activities.

Underlying consumer, lead, campaign or other individual records used in a client service are referred to here as client data. Client data is separate from the limited business-administration information that Shenberg processes for its own corporate purposes. The relevant client or other controller determines the authorised purposes and essential means of processing client data unless a separate written arrangement expressly gives Shenberg a different legal role.

2. Client data: no independent ownership or exploitation

Commercial involvement does not give Shenberg ownership of client data or an independent right to exploit it. We do not use client data to build our own reusable marketing lists, contact individuals for Shenberg's own campaigns, create independent profiles, or sell, rent, license or otherwise commercialise client data for our own purposes.

We do not routinely request, inspect or retain client datasets. If limited access or temporary handling is technically necessary, it must be specifically authorised, proportionate to the contracted task and subject to applicable confidentiality, security and retention controls. Unrequested datasets should not be sent to Shenberg.

3. Information we process directly

For our own administration, Shenberg may process names, job titles, employer or business affiliation, business email addresses and telephone numbers, signatures, contracting information, invoice and payment records, supplier information, correspondence, compliance records and records needed to establish or defend legal claims.

We generally obtain this information from the individual, their organisation, a commercial counterparty, an authorised representative, or records generated through our own business relationship.

4. Why we use business information

We use business information to assess and establish commercial relationships, arrange and administer services, communicate with clients and suppliers, manage contractual documentation, reconcile invoices and payments, maintain business records, comply with legal and regulatory requirements, prevent misuse, secure our systems and handle complaints or legal claims.

Depending on the purpose, our lawful basis may be performance of or steps connected with a contract, compliance with a legal obligation, legitimate interests in operating and protecting our business and relationships, or consent where the law requires it. Where we rely on legitimate interests, we consider necessity, reasonable expectations and the effect on the individual.

5. Website and technical information

When this website is accessed, hosting, security and infrastructure providers may process limited technical information such as IP address, browser and device information, timestamps, requested resources, diagnostic information and security logs. This is used to deliver, protect and maintain the website and investigate misuse or technical faults.

If Shenberg introduces non-essential analytics, advertising technologies or marketing cookies, the appropriate notice and consent controls will be implemented before use where required.

6. Suppliers, service providers and counterparties

Shenberg may engage technology, hosting, accounting, banking, payment, professional-advisory and administration providers. Where a supplier processes personal information on our behalf, it must act for the authorised purpose and under appropriate confidentiality, security and contractual controls.

Where we coordinate a specialist provider for client data, the applicable client, provider and service documents determine the processing roles. A provider is not given an independent right to market, profile, pool, resell or reuse client data merely because it supports a Shenberg-coordinated service.

7. Disclosures

We may disclose limited business information to authorised staff, service providers, banks and payment providers, accountants, auditors, lawyers, insurers, business counterparties and public authorities where necessary for the relevant purpose or required by law. We limit disclosures to information reasonably required for that purpose.

In a genuine corporate transaction, relevant information may be provided to prospective buyers, investors, lenders or advisers under appropriate confidentiality and due-diligence controls.

8. International transfers

Because clients, suppliers and service providers may operate internationally, personal information may be accessed or processed outside the United Kingdom. Where Shenberg initiates a restricted transfer under the UK GDPR, we use a permitted transfer mechanism, such as UK adequacy regulations or appropriate safeguards including the UK International Data Transfer Agreement or UK Addendum where suitable, together with supplementary measures where required.

Where Shenberg acts only on documented instructions for a client, transfer responsibilities are allocated in the applicable contract and service arrangement.

9. Retention

We retain personal information only for as long as needed for the purpose for which it was collected and for applicable accounting, tax, contractual, compliance, complaint, security and legal-claim periods. Retention depends on the type of record, statutory requirements, contractual obligations and whether a dispute, investigation or legal hold is active.

When information is no longer required, it is deleted, anonymised or securely isolated. Backup copies awaiting normal expiry remain protected and are not used for unrelated purposes.

10. Security and incidents

Shenberg applies proportionate technical and organisational measures appropriate to the information and risk, including access restrictions, confidentiality requirements, secure authentication, protected systems, supplier due diligence and incident-management procedures.

Suspected loss, unauthorised access or disclosure is investigated and contained. Clients, authorities and affected individuals are notified where required by applicable law or contract. No method of storage or transmission can be guaranteed completely secure.

11. Your rights

Depending on the circumstances and applicable law, you may have rights to request access, correction, erasure, restriction or portability of your personal information, object to certain processing, and withdraw consent where processing is based on consent. You may also complain to the Information Commissioner's Office (ICO).

Requests concerning Shenberg's own processing can be sent in writing to the registered office stated above. For underlying client data, the relevant client or controller will usually be the appropriate first contact; Shenberg will assist where required by its role and applicable law.

12. Data Protection Officer

Shenberg has not appointed a Data Protection Officer. Based on its current assessment of the nature, scope, context and purposes of its processing, Shenberg does not consider that the mandatory designation criteria under Article 37 of the UK GDPR presently apply. This assessment will be reviewed if our activities materially change.

13. Children

Our website and intermediary services are directed to businesses and professional users. We do not knowingly seek personal information from children through this website.

14. Changes to this notice

We may update this notice to reflect changes in our activities, legal requirements, service providers or security practices. Material changes do not retrospectively authorise incompatible uses of personal information. The date shown above identifies the current version.