Privacy Policy

Data Controller: Greyline Investigations Limited · Company Number: 17121990 · Contact: cases@greylineinvestigations.co.uk

This Privacy Policy explains how Greyline Investigations Limited collects, uses, stores, and protects your personal data, in strict compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Greyline Investigations Limited is a professional private intelligence and cybersecurity firm providing investigation services to clients across the UK, Nigeria, and internationally. We are incorporated in England and Wales (Company Number 17121990) and operate as the data controller in respect of personal data processed through our website and client engagements.

Where we process personal data relating to the subject of an investigation on behalf of a client, we act as a data processor on that client's instructions. In all other respects we are the data controller.

2. What Personal Data We Collect

2.1 Data you provide directly

Identity data: name or alias, contact email address, phone number
Case data: details of the matter enquired about, including information about the subject of investigation
Communication data: emails, messages, and correspondence sent to us
Contractual data: signed confidentiality agreements and engagement letters

2.2 Data we collect automatically

Technical data: IP address, browser type, and pages visited, collected via standard web server logs
Usage data: how you interact with our website (page visits, time spent, referral source)

2.3 Data about third parties (investigation subjects)

When conducting investigations, we process personal data about the subject of the investigation. This data is collected from publicly available open sources only (OSINT), or from material lawfully disclosed with informed consent. We do not access private accounts, intercept communications, or obtain data through unlawful means. The legal basis for processing this data is our legitimate interests in providing the contracted service and, where relevant, the legal claims of the commissioning client.

3. Legal Basis for Processing

Contract performance: processing necessary to deliver investigation services to clients who have engaged us.
Legitimate interests: processing for fraud prevention, security, improving our services, and conducting intelligence work on behalf of clients, balanced against individuals' rights and freedoms.
Legal obligation: where we are required to process data to comply with applicable law, including any law enforcement disclosure requirement.
Consent: where you have given specific, informed consent. Consent may be withdrawn at any time.

4. How We Use Your Personal Data

To respond to inquiries and assess feasibility of requested services
To prepare, execute, and deliver investigation services under a written engagement letter
To send confidentiality agreements and contractual correspondence
To process fees for agreed engagements and maintain financial records
To communicate case updates, findings, and reports
To comply with legal and regulatory obligations
To protect our legitimate business interests and defend against legal claims
To improve our website and services using aggregated, anonymised analytics

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

5. Who We Share Your Data With

We do not sell, rent, or share your personal data with third parties for marketing purposes. We may share data in limited circumstances:

Service providers: trusted third-party suppliers who process data on our behalf under strict data processing agreements. These parties may only process data on our instructions.
Legal and regulatory authorities: where required by law, court order, or regulatory requirement.
Law enforcement: where we have a legal obligation or reasonable belief that disclosure is necessary to prevent crime or protect a person's safety.
Professional advisers: solicitors, accountants, and insurers, where necessary and subject to professional confidentiality obligations.

We will never disclose your identity or case details to the subject of an investigation without your express prior written consent.

6. International Data Transfers

Greyline serves clients globally, including in Nigeria, the USA, Canada, and Australia. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V, including transfer to countries with an adequacy decision, International Data Transfer Agreements or Standard Contractual Clauses, and Binding Corporate Rules where applicable. For Nigerian client engagements, we additionally adhere to the Nigeria Data Protection Act 2023 (NDPA) where applicable.

7. How Long We Keep Your Data

Inquiry data (no engagement): 90 days from submission, then permanently deleted
Client data and case files: 12 months from case closure, then permanently deleted unless the client requests extended retention in writing
Signed contracts and financial records: 7 years, per UK company law and HMRC requirements
Website analytics data: aggregated and anonymised; individual session data retained for no more than 13 months

On expiry of the retention period, data is securely and permanently deleted from all systems and backups.

8. Your Rights Under UK GDPR

Right of access, to obtain a copy of the personal data we hold about you.
Right to rectification, to have inaccurate data corrected.
Right to erasure, to request deletion where there is no legitimate reason for continued processing.
Right to restriction, to request that we limit how we use your data in certain circumstances.
Right to data portability, to receive your data in a structured, commonly used format.
Right to object, to processing based on legitimate interests or for direct marketing.
Right to withdraw consent, where processing is based on consent, at any time.

To exercise any of these rights, contact us at cases@greylineinvestigations.co.uk. We will respond within one calendar month and may need to verify your identity first. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9. How We Protect Your Data

We implement appropriate technical and organisational measures, including end-to-end encrypted communications for case correspondence, access controls limiting data access to authorised personnel, encrypted storage, regular review of security practices, and immediate breach-notification procedures. In the event of a personal data breach likely to result in a risk to your rights, we will notify you and the ICO without undue delay and within 72 hours of becoming aware, as required by UK GDPR Article 33.

10. Cookies and Website Tracking

Our website uses standard web server logging to ensure the site functions correctly, and Google Analytics to understand how visitors use the site. Analytics only runs where you have accepted it through the cookie banner; you can withdraw consent at any time using the "Cookie Preferences" link in the footer. We do not use advertising, remarketing, or third-party tracking cookies. Our website also loads its typefaces directly from Google Fonts on every page, which may expose your IP address to Google as a normal function of that request; this does not set a cookie. See our Cookie Policy for full details.

11. Children's Data

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, contact us immediately at cases@greylineinvestigations.co.uk and we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The current version is always available on this page, and we will notify active clients of any material changes by email.

13. Contact Us

For questions about this Privacy Policy or to exercise your data rights, email cases@greylineinvestigations.co.uk with the subject line "Data Protection Enquiry". We aim to respond to all privacy enquiries within five working days.