Privacy and data protection

How we collect, process, and protect personal data when you use Disclosurely, in line with applicable data protection law.

Effective date: November 2025

Company: Disclosurely Limited

Website: disclosurely.com

Contact: privacy@disclosurely.com

Registered Office: London, EC1V 2NX, United Kingdom

1. Introduction and Scope

Disclosurely Limited ("Disclosurely", "we", "us" or "our"), a company registered in England and Wales with registered office at London, EC1V 2NX, United Kingdom, is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you use our whistleblowing and compliance platform at disclosurely.com (the "Service").

We process personal data in line with applicable requirements under the General Data Protection Regulation (EU 2016/679) ("GDPR"), the UK GDPR (as enacted in the Data Protection Act 2018), the EU Whistleblowing Directive (2019/1937), and other applicable data protection law.

This Privacy Policy applies to all users of the Service, including: (a) Customers (organisations subscribing to the Service); (b) Authorised Users (employees and agents of Customer organisations); (c) Whistleblowers (individuals submitting reports); and (d) website visitors. Different sections may apply to different user types as indicated.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you must not use the Service.

2. Data Controller and Data Processor Roles

The roles of Data Controller and Data Processor depend on the type of data and the context in which it is processed:

For Customer Account Data: When you register as a Customer, subscribe to the Service, or manage your account and billing, Disclosurely acts as the Data Controller for your personal data (name, email, company details, billing information, etc.).

For Whistleblower Reports and Customer Data: When Customers use the Service to receive and manage whistleblower reports, the Customer organisation acts as the Data Controller for all report content and personal data contained therein. Disclosurely acts as the Data Processor, processing this data strictly according to the Customer's documented instructions and our Data Processing Agreement (DPA).

For Website Analytics: Disclosurely acts as the Data Controller for anonymised website usage data collected through essential cookies.

Contact Information: For questions about how your personal data is processed, Customers should contact privacy@disclosurely.com. Whistleblowers should contact the organisation to which they submitted their report, as that organisation is the Data Controller for report content.

3. Personal Data We Collect

We may collect and process the following categories of personal data, depending on how you interact with the Service:

a) Customer Account Data (Disclosurely as Controller)

Identity and contact information: full name, job title, company name, business email address, business phone number
Account credentials: username, email address, password (encrypted and hashed), multi-factor authentication data
Billing and payment information: billing address, payment method details (processed by our payment processor Stripe - we do not store full card details), VAT/tax numbers, purchase history, invoices
Organisation information: company registration details, number of employees, industry sector, organisational structure
Communication data: correspondence with our support team, feedback, survey responses

b) Whistleblower and Report Data (Customer as Controller, Disclosurely as Processor)

Report content: any information voluntarily submitted in a report, which may include personal data about the whistleblower, accused persons, witnesses, or other individuals. This may include names, job titles, departments, dates, locations, descriptions of events, and other details
Special category data: reports may contain special categories of personal data (e.g., data revealing racial or ethnic origin, political opinions, religious beliefs, health data, sex life, sexual orientation, trade union membership, biometric data, genetic data) or data relating to criminal convictions and offences. Processing of such data is governed by GDPR Articles 9 and 10 and the EU Whistleblowing Directive
Contact information (optional): if provided, email address, phone number, or mailing address for follow-up communication
Technical and metadata: For non-anonymous reports, we may collect IP address, browser type and version, device type, operating system, time zone setting, browser plug-in types and versions, screen resolution, and timestamp. For anonymous reports, technical metadata collection is minimised or disabled as configured by the Customer
Communication data: messages exchanged between whistleblowers and Customer organisations through our secure messaging system
Uploaded files: documents, images, audio, video, or other files attached to reports

c) Technical and Usage Data

Log data: IP addresses, access times, pages viewed, browser type, referring/exit pages, operating system, click-stream data
Security data: login attempts, authentication events, security incidents, access control logs
Performance data: Service performance metrics, error logs, crash reports, load times
Cookie data: essential cookies for session management, authentication, and security (see Section 14)

d) Marketing and Communications Data (with consent)

Newsletter subscriptions: email address, communication preferences
Event registrations: name, email, company, job title for webinars or events
Website forms: information submitted through contact forms, demo requests, or quote requests

4. How We Use Personal Data

We use personal data for the following purposes, with the legal basis indicated in Section 5:

Service Provision: To provide, operate, and maintain the Service; authenticate users; process and facilitate whistleblower reports; enable secure messaging; deliver case management functionality; and perform our contractual obligations
Account Management: To create and manage Customer accounts; process registrations; verify identity; manage subscriptions and renewals; and communicate service-related information
Payment Processing: To process subscription payments; issue invoices; manage billing; prevent payment fraud; and maintain financial records
Customer Support: To respond to inquiries; provide technical support; troubleshoot issues; and improve customer service quality
Security and Fraud Prevention: To protect the Service and users from security threats; detect and prevent fraud, abuse, and unauthorised access; investigate security incidents; conduct security audits; and ensure Service integrity
Legal Compliance: To comply with legal obligations including data protection laws, the EU Whistleblowing Directive, financial regulations, court orders, and regulatory requests; maintain required records; and cooperate with law enforcement where legally required
Service Improvement: To analyse Service usage; identify trends and patterns; improve features and functionality; develop new services; conduct quality assurance; and optimise user experience (using anonymised and aggregated data only)
Communications: To send transactional emails (account confirmations, password resets, billing notices, security alerts); provide Service updates and announcements; and send marketing communications (with consent, which can be withdrawn at any time)
Research and Analytics: To conduct anonymised research; generate statistical reports; benchmark performance; and analyse compliance trends (personal data is always anonymised or aggregated for these purposes)
Business Operations: To manage internal operations; conduct audits; enforce our terms; protect our legal rights; and facilitate business transactions (mergers, acquisitions, asset sales)

5. Legal Bases for Processing

We process personal data only where we have a lawful basis under GDPR Article 6 (and Article 9 for special category data). Our legal bases are:

Contractual Necessity (Article 6(1)(b)) – Processing is necessary to perform our contract with you, including: providing the Service you subscribed to; managing your account; processing payments; and delivering customer support

Legitimate Interests (Article 6(1)(f)) – Processing is necessary for our legitimate interests or those of a third party, including: improving and optimising the Service; ensuring security and preventing fraud; conducting analytics (anonymised); direct marketing to existing customers (subject to opt-out); enforcing legal rights; and business administration. We always balance our legitimate interests against your rights and freedoms

Legal Obligations (Article 6(1)(c)) – Processing is necessary to comply with legal obligations, including: compliance with the EU Whistleblowing Directive; GDPR requirements; financial and tax regulations; court orders and legal process; regulatory investigations; and record-keeping requirements

Consent (Article 6(1)(a) and Article 9(2)(a)) – You have given explicit consent for processing, including: marketing communications; optional data collection; processing of special category data (where applicable); and cookies beyond essential cookies. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal

Vital Interests (Article 6(1)(d)) – Processing is necessary to protect vital interests, such as when a report involves imminent serious harm or threats to life

Public Interest and Legal Claims (Article 9(2)(f) and (g)) – For special category data in whistleblower reports, processing may be necessary for the establishment, exercise, or defence of legal claims, or when processing is necessary for reasons of substantial public interest (prevention of unlawful acts, protection of public interest in the area of employment law and social security)

Whistleblowing Legal Framework (Article 9(2)(g) and Directive 2019/1937) – Processing of personal data in whistleblower reports is explicitly permitted under the EU Whistleblowing Directive for the purposes of receiving, investigating, and following up on reports concerning breaches of EU law and serious misconduct

6. Data Hosting, Storage, and International Transfers

Data hosting: Customer Data is processed using infrastructure we configure with Supabase in the EEA (Ireland and, where used, Frankfurt). Data in transit is protected using TLS 1.3 (or equivalent). Stored content at rest is protected using AES-256-GCM (or an equivalent industry-standard algorithm).

Data residency: we configure primary storage and backups to remain within the EEA/UK unless we engage a subprocessor outside those regions with appropriate safeguards (see International transfers).

International transfers: we do not routinely transfer personal data outside the EEA/UK. If a transfer becomes necessary (for example to a subprocessor), we use mechanisms required by GDPR Chapter V where applicable, such as Standard Contractual Clauses or adequacy decisions, and we notify Customers where we are required to do so.

Subprocessors: we engage carefully selected subprocessors under written agreements. A current list of material subprocessors is available on request. We conduct proportionate due diligence and require appropriate confidentiality and security commitments.

7. Data Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are:

Customer Account Data: Retained for the duration of your active subscription plus six (6) years after account closure for accounting, tax, and legal purposes. Financial records are retained for seven (7) years to comply with UK tax law.
Whistleblower Reports and Customer Data: As Data Processor, we retain this data according to the Customer's instructions (the Customer, as Data Controller, determines retention periods). Upon account termination or Customer request, we will delete or return all Customer Data within thirty (30) days, unless longer retention is required by law. Customers must ensure their retention periods comply with the EU Whistleblowing Directive (which generally requires retention for the duration of investigations and legal proceedings, with a maximum recommended period of five years after case closure).
Technical Logs and Security Data: Retained for up to twelve (12) months for security monitoring, fraud prevention, and incident investigation purposes, then automatically deleted.
Marketing Data: Retained until you unsubscribe or withdraw consent, then deleted within thirty (30) days. We may retain a suppression list of unsubscribed email addresses to ensure we do not contact you again.
Anonymised Data: We may retain anonymised and aggregated data indefinitely for statistical analysis, research, and service improvement. This data cannot be used to identify individuals.
Legal Holds: In the event of litigation, investigation, or regulatory inquiry, we may suspend deletion of relevant data until the matter is resolved, as required by law.

8. Disclosure and Sharing of Personal Data

We do not sell, rent, or trade personal data. We may disclose personal data only in the following limited circumstances:

To Customer Organisations: Whistleblower reports and related data are disclosed to the Customer organisation that operates the reporting portal. The Customer is the Data Controller and is responsible for handling reports in accordance with applicable laws.
Service Providers and Subprocessors: We engage trusted third-party service providers who process personal data on our behalf under strict contractual obligations, including: (a) Supabase (data hosting and infrastructure); (b) Stripe (payment processing); (c) SendGrid or similar (transactional email delivery); (d) Cloud storage providers (for file attachments); and (e) Customer support platforms. All service providers are required to implement appropriate security measures and process data only as instructed.
Legal and Regulatory Obligations: We may disclose personal data where required by law, including: (a) in response to court orders, subpoenas, or legal process; (b) to comply with regulatory investigations or requests from data protection authorities; (c) to comply with the EU Whistleblowing Directive or national implementing legislation; (d) to enforce our Terms of Service or protect our legal rights; and (e) to investigate fraud, security incidents, or violations of our policies.
Protection of Rights and Safety: We may disclose personal data where necessary to: (a) protect the rights, property, or safety of Disclosurely, our users, or the public; (b) detect, prevent, or address fraud, security, or technical issues; or (c) respond to emergencies involving danger of death or serious physical injury.
Business Transfers: In the event of a merger, acquisition, reorganisation, sale of assets, or bankruptcy, personal data may be transferred to the successor entity. We will notify you via email and/or prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.
Professional Advisors: We may share personal data with lawyers, accountants, auditors, and other professional advisors under obligations of confidentiality when necessary for business operations or legal compliance.
With Your Consent: We may disclose personal data for purposes not described in this Privacy Policy with your explicit consent.

9. Security Measures

We implement comprehensive technical and organisational measures to protect personal data from unauthorised access, disclosure, alteration, destruction, loss, or misuse. Our security measures include, but are not limited to:

Encryption: All data is encrypted in transit using TLS 1.3 or higher. Data at rest is encrypted using AES-256-GCM (or an equivalent industry-standard algorithm). Passwords are hashed using bcrypt with salt.
Access Controls: Role-based access control (RBAC) ensures users can only access data necessary for their role. Multi-factor authentication (MFA) is available and recommended for all accounts. Authorised Users are assigned unique credentials with audit logging.
Network Security: Firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) protect our infrastructure. Regular penetration testing and vulnerability assessments are conducted. DDoS protection is implemented.
Data Segregation: Customer Data is logically segregated to prevent cross-customer data access. Anonymised and identified reports are stored with appropriate access controls.
Security Monitoring: 24/7 automated monitoring for security incidents and anomalous behaviour. Security logs are retained and regularly reviewed. Incident response procedures are in place and regularly tested.
Employee Training and Vetting: All employees with access to personal data undergo background checks and sign confidentiality agreements. Regular security awareness and data protection training is mandatory. Access is granted on a need-to-know basis and reviewed quarterly.
Physical security: our hosting providers operate facilities with controlled physical access, environmental safeguards, and monitoring appropriate to cloud SaaS workloads.
Backup and Recovery: Automated encrypted backups are performed daily and stored in geographically redundant locations. Disaster recovery and business continuity plans are tested regularly.
Secure Development: We follow secure coding practices and conduct code reviews. Security testing is integrated into our development lifecycle. Third-party dependencies are regularly updated and scanned for vulnerabilities.
Data Breach Response: We have documented procedures for detecting, investigating, and responding to personal data breaches. In the event of a breach affecting personal data, we will notify affected individuals and relevant supervisory authorities within 72 hours as required by GDPR.

While we apply appropriate technical and organisational measures, no online service can be guaranteed completely secure. Please use strong passwords, enable multi-factor authentication where offered, and follow your organisation’s security guidance.

10. Your Rights Under Data Protection Law

Under GDPR, UK GDPR, and other data protection laws, you have the following rights regarding your personal data. The specific rights available to you depend on your role (Customer, Authorised User, or Whistleblower) and the legal basis for processing:

Right of Access (Article 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to access that data along with information about how it is processed. You may request a copy of your personal data free of charge (additional copies may incur a reasonable administrative fee).
Right to Rectification (Article 16): You have the right to have inaccurate personal data corrected and incomplete personal data completed without undue delay.
Right to Erasure / 'Right to be Forgotten' (Article 17): You have the right to request deletion of your personal data in certain circumstances, including: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw consent (where processing is based on consent) and there is no other legal basis; (c) you object to processing based on legitimate interests and there are no overriding legitimate grounds; (d) the data has been unlawfully processed; or (e) erasure is required to comply with a legal obligation. Note: This right is not absolute. We may retain data where necessary to comply with legal obligations, establish or defend legal claims, or for other legitimate reasons.
Right to Restriction of Processing (Article 18): You have the right to request that we restrict processing of your personal data in certain circumstances, including when: (a) you contest the accuracy of the data (restriction applies during verification); (b) processing is unlawful but you prefer restriction over erasure; (c) we no longer need the data but you need it for legal claims; or (d) you have objected to processing pending verification of our legitimate grounds.
Right to Data Portability (Article 20): Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance. Where technically feasible, you may request that we transmit the data directly to another controller.
Right to Object (Article 21): You have the right to object at any time to processing of your personal data based on legitimate interests or for direct marketing purposes. For direct marketing, we will cease processing upon your objection. For other objections, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.
Right Not to Be Subject to Automated Decision-Making (Article 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. We do not currently engage in automated decision-making of this nature.
Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. You can withdraw consent by contacting privacy@disclosurely.com or using unsubscribe links in marketing emails.
Right to Lodge a Complaint (Article 77): You have the right to lodge a complaint with a supervisory authority, particularly in the EU Member State or UK country of your habitual residence, place of work, or place of the alleged infringement. In the UK, the supervisory authority is the Information Commissioner's Office (ICO): ico.org.uk, telephone: 0303 123 1113.

How to Exercise Your Rights: To exercise any of these rights, please contact us at privacy@disclosurely.com with sufficient detail to identify you and the data concerned. We will respond within one (1) month of receipt (this may be extended by two months for complex or numerous requests, in which case we will inform you).

Important Note for Whistleblowers: If you submitted a report to an organisation using our Service, that organisation is the Data Controller for the report content and your personal data contained therein. To exercise your rights regarding report data, you must contact the organisation directly. Disclosurely, as Data Processor, can only act on instructions from the Data Controller. However, we will assist the organisation in responding to your request where appropriate.

Verification: To protect your personal data, we may need to verify your identity before responding to requests. We may request additional information to confirm your identity.

11. Third-Party Services and Links

The Service may integrate with or contain links to third-party websites, applications, or services ("Third-Party Services") that are not operated by Disclosurely. This Privacy Policy does not apply to Third-Party Services.

We are not responsible for the privacy practices, content, or security of Third-Party Services. We encourage you to review the privacy policies of any Third-Party Services you access.

Third-Party Services we may use include: (a) Stripe for payment processing (Stripe Privacy Policy: stripe.com/privacy); (b) Google OAuth for authentication (Google Privacy Policy: policies.google.com/privacy); and (c) email service providers for transactional emails.

12. Children's Privacy

The Service is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If you are under 16, you must not use the Service or provide any personal data to us.

If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information as soon as possible.

If you believe we have collected personal data from a child under 16, please contact us immediately at privacy@disclosurely.com.

13. Anonymous Whistleblower Reporting

The Service offers anonymous reporting functionality to protect whistleblower confidentiality in accordance with the EU Whistleblowing Directive. When anonymous reporting is enabled by a Customer:

We minimise data collection: IP addresses, device identifiers, and other metadata that could identify the whistleblower are not collected or are anonymised. Whistleblowers access their reports using a unique access code that does not require registration or authentication with personal information.

Anonymous messaging: where enabled, whistleblowers can communicate with the Customer through messaging protected in transit and subject to access controls configured for the Service. The precise technical model depends on your organisation’s configuration; it should not be assumed to provide end-to-end encryption in every deployment.

Customer Obligations: Customers are responsible for ensuring they do not attempt to identify anonymous whistleblowers. Customers must configure the Service in accordance with applicable law and their whistleblowing procedures.

Limitations: Complete anonymity cannot be guaranteed in all circumstances. For example, if a whistleblower includes identifying information in their report, or if disclosure is required by law, anonymity may be compromised. Whistleblowers are advised not to include personal information in reports if they wish to remain anonymous.

14. Cookies and Tracking Technologies

The Service uses cookies and similar tracking technologies. A cookie is a small text file stored on your device that allows us to recognise your browser and capture certain information.

Types of Cookies We Use: We use only essential cookies that are strictly necessary for the Service to function. These include: (a) Session cookies: to authenticate users and maintain your logged-in state; (b) Security cookies: to detect authentication abuse and protect user accounts; (c) Functionality cookies: to remember your preferences (e.g., language settings).

We do not use: Advertising cookies, tracking cookies, analytics cookies (other than anonymised internal analytics), or third-party marketing cookies.

Cookie Duration: Most cookies are session cookies that expire when you close your browser. Some cookies persist for up to 30 days to maintain your login state.

Managing Cookies: You can control cookies through your browser settings. Most browsers allow you to refuse cookies or delete cookies. However, if you disable essential cookies, you may not be able to use certain features of the Service. For browser-specific instructions, see: Chrome: support.google.com/chrome/answer/95647; Firefox: support.mozilla.org/kb/enable-and-disable-cookies-website-preferences; Safari: support.apple.com/guide/safari/manage-cookies-and-website-data-sfri11471/mac; Edge: support.microsoft.com/help/4027947/microsoft-edge-delete-cookies.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes as follows:

For Customers: We will send email notification to the email address associated with your account at least thirty (30) days before material changes take effect. We will also post a notice on the Service dashboard.

For Whistleblowers: Material changes will be posted on the reporting portal, and the effective date at the top of this Privacy Policy will be updated.

For Website Visitors: We will post a notice on our website homepage for thirty (30) days.

Non-Material Changes: Minor changes, clarifications, or corrections may be made without advance notice. We encourage you to review this Privacy Policy periodically.

Continued Use: Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy. If you do not agree to changes, you must stop using the Service and may request deletion of your data.

16. Contact Us and Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Disclosurely Limited

London, EC1V 2NX, United Kingdom

Email: privacy@disclosurely.com (for privacy and data protection inquiries) or support@disclosurely.com (for general support)

Data Protection Officer: We have appointed a Data Protection Officer (DPO) who can be contacted at: dpo@disclosurely.com

Response times: we aim to acknowledge privacy inquiries promptly. Where GDPR applies to a request, we will generally respond within one month (which may be extended in complex cases, when we will notify you).

17. EU Whistleblowing Directive Compliance

The Service is designed to support common requirements under the EU Whistleblowing Directive (Directive 2019/1937) and national implementing legislation. Key measures include:

Confidentiality and Anonymity: The Service provides secure channels that protect the confidentiality of whistleblowers, including anonymous reporting options. We implement technical and organisational measures to prevent unauthorised access to whistleblower identities.

Data Minimisation: Personal data in reports is processed only to the extent necessary for the purposes of receiving, investigating, and following up on reports. Customers are advised to limit data collection to what is necessary.

Security: we apply encryption and access controls intended to protect the integrity and confidentiality of reports and communications, consistent with our Security page and DPA.

Retention Limits: Customers are responsible for establishing retention periods for reports in accordance with the Directive and national law. The Directive generally requires deletion of data that is not necessary for follow-up actions.

Access Rights: Access to whistleblower identity and report content is restricted to authorised personnel designated by the Customer. We provide audit logs to track access.

Data Subject Rights: While the Directive requires protection of whistleblower confidentiality, data subjects (including persons mentioned in reports) retain their GDPR rights, which must be balanced against the need to protect whistleblowers. Customers are responsible for managing this balance.

Disclaimer: Customers are solely responsible for ensuring their use of the Service and their internal whistleblowing procedures comply with the EU Whistleblowing Directive and all applicable national laws. Disclosurely provides the technical platform but does not provide legal advice on compliance.

Last updated: November 2025