1. Data Controller

Noctula Risk Intelligence Limited, a company registered in England and Wales (company number 17550647), registered office: 128, City Road, London, EC1V 2NX, UNITED KINGDOM. Contact: support@noctula.org

2. Data We Collect

Account data: Name, email, company, role, contact details
Usage data: IP address, browser type, device fingerprint, session duration, page views
Transaction data (for platform customers): Transaction records, customer PII (encrypted), risk scores, alerts
Communication data: Demo requests, support tickets, newsletter subscriptions

3. Legal Bases for Processing (GDPR Art. 6)

Contract performance: To provide platform services
Legal obligation: AML/KYC record keeping, tax, accounting
Legitimate interest: Security analytics, fraud prevention, platform improvement
Consent: Marketing emails, analytics cookies (optional)

4. Data Sharing

Customer transaction data (including PII) is never shared with any third party. Sharing only occurs:

Sub-processors: AWS (hosting), Vercel (website), Resend (email delivery for website forms), Stripe (payments), with signed DPAs
Legal obligation: Court order, regulatory request (MASAK, FCA, BaFin, etc.)
Corporate transaction: Merger, acquisition, asset sale (with prior notice)

5. International Data Transfers

Data is primarily processed in EU (Frankfurt) and UK (London) data centers. For US sub-processors: Standard Contractual Clauses (SCC) and UK International Data Transfer Agreement (IDTA) are in place.

6. Retention Periods

Account data: While account active + 1 year after termination
Transaction/record data: Minimum 5 years per AML regulation (AMLD6), maximum 10 years
Usage/analytics data: 13 months (after anonymization)
Demo/contact data: 2 years (deleted immediately upon consent withdrawal)

7. Your Rights (GDPR Art. 15-22)

Right of access: Learn what data is processed
Right to rectification: Correct incomplete/incorrect data
Right to erasure ('Right to be forgotten'): Deletion under certain conditions
Right to restriction: Stop processing under certain conditions
Right to portability: Receive data in machine-readable format
Right to object: Object to processing based on legitimate interest
Automated decision-making: Object to automated decisions including profiling

To exercise your rights: support@noctula.org

8. Security Measures

AES-256 (at rest) + TLS 1.3 (in transit)
Hardware-bound FIDO2 MFA (all personnel and customer admins)
JIT access and cryptographic masking
Immutable audit trails (hash-chained)
SOC 2 Type II, ISO 27001 certified infrastructure (AWS)
Annual penetration testing and continuous security monitoring

9. Cookies and Similar Technologies

Essential storage (your cookie choice) does not require consent. Analytics and marketing cookies require opt-in. See the Cookie Policy for details.

10. Children's Privacy

Platform is not directed to individuals under 18. If you believe we have collected data from a child under 18, contact support@noctula.org.

11. Changes to This Policy

Material changes announced at least 30 days in advance via email and/or in-platform notification. Last updated date shown at top of this page.

12. Contact

Data protection and privacy questions: support@noctula.org
Post: Noctula Risk Intelligence Limited, 128, City Road, London, EC1V 2NX, UNITED KINGDOM

Privacy Policy