Privacy Policy

1. Data Controller Identification

Under the UK GDPR and the Data Protection Act 2018, the registered Data Controller responsible for your personal data is:

2. Regulatory Compliance Framework

Neptune Formation processes personal data in strict compliance with:

• The UK General Data Protection Regulation (UK GDPR);
• The Data Protection Act 2018 (DPA 2018);
• The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 (MLR 2017);
• The Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR);
• The Companies Act 2006 and Companies House registrar filing directives.

3. Core Principles of Data Protection

Whenever we handle personal information, we adhere to the foundational principles set out in Article 5 of the UK GDPR:

1. Lawfulness, fairness, and transparency: Data is processed with legitimate legal bases and clear notices;
2. Purpose limitation: Information is collected only for specified, explicit, and legitimate corporate formation purposes;
3. Data minimisation: We restrict our collection strictly to what is necessary for our legal and service duties;
4. Accuracy: Reasonable steps are taken to keep personal data accurate, verified, and current;
5. Storage limitation: Records are retained only for as long as required by corporate and anti-money laundering law;
6. Integrity and confidentiality: Data is secured using modern cryptographic safeguards and access controls.

4. Categories of Data Collected

In order to provide our company formation, nominee, address, and compliance services, we collect and process:

• Client Identity Records (KYC): Full legal name, date of birth, nationality, country of residence, passport numbers, national identity cards, residential addresses, proof of address utility bills, and photograph/biometric likeness;
• Corporate & Shareholder Data: Proposed company name, corporate structure, share capital allocation, director appointments, shareholder registers, and ultimate beneficial ownership (UBO / PSC) structures;
• Contact Information: Business email, personal email, telephone numbers, postal address, and WhatsApp contact handles;
• Financial & Billing Data: Payment transaction identifiers, billing addresses, invoice records, and cardholder tokens. (Note: Neptune Formation does not store full credit card numbers; card transactions are processed via secure PCI-DSS level 1 gateways);
• Technical & Usage Telemetry: IP address, browser type and version, timezone settings, operating system, and interaction analytics collected via cookies.

5. Sensitive Data & Sanctions Screening

In accordance with UK AML regulations and sanctions compliance directives issued by HM Treasury (OFSI) and international watchlists, we may process data relating to:

• Politically Exposed Persons (PEP) status;
• International economic sanctions screening and enforcement database checks;
• Adverse media records concerning financial crimes, fraud, or corporate disqualifications.

We do not collect or process sensitive special-category data such as racial origin, religious beliefs, sexual orientation, or trade union membership.

6. Collection Methodology

We collect data through multiple channels:

• Direct Submissions: Information you enter into our online incorporation forms, onboarding questionnaires, contact forms, or send via secure email;
• Identity Verification Portals: Automated cryptographic identity verification software used to authenticate biometric chip data and validate photo documents;
• Official Databases: Electoral rolls, Companies House public records, credit reference agencies, and international compliance databases;
• Automated Technologies: Server logs and functional cookies operating during your visit to our website.

7. Lawful Bases for Processing

Under Article 6 of the UK GDPR, Neptune Formation relies on the following lawful grounds to process your personal data:

• Performance of a Contract: Processing is strictly necessary to perform our obligations under our Service Agreement (e.g., preparing incorporation filings, activating registered addresses, administering nominee appointments);
• Compliance with Legal Obligations: Processing is legally mandated under the UK Money Laundering Regulations 2017, the Companies Act 2006, and HMRC tax reporting statutes;
• Legitimate Interests: To protect our IT infrastructure against cyber threats, prevent fraudulent applications, enforce our Terms & Conditions, and maintain high customer service standards;
• Explicit Consent: Where you voluntarily opt in to receive marketing digests, educational guides, or optional commercial updates.

8. Specific Purposes of Processing

Your personal data is used specifically to:

1. Prepare, sign, and lodge company incorporation applications with Companies House and international registrars;
2. Execute mandatory Anti-Money Laundering (AML) identity validation and beneficial ownership verification;
3. Operate registered office and service address mail scanning, digital upload, and forwarding;
4. Coordinate nominee director, nominee shareholder, and corporate secretarial duties;
5. Assist with business bank account introduction applications and merchant facility documentation;
6. Provide statutory confirmation statement renewal alerts, accounting reminders, and compliance deadlines;
7. Process service payments, invoices, refunds, and financial auditing.

9. Public Registry Disclosures & Companies House Warning

This includes:

• Directors' full legal names, month and year of birth, nationality, and occupation;
• Directors' official service addresses (which will be our London address if you purchase our Registered Office service);
• Details of Persons with Significant Control (PSC) holding 25% or more shares or voting rights.

Please note that once published by Companies House, public records cannot be removed or hidden by Neptune Formation and are indexed by third-party search engines.

10. Third-Party Data Sharing

Neptune Formation does not sell, rent, or lease client personal information. We share data only with selected processors bound by strict Data Processing Agreements (DPAs):

• Government Authorities: Companies House, HM Revenue & Customs (HMRC), and regulatory agencies as required by statutory law;
• Automated KYC Verification Partners: Accredited digital identity verification providers to validate passport security features and run AML sanctions screenings;
• Partner Financial Institutions: Business banks, EMIs, and payment providers, strictly and solely upon your express written instruction for banking assistance;
• IT & Hosting Providers: Secure UK/EU data centres, encrypted cloud storage providers, and transactional email gateways;
• Law Enforcement & Courts: Where required pursuant to a court order, statutory subpoena, or police fraud investigation.

11. International Data Transfers & Cross-Border Safeguards

Where personal data is transferred outside the United Kingdom or the European Economic Area (EEA)—for example, when registering offshore companies or utilizing international verification servers—we ensure appropriate safeguards are implemented in accordance with Chapter V of the UK GDPR:

• Transfers to countries possessing a formal adequacy decision from the UK Secretary of State;
• Execution of the UK International Data Transfer Addendum (IDTA) or standard contractual clauses (SCCs);
• Multi-layer cryptographic encryption applied to all international data transmissions.

12. Data Retention Schedules

We retain personal information only for the period necessary to fulfill the purposes for which it was collected and to comply with statutory legal mandates:

• AML & KYC Verification Records: Under Regulation 40 of the UK MLR 2017, we are legally required to preserve identity documents, proof of address, and corporate records for a minimum of five (5) to six (6) years following the termination of the business relationship;
• Accounting & Invoicing Records: Preserved for six (6) years under UK tax and VAT legislation;
• Correspondence & Scanned Mail: Digital scans of statutory post are stored securely for two (2) years before automated cryptographic deletion;
• Marketing Contact Lists: Retained until you withdraw your consent or unsubscribe.

13. Technical & Organisational Security Safeguards

Neptune Formation employs comprehensive enterprise-grade technical and physical safeguards to prevent accidental loss, unauthorised access, alteration, or disclosure:

• Encryption: All web traffic is protected by Transport Layer Security (TLS 1.3 / SSL); stored KYC documents are encrypted using AES-256 cipher standards;
• Access Segregation: Only vetted compliance personnel with two-factor authentication (2FA) have access to identity and corporate databases;
• Physical Security: Our London server facilities and registered office archives operate biometric entry systems and 24/7 CCTV surveillance;
• Vulnerability Audits: Periodic penetration testing and security audits of our portal applications.

14. Statutory Rights of Data Subjects

Under the UK GDPR, you possess extensive statutory rights regarding your personal data:

1. Right of Access (Article 15): You have the right to obtain confirmation and request copies of your personal data held by us;
2. Right to Rectification (Article 16): You may require us to correct inaccurate, outdated, or incomplete details;
3. Right to Erasure (“Right to be Forgotten”, Article 17): You may request the deletion of your personal data where retention is no longer necessary, subject to statutory AML record-keeping obligations;
4. Right to Restrict Processing (Article 18): You may ask us to suspend processing while the accuracy of data is contested;
5. Right to Data Portability (Article 20): You may request the transfer of your data to another service provider in a structured, machine-readable format;
6. Right to Object (Article 21): You may object to data processing based on legitimate interests or direct marketing.

15. Subject Access Requests (SAR) Procedure

To exercise any of your statutory rights, please submit a formal Subject Access Request (SAR) in writing to our Data Protection Officer at contact@neptuneformation.com.

Response Timeframe: We will respond within one calendar month of receipt. In complex cases, we may extend this period by two further months in accordance with UK GDPR guidelines. Requests are handled free of charge, except where requests are manifestly unfounded or excessive.

16. Cookies, Tracking & Analytics Technologies

Our website utilizes cookies and similar tracking tags to improve performance and provide a personalized experience:

• Essential & Functional Cookies: Necessary for core site navigation, CSRF token validation, user authentication, and light/dark theme preference retention;
• Performance & Analytics Cookies: Anonymous aggregated telemetry (e.g. page visits, load speeds, session drop-off rates) to optimize our UI;
• Cookie Management: You can configure your web browser to block or alert you to cookies; however, disabling cookies may impair dashboard functionality.

17. Marketing Communications & Opt-Out Protocols

We may send you service announcements, regulatory compliance warnings (e.g. approaching confirmation statement deadlines), and billing notices as part of our core service contract. We will only send you commercial marketing communications if you have explicitly opted in.

You can unsubscribe from marketing emails at any time by clicking the “Unsubscribe” link in any newsletter or emailing contact@neptuneformation.com.

18. Children's Privacy (Strictly 18+)

Under UK corporate law, company directors and registered business owners must be at least 16 years old; however, Neptune Formation's services and portal are strictly reserved for individuals aged 18 years and older. We do not knowingly collect or solicit data from minors.

19. Third-Party Links & External Platforms

Our website may include links to third-party portals (such as Companies House, HMRC, or partner banking gateways). Clicking on those links may allow third parties to collect data about you. We do not control these third-party websites and are not responsible for their individual privacy statements.

20. Data Breach Response & ICO Notification Protocol

Neptune Formation maintains a formal Data Breach Incident Response Plan. In the unlikely event of a personal data breach posing a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the incident.

Affected clients will be notified promptly with details of the breach and remediation measures taken.

21. Supervisory Authority & Right to Lodge a Complaint

If you believe that Neptune Formation has not handled your personal data in accordance with UK data protection laws, you have the statutory right to lodge a formal complaint with the UK supervisory authority:

22. Data Protection Officer (DPO) & Contact Details

For all data protection queries, requests to exercise your privacy rights, or security concerns, please contact our Data Protection Team: