Privacy Policy

At Neptune Formation (“Neptune Formation”, “we”, “us”, or “our”), we take your privacy and the confidentiality of your commercial and personal data with the utmost seriousness. This Privacy Policy outlines our transparent data handling principles in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Money Laundering Regulations 2017 (MLR 2017), and the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023).

This Policy applies to all individuals who visit our website (neptuneformation.com), purchase corporate formation or web development packages, submit Know Your Customer (KYC) identity documentation, or interact with our client support desks.

1. Data Controller Identification

Under the UK GDPR, the Data Controller responsible for your personal data is:

We ensure that all staff, consultants, and appointed nominees who handle personal data are bound by strict contractual confidentiality duties and trained in data privacy compliance.

2. Scope & Applicability

This Privacy Policy covers personal data collected through:

• Our primary website (neptuneformation.com) and online checkout facilities;
• Customer due diligence onboarding portals and secure KYC file submission forms;
• Order status tracking systems and customer service communications (email, WhatsApp, phone); and
• Corporate governance administration, company registry filings, and nominee management.

3. Lawful Bases for Data Processing under UK GDPR

We only collect and process personal data where we have a valid legal basis under Article 6 of the UK GDPR:

• Contractual Performance (Article 6(1)(b)): Processing necessary to fulfill our contract with you, such as registering your company with Companies House, preparing custom logo design vector files, developing your website, or providing registered address services.
• Legal & Statutory Obligation (Article 6(1)(c)): Processing mandatory to comply with UK statutory regulations, including Customer Due Diligence (CDD) under the Money Laundering Regulations 2017, the Companies Act 2006, and the Economic Crime and Corporate Transparency Act 2023.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate commercial interests, such as preventing payment fraud, maintaining cybersecurity, tracking orders, and improving our service offerings, provided your fundamental privacy rights do not override those interests.
• Consent (Article 6(1)(a)): Where you have granted explicit consent for specific non-essential processing, such as subscribing to our newsletter updates or optional analytics cookies.

4. Categories of Personal Data We Collect

Depending on the service package purchased, we may collect and process the following categories of data:

• Identity & KYC Documentation: Full legal name, date of birth, nationality, gender, passport or national identity card scans, photographic verification, and occupation.
• Residential & Address Verification: Personal residential address, utility bills, council tax statements, bank statements, or proof of address documents dated within 3 months.
• Corporate Officer & PSC Records: Proposed corporate role (Director, Shareholder, Secretary, Person with Significant Control), percentage of share ownership, and voting rights.
• Contact Information: Email address, telephone/mobile number, WhatsApp contact, and postal correspondence address.
• Financial & Transaction Details: Billing address, payment transaction references, PayPal order IDs, invoice history, and package selection records (Note: We do not store full credit card numbers; payment data is securely tokenized by licensed payment gateways).
• Digital & Technical Telemetry: IP address, browser type and version, device operating system, referral URL, and timestamps collected via essential session cookies.

5. How We Collect Your Personal Data

We collect data through several direct and automated touchpoints:

• Direct Interaction: When you complete our online checkout forms, submit company registration parameters, upload identity files, or send email inquiries.
• Statutory Verification Databases: We may cross-reference identity information against electronic AML screening databases, sanction lists (OFAC, UK HMT, UN), and politically exposed person (PEP) registries to fulfill statutory compliance duties.
• Automated Technologies: As you navigate our website, essential cookies and server logs automatically record technical device data for security and performance optimization.

6. Purposes for Which We Process Your Personal Data

We process your information strictly for legitimate commercial and regulatory purposes:

1. To prepare and file incorporation applications, statutory PSC registers, and Articles of Association with Companies House;
2. To execute mandatory Anti-Money Laundering (AML) and Know Your Customer (KYC) compliance screening;
3. To provision, manage, and coordinate nominee director and nominee shareholder arrangements;
4. To activate and manage registered office address facilities and statutory government mail forwarding;
5. To facilitate corporate introductions and dossier preparation for business banking partners;
6. To develop bespoke logo design vectors, brand identity kits, and corporate websites;
7. To process transactions, generate PDF invoices, and maintain order tracking records; and
8. To prevent fraudulent chargebacks, detect cyber threats, and comply with law enforcement requests.

7. Public Registers & Companies House Disclosures

If you utilize our London Registered Office Address service, our address will be filed as your official corporate correspondence address, keeping your personal residential address shielded from the public register.

8. Disclosure of Data to Authorized Third Parties

We do not sell, rent, or trade your personal data to advertisers. We only share information with trusted third parties where necessary to deliver services or comply with law:

• Government Registrars: Companies House (UK), HM Revenue & Customs (HMRC), and corresponding international corporate registries.
• Payment Processors & Gateways: PayPal (Europe) S.à r.l. et Cie, SCA, Stripe, and licensed merchant acquirers for secure payment settlement.
• KYC & AML Verification Vendors: Regulated identity verification providers for biometric document matching and global sanctions screening.
• Banking Partners: Licensed banks, EMIs, and financial institutions where you have explicitly requested banking assistance.
• Professional Nominee Partners: Designated professional nominee directors, shareholders, and legal custodians bound by non-disclosure agreements.
• Law Enforcement & Regulators: UK law enforcement agencies, the National Crime Agency (NCA), and judicial courts where legally mandated under statutory court orders.

9. International Data Transfers

Neptune Formation operates primarily within the United Kingdom. Where personal data is transferred outside the UK or European Economic Area (EEA)—for instance, when interacting with international offshore registries or cloud infrastructure—we ensure appropriate safeguards are implemented in compliance with Chapter V of the UK GDPR.

These safeguards include UK International Data Transfer Agreements (IDTAs), European Commission Standard Contractual Clauses (SCCs), and adequacy regulations recognized by the UK Secretary of State.

10. Data Security & Storage Protocols

We implement enterprise-grade technical and organizational security measures to protect your personal data against unauthorized access, destruction, loss, or alteration:

• Transport Layer Security (TLS/SSL): All web communications, file uploads, and checkout transactions are encrypted using modern 256-bit TLS encryption.
• Data At Rest Encryption: Stored identity documents and verification databases are encrypted using AES-256 standards.
• Strict Role-Based Access: Access to sensitive identity documents is restricted strictly to vetted compliance officers on a least-privilege need-to-know basis.
• Routine Vulnerability Audits: Continuous server monitoring, automated firewall protection, and regular security patching.

11. Data Retention & Statutory AML Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to satisfy statutory accounting, tax, and anti-money laundering requirements:

• AML & KYC Verification Records: Under Regulation 40 of the UK Money Laundering Regulations 2017, we are legally required to retain identity verification records and customer files for a minimum period of 5 years from the date our business relationship with you ends.
• Financial & Accounting Records: Invoices, payment transaction logs, and corporate billing files are retained for 6 to 7 years to comply with UK HMRC tax and corporate audit regulations.
• General Client Inquiries: Unsuccessful or unfulfilled inquiries are securely purged after 12 months.

12. Your Data Subject Rights under UK GDPR

As a data subject under UK data protection law, you possess key statutory rights:

• Right to Access (Subject Access Request): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request the correction of any inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): You can request the deletion of your personal data where it is no longer needed, subject to statutory AML retention duties which supersede erasure requests under UK law.
• Right to Restrict Processing: You may request the restriction of processing under certain contested circumstances.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object: You can object to data processing based on legitimate interests or direct marketing communications.
• Right to Withdraw Consent: Where processing relies on consent, you may withdraw your consent at any time without affecting prior lawful processing.

13. How to Exercise Your Data Subject Rights

To exercise any of your statutory rights, submit a formal written request to our Data Protection Desk at contact@neptuneformation.com.

To protect your privacy, we may request verification of your identity before fulfilling the request. Under UK GDPR, we respond to verified requests within one calendar month free of charge, unless the request is manifestly unfounded or excessive.

14. Cookies & Tracking Technologies

Our website utilizes essential session cookies and local storage tokens strictly necessary to maintain shopping carts, manage dark/light visual theme preferences, preserve security sessions, and enable preloader functionality. We do not deploy intrusive third-party cross-site advertising trackers.

You can configure your browser settings to block or delete cookies; however, certain functional aspects of our online checkout and client portals may not function properly without essential cookies enabled.

15. Third-Party Websites & External Gateways

Our website may contain links to government authorities (Companies House, HMRC) and verified payment gateways (PayPal). We are not responsible for the privacy practices, content, or cookie policies of third-party external websites. We encourage you to review their respective privacy notices upon leaving our site.

16. Protection of Minors

Our corporate formation and digital services are directed strictly to individuals aged 18 and older. We do not knowingly collect or solicit personal data from children under the age of 18. If we become aware that a minor has provided personal data, we will take immediate steps to delete such information.

17. Direct Marketing & Opt-Out Rights

We may occasionally send registered customers important regulatory compliance notices, Companies House annual confirmation statement reminders, or service announcements. We do not send unsolicited commercial spam.

You may opt out of promotional newsletters at any time by clicking the “Unsubscribe” link in the footer of any marketing email or by emailing our support desk.

18. Data Protection Officer & ICO Supervisory Authority

If you have any questions, concerns, or complaints regarding our data handling practices, please contact our Data Protection Officer at contact@neptuneformation.com.

You also have the right under UK law to lodge a formal complaint with the UK data protection supervisory authority:

19. Revisions & Policy Updates

Neptune Formation may update this Privacy Policy periodically to reflect changes in data protection legislation, regulatory directives, or operational workflows. Any updates will be posted on this page with an amended “Effective Date”. Continued use of our services following an update signifies your acceptance of the revised terms.

20. Official Privacy Contact Details

For all data privacy matters, please contact our dedicated governance team: