Privacy Policy

Who We Are

This Privacy Policy applies to Karvix Group Ltd, a private company limited by shares, registered in England and Wales under Company Number 17225304. Our registered office is at International House, 50 Essex Street, London, WC2R 3JF, United Kingdom.

We act as a data controller in respect of personal data collected in connection with our B2B trade intermediary activities. This means we determine the purposes and means by which your personal data is processed.

Data We Collect

We collect personal data in the following contexts:

Contact and Enquiry Data: When you submit a sourcing enquiry via our website, we collect your name, email address, company name, and the content of your message.

Business Correspondence: In the course of conducting trade negotiations or commercial transactions, we may collect names, job titles, business email addresses, telephone numbers, and correspondence records of representatives.

Due Diligence Data: As required by applicable anti-money laundering regulations, we may collect identification information about directors, beneficial owners, or authorised representatives of our counterparties.

Technical Data: When you visit our website, we may automatically collect standard log data including IP address, browser type, referring URLs, and pages visited.

• We do not collect sensitive personal data (as defined under UK GDPR) unless strictly required.
• We do not target or solicit personal data from individuals acting in a private capacity.
• We do not process data of persons under 18 years of age.

How We Use It

We use personal data for the following purposes:

• To respond to business enquiries and assess whether we can assist with a sourcing or trade requirement.
• To negotiate and execute commercial transactions, including communicating with suppliers and buyers on your behalf.
• To fulfil legal and regulatory obligations, including anti-money laundering (AML) and Know Your Customer (KYC) requirements applicable to trade intermediaries.
• To maintain business records for the purposes of accounting, audit, and contractual documentation.
• To operate and improve our website, including understanding how visitors navigate our pages.

We do not use your personal data for unsolicited direct marketing purposes without your explicit consent.

Legal Basis for Processing

We process personal data on one or more of the following legal bases, as set out in the UK General Data Protection Regulation (UK GDPR):

• Legitimate Interests (Article 6(1)(f)): Processing contact and correspondence data in connection with B2B commercial negotiations, where our interests do not override your rights.
• Contract Performance (Article 6(1)(b)): Processing data necessary to fulfil or enter into a commercial agreement with your organisation.
• Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable laws, including AML/KYC obligations under the Proceeds of Crime Act 2002 and the Money Laundering Regulations.
• Consent (Article 6(1)(a)): Where we have requested and received your explicit consent for a specific processing activity.

Data Sharing

We may share personal data in limited and controlled circumstances:

• Trade counterparties: We may share your contact details and commercial requirements with potential suppliers or buyers as part of facilitating a transaction you have requested.
• Professional advisors: Lawyers, accountants, and compliance consultants who are bound by confidentiality obligations.
• Regulatory authorities: Where we are legally required to disclose information to HMRC, Companies House, or law enforcement agencies.
• Service providers: Technology or communication service providers who process data on our behalf under strict data processing agreements.

We do not sell, rent, or trade personal data to third parties for commercial purposes.

Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy, subject to the following guidelines:

• Enquiry data that does not lead to a transaction: up to 12 months.
• Contractual and transaction records: 7 years from the date of the relevant transaction, in accordance with UK accounting and tax requirements.
• AML/KYC documentation: 5 years from the end of the business relationship, as required by the Money Laundering Regulations 2017.
• Website log data: Up to 12 months.

After retention periods expire, data is securely deleted or anonymised.

Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To ask us to correct inaccurate or incomplete data.
• Right to Erasure: To request deletion of your data, subject to our legal obligations.
• Right to Restrict Processing: To limit how we use your data in certain circumstances.
• Right to Data Portability: To receive your data in a structured, machine-readable format where technically feasible.
• Right to Object: To object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, to withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us using the details in Section 11. We will respond within one calendar month. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

Our website may use cookies and similar tracking technologies. We use:

• Essential cookies: Necessary for the basic operation of the website.
• Analytics cookies: To understand how visitors interact with our site. These are only deployed with your consent.

You may control cookie settings through your browser preferences. Disabling non-essential cookies will not affect your ability to use our core services.

Security

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss, destruction, or disclosure. These include encrypted communication channels, access controls, and secure document management practices.

While we take security seriously, no transmission over the internet is entirely risk-free. We will notify affected individuals and relevant authorities promptly in the event of a data breach where required by law.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our operations, legal requirements, or regulatory guidance. The most current version will always be available on our website. Material changes will be communicated to affected parties where practicable.

Contact Us

For any questions, requests, or concerns related to this Privacy Policy or the handling of your personal data, please contact us at: