Privacy Policy
How Lycia Limited collects, uses and protects personal data across all websites, portals, verification links and services in accordance with UK GDPR and the Data Protection Act 2018.
This document is a draft and has not been formally approved. It is provided for review purposes and may be updated. No legal claims, certifications or compliance status should be inferred from this document until formally approved by the Master Administrator following solicitor and data-protection review.
Lycia Limited
282a Leigh Road
Leigh-on-Sea, Essex
SS9 1BW, United Kingdom
Company Registration No: 04465356
VAT Registration No: GB 155 3559 95
ICO Registration No: ZA250263
1. Data Controller
Lycia Limited is the data controller responsible for personal data processed through this website and associated platforms.
Registered office: 282a Leigh Road, Leigh-on-Sea, Essex, SS9 1BW, United Kingdom
Company Registration Number: 04465356
VAT Registration Number: GB 155 3559 95
ICO Registration Number: ZA250263
Canonical domain: https://lycia.co.uk
2. Scope of This Policy
This policy applies to personal data processed by Lycia Limited across:
- the public website (lycia.co.uk)
- the Staff Portal (CRM and administration)
- the Client Portal (invitation-only client access)
- secure verification links (/verification/:token)
- the gold site assessment questionnaire portal (/gold-site-questionnaire/:token)
- verification and due-diligence services (KYC, KYB, AML)
- reports, proposals and advisory outputs
- data rooms and document sharing
- enquiry and contact forms
- API integrations (Companies House, HMRC, Shufti Pro)
- cookies and analytics on the public website
It does not apply to third-party websites linked from our services. We encourage you to read the privacy policies of any third-party sites you visit.
3. Categories of Personal Data We Process
3.1 Identity and Contact Data
- Name
- Title or role
- Date of birth
- Nationality
- Country of residence
- Email address
- Telephone number
- Residential address
- Correspondence address
3.2 Business Data
- Legal company name
- Trading name
- Company number
- Incorporation date
- Company status
- Registered office address
- Trading address
- SIC codes
- Officers and directors
- Persons with significant control (PSCs)
- Beneficial owners
- Ownership structure
- VAT number
- Tax identifiers
- Licences and regulatory information
3.3 Verification Data
- Identity verification status
- Document verification status
- Face-match result
- Liveness result
- Address verification result
- AML screening result
- PEP status
- Sanctions screening result
- Adverse media result
- Decline reasons and codes
- Verification references (e.g. Shufti reference, consultation number)
3.4 Financial and Transaction Data
- Expected transaction values
- Source of funds evidence
- Source of wealth evidence
- Invoices and payment records
- Bank evidence where required
- VAT verification results from HMRC
3.5 Technical Data
- IP address
- Browser type and version
- Device information
- Login records
- Session records
- Audit events
- Security events
- API request references
- Access logs
3.6 Document Data
- Certificates of incorporation
- Articles of association
- Licences and regulatory documents
- Proof of address
- Authority documents
- Ownership structure charts
- Verification evidence
- Reports and correspondence
3.7 Special-Category and Sensitive Data
Lycia processes the following special-category and criminal-offence data only where necessary for verification and compliance purposes:
- Biometric verification results (processed by Shufti Pro, our identity verification provider)
- Political exposure and PEP status (from AML/PEP screening)
- Sanctions and criminal-offence-related data (from sanctions screening)
- Identity documents (passports, driving licences, national ID cards)
Lycia does not knowingly collect health data, racial or ethnic origin data, religious or philosophical belief data, trade union membership data, sex life or sexual orientation data unless specifically and lawfully required for verification or compliance purposes and with an appropriate UK GDPR Article 9 condition and Data Protection Act 2018 condition satisfied.
3.8 Confidential Commercial Information
Commercial information such as ownership structures, financial projections, transaction details, contracts and business plans is treated as confidential and processed under legitimate interests or contractual necessity.
3.9 Authentication Credentials and API Secrets
API keys, OAuth client secrets, access tokens, SMTP passwords, webhook secrets and encryption keys are classified as RESTRICTED SECRET under Lycia's Data Classification Policy. They are stored only in the platform's secrets management system and are never stored in entity fields, frontend code or logs.
4. Sources of Data
Lycia obtains personal data from the following sources:
- The individual directly (e.g. enquiry forms, portal registration, verification forms)
- The client organisation or authorised representative (e.g. company details, ownership information)
- Companies House public-data API (company profiles, officers, PSCs, registered office)
- HMRC (VAT verification results via Check a UK VAT Number API v2)
- Shufti Pro (identity verification, document verification, AML/PEP/sanctions screening)
- Public registers and sanctions/PEP databases
- Professional advisers, counterparties and suppliers (with appropriate authorisation)
- Portal users and uploaded documents
- System and security logs (IP addresses, browser data, session records)
Where data is obtained indirectly (e.g. from Companies House or from a client about a beneficial owner), Lycia will inform the individual of the source where required by UK GDPR Article 14, unless this proves impossible or involves disproportionate effort.
5. Purposes and Lawful Bases
The table below summarises the main processing purposes, lawful bases and retention periods. Items marked "LEGAL REVIEW REQUIRED" have not been confirmed by legal review.
| Purpose | Data Category | Lawful Basis | Retention | Mandatory? |
|---|---|---|---|---|
| Responding to enquiries | Identity, contact | Legitimate interests | LEGAL REVIEW REQUIRED | No — but required to respond |
| Client/supplier/buyer onboarding | Identity, business, financial | Contract / steps before contract | LEGAL REVIEW REQUIRED | Yes — required to onboard |
| Company verification (Companies House) | Business data | Legitimate interests | LEGAL REVIEW REQUIRED | No — but needed for verification |
| VAT verification (HMRC) | VAT number, business name, address | Legitimate interests | LEGAL REVIEW REQUIRED | No — but needed for verification |
| Identity verification (Shufti Pro) | Identity documents, biometric | Consent / Legitimate interests | LEGAL REVIEW REQUIRED | No — but required for KYC |
| AML, PEP and sanctions screening | Name, DOB, nationality | Legal obligation (AML regulations) | LEGAL REVIEW REQUIRED | Yes — regulatory requirement |
| Fraud prevention | All categories | Legitimate interests | LEGAL REVIEW REQUIRED | Yes |
| Contract administration | Business, contact | Contract | Duration of contract + LEGAL REVIEW REQUIRED | Yes |
| Report creation | Business, financial, verification | Contract | LEGAL REVIEW REQUIRED | Yes — as per engagement |
| Data room access | Business, documents | Contract / Legitimate interests | LEGAL REVIEW REQUIRED | Yes — for access |
| Portal access | Identity, contact, technical | Contract / Legitimate interests | Duration of access | Yes — for access |
| Security monitoring | Technical, audit | Legitimate interests / Legal obligation | LEGAL REVIEW REQUIRED | Yes — system security |
| Legal compliance | All categories | Legal obligation | Per applicable law | Yes |
| Accounting and tax | Financial, business | Legal obligation | Per tax law | Yes |
| Consented analytics | Technical (anonymised) | Consent | Until consent withdrawn | No — opt-in only |
| Marketing (where consented) | Identity, contact | Consent | Until consent withdrawn | No — opt-in only |
Special-category data conditions: Where Lycia processes biometric data for identity verification, the UK GDPR Article 9(2)(a) condition (explicit consent) and the Data Protection Act 2018 Schedule 1 condition apply. Where criminal-offence data is processed for AML/sanctions screening, the Article 10 condition and Data Protection Act 2018 Schedule 1 Part 2 condition (prevention of unlawful acts) apply.
LEGAL REVIEW REQUIRED — All lawful basis assessments and retention periods in this table require confirmation by a qualified data-protection professional.
6. HMRC VAT Verification
Lycia may submit a UK VAT number to HMRC's Check a UK VAT Number API v2 for verification purposes.
What happens during VAT verification
- Lycia submits the target VAT number to HMRC via the backend function
- For a verified check, a requester VAT number may be included (only with authorisation)
- HMRC may return: registered business name, registered address, processing date, consultation number (for verified checks), verification result
- A request reference may be generated and stored in the audit log
How Lycia handles HMRC data
- HMRC OAuth credentials remain backend-only — they are never exposed in frontend code or stored in entity fields
- Access tokens are cached in memory only and are not stored in client records
- Raw authentication data is not shown to users
- Results may be compared with Companies House data and client-provided data for discrepancy detection
- Discrepancies may require manual review by a compliance officer
- A failed API call (e.g. HTTP 404 or connection error) is not proof that a VAT registration is invalid
- Customer records are not overwritten automatically without authorised review
HMRC operates as a separate data controller for its statutory processing. For information about how HMRC processes personal data, see the HMRC Personal Information Charter.
7. Companies House Data
Lycia retrieves public company information from Companies House using the Companies House public-data API.
Data retrieved may include:
- Company profile (name, number, status, type, incorporation date)
- Registered office address
- Officers (directors and secretaries)
- Persons with significant control (PSCs)
- Accounts reference dates and filing status
- Confirmation statement dates and status
- SIC codes
- Previous names
- Filing and insolvency indicators
Although Companies House data is publicly available, it may still constitute personal data under UK GDPR. Lycia uses it for verification and due-diligence purposes. Imported data is labelled with its source and retrieval date. Official data from Companies House is not silently overwritten — discrepancies between Companies House data and client-provided data may be referred to manual review.
8. Shufti Pro Identity Verification
Lycia uses Shufti Pro as a third-party identity verification provider. Services may include:
- Identity verification (document and facial)
- Liveness detection
- Address verification
- AML (anti-money laundering) screening
- PEP (politically exposed person) screening
- Sanctions screening
- Adverse media screening
- Business verification (KYB)
How identity verification works
- Each individual receives their own secure verification link — you cannot complete verification on behalf of another person
- Identity documents should be collected directly by Shufti Pro's verification interface
- Raw identity-document URLs are not publicly stored or accessible
- Verification references, outcomes and review statuses may be retained by Lycia for audit and compliance purposes
- Biometric processing (facial match and liveness) may occur during verification
- Explicit consent or another lawful condition is obtained before biometric processing
- Automated checks may be followed by human review where results are inconclusive
- A failed automated result does not necessarily indicate fraud — it may trigger manual review
- Individuals may request human intervention in automated decision-making where applicable
Shufti Pro processor status
Shufti Pro acts as a processor or separate controller subject to the executed agreement between Lycia Limited and Shufti Pro. The agreement covers data processing terms, retention periods, deletion processes, and international transfer safeguards.
For details on Shufti Pro's hosting location, retention periods and deletion processes, see our Subprocessors & Data Sharing page.
CONTRACTUAL REVIEW REQUIRED — The Shufti Pro data processing agreement must be verified to confirm processor status, hosting location, retention period and deletion terms.
9. Data Sharing and Subprocessors
Lycia does not sell personal data. Data may be shared with the following categories of recipients where necessary:
| Recipient | Purpose | Role | Location |
|---|---|---|---|
| Base44 (platform provider) | Hosting, database, backend infrastructure | Processor | LEGAL REVIEW REQUIRED |
| Companies House | Company verification (public data API) | Independent controller | UK |
| HMRC | VAT verification (API) | Independent controller | UK |
| Shufti Pro | Identity, AML, PEP, sanctions verification | Processor / Controller | LEGAL REVIEW REQUIRED |
| OpenAI | AI-powered content and document analysis | Processor | LEGAL REVIEW REQUIRED |
| Email/SMTP provider | Transactional email delivery | Processor | LEGAL REVIEW REQUIRED |
| Analytics providers (GA4, GTM, Clarity) | Website analytics (consent-based) | Processor | LEGAL REVIEW REQUIRED |
| Professional advisers | Legal, tax, audit advice | Independent controller | UK |
| Banks and payment providers | Transaction processing | Independent controller | UK |
| Regulators, courts and law enforcement | Legal compliance | Independent controller | UK |
For the full subprocessor register, including DPA status and transfer mechanisms, see our Subprocessors & Data Sharing page.
CONTRACTUAL REVIEW REQUIRED — Provider roles, locations and DPA status must be confirmed for each named provider.
10. International Data Transfers
Some of Lycia's service providers may process data outside the UK. Lycia does not claim all data stays in the UK unless this is confirmed.
Where data is transferred outside the UK, Lycia relies on one or more of the following transfer mechanisms:
- UK adequacy regulations (where the destination country has been deemed adequate)
- UK International Data Transfer Agreement (UK IDTA)
- UK Addendum to EU Standard Contractual Clauses
- Derogations under UK GDPR Article 49 (for specific, limited situations)
Transfer risk assessments are conducted for non-adequate destinations and supplementary measures are applied where necessary.
For the full international transfer register, see our Subprocessors & Data Sharing page.
11. Data Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory and accounting requirements. Detailed retention periods are set out in our Data Retention Schedule.
Retention periods marked "LEGAL REVIEW REQUIRED" have not been confirmed by legal, tax or provider requirements. Lycia does not automatically delete regulated data until approved retention periods are confirmed.
12. Your Rights
Under UK GDPR, you have the following rights:
- Right to be informed (this policy)
- Right of access to your personal data
- Right to rectification of inaccurate data
- Right to erasure (the 'right to be forgotten')
- Right to restriction of processing
- Right to object to processing
- Right to data portability (where applicable)
- Rights related to automated decision-making and profiling
- Right to withdraw consent at any time (where processing is based on consent)
- Right to complain to the Information Commissioner's Office (ICO)
These rights are not absolute and may be subject to exemptions. For details and to submit a request, see our Data Subject Rights page.
13. Data Security
Lycia applies layered security controls including role-based access, client data isolation, private file storage with signed URLs, comprehensive audit logging, secrets management, and webhook validation. For details, see our Information Security Statement.
14. Cookies and Analytics
Lycia uses cookies and similar technologies on its public website. Analytics cookies are disabled by default and are only loaded after you give consent. Cookie consent is versioned and can be withdrawn at any time. For full details, see our Cookie Policy.
15. Changes to This Policy
Lycia may update this policy from time to time. The version number, last updated date and change summary will be updated accordingly. Material changes will be notified through the website or directly where appropriate.
Version: 2.0 | Last updated: July 2026 | Status: Draft — Solicitor and Data-Protection Review Required