Governance
Privacy Notice
How Aureneum Limited collects and uses personal data
Issued 16 October 2026 · Version 3.2
This notice explains how Aureneum Limited collects and uses personal data, and what rights you have over it. It is written to be read rather than skimmed, and it describes only what we actually do.
1. Who we are
Aureneum Limited is the data controller. We are a company registered in England and Wales, company number 16790273, with our registered office at 158 Bedford Road, Kempston, Bedford MK42 8BH, United Kingdom. Our Legal Entity Identifier is 648826X7MMDGCW920112.
Aureneum Limited is the controller for everything done under its name, including Aquila, our client application. Aquila and any other division or product name we use are brands of Aureneum Limited, not separate legal entities, and this notice covers all of them.
Questions, requests and complaints about personal data go to privacy@aureneum.com, or by post to the registered office marked for the attention of the Data Protection Contact. We are not required to appoint a Data Protection Officer and have not appointed one. The mailbox above reaches the person responsible.
2. What this website collects
This website sets no cookies. It runs no analytics, no tracking pixels, no advertising technology and no third-party scripts. Every public page is served with a policy that blocks scripts entirely. The one exception is the private purchase page described in section 4, which runs a small script of our own, loaded from our own domain, to check and record an invitation. It loads nothing from any third party and sets no cookie. There is no cookie banner because there is nothing to consent to.
Our hosting provider records standard server logs when a page is served. These contain your IP address, the time of the request, the page requested, and your browser's user-agent string. We use them only to keep the site available and to investigate abuse. We do not use them to build a profile of you and we do not attempt to identify you from them.
3. What we collect when you contact us
This website exists so that institutional and professional readers can express interest in Aureneum. It carries no forms, no accounts and no client area. You contact us by email or by telephone, and each is handled the same way.
| Route | What we process |
|---|---|
| Your name, your email address, any other contact details you include, your organisation, and the content of the correspondence. | |
| Telephone | Your telephone number, your name, and a note of what the call was about, so that we can return it. Apart from a voicemail you choose to leave, we do not record or transcribe calls. If that changes, we will say so at the start of the call and this notice will be updated before it does. |
Voicemail
If we cannot take your call, you may leave a voicemail. Your message is recorded and held by our telephone provider, Telnyx, until we retrieve it. We listen to it, return your call, and then delete it, within 90 days at most. A voicemail is used for nothing else.
Where we take on a client, counterparty or supplier, we also process the information needed to enter into and perform that relationship, including information required for identity, onboarding and anti-money-laundering checks where those apply to us or to our counterparties.
We do not buy personal data, and we do not collect personal data from public sources to build marketing lists.
4. Becoming, and ceasing to be, a client
Our research library is not published on this website. It is available to onboarded clients through our client application, under tiered access.
Onboarding
Interest is expressed by email or by telephone. If we decide to offer access, we issue a private invitation: a single link sent to one email address, valid for seven days, which opens a purchase page on this site. That page states the tier, the price and the terms, and records your acceptance.
What the purchase page records. The invitation reference; the email address the invitation was bound to; the time of acceptance; your IP address and browser user-agent string; the version of the Terms of Service you accepted; your answers to the self-certification statement; and your express request that supply begin within the cancellation period, with your acknowledgement of what that means. The invitation token itself travels in a part of the link that is not sent to any server, so it does not appear in our logs, and we store only a one-way hash of it.
Individual subscribers then pay on our payment provider's page. Institutions are invoiced. Credentials are issued by Aureneum after a person has reviewed the acceptance, within one working day of confirmed payment or recorded settlement.
In the course of that process we process your name, business contact details, organisation, the tier you hold, your payment arrangement and its status, and records of the correspondence. Once you are using the application we also process your account identifier and authentication records, and the access and security logs the application generates.
The activation code. Each reader's first sign in uses a one-time activation code, which we send by text message or give on a short telephone call, never by email. We ask for a mobile number for that purpose. The number is used for nothing else, and we do not keep the code.
Offboarding
A client relationship may end at your request or where a subscription payment is not met. The circumstances in which access ends are set out in the Terms of Service and summarised at Cancellation and Refunds.
When access ends we disable the credentials promptly. We keep the underlying records for the periods set out in section 6, because we need them for our accounts and in case of a later dispute.
5. Why we process it, and on what lawful basis
| What we do | Lawful basis |
|---|---|
| Retrieve a voicemail you leave, and return your call | Legitimate interests, Article 6(1)(f): returning a call you made to us. The message is deleted once the call is returned |
| Reply to enquiries and conduct business correspondence, by email or telephone | Legitimate interests, Article 6(1)(f): our interest in responding to people who contact us and in running the business. We have considered your interests and consider this uncontroversial, since you initiated contact and would expect a reply. |
| Onboard you, issue credentials, provide access at your tier, and administer your subscription | Performance of a contract, Article 6(1)(b) |
| Send a reader's activation code by text message to the number given for it | Performance of a contract, Article 6(1)(b) |
| Record your acceptance of an invitation: the terms version, your self-certification, and your request that supply begin at once | Performance of a contract, Article 6(1)(b), and legal obligation, Article 6(1)(c): the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013 require us to hold evidence of an express request and acknowledgement where a cancellation right is affected |
| Take payment and administer refunds | Performance of a contract, Article 6(1)(b). Payment is taken by our provider on its own page; we receive confirmation and the invitation reference, never card details |
| Attempt a failed renewal payment again before ending access | Legitimate interests, Article 6(1)(f): giving you a fair opportunity to keep access before it lapses |
| Apply a reader mark to papers displayed in the application, and keep authentication, access and security logs | Legitimate interests, Article 6(1)(f): protecting client accounts, our own systems, and research that clients pay to have kept confidential |
| Keep accounting, tax and statutory records | Legal obligation, Article 6(1)(c) |
| Keep the website available and investigate abuse | Legitimate interests, Article 6(1)(f): security and continuity of our own systems |
| Send you research or publications you asked to receive | Consent, Article 6(1)(a), which you may withdraw at any time |
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you.
We do not routinely process special category data. If you volunteer such information in correspondence, we will not use it beyond replying to you.
6. How long we keep it
| Category | Retention |
|---|---|
| Website server logs | Up to 12 months, then deleted |
| Enquiries that do not become a relationship | 24 months from the last message |
| Voicemail messages | Deleted once the call has been returned, and within 90 days at most |
| Application access and authentication logs | 12 months from the event |
| Client, counterparty and supplier records, including invitation and acceptance records | 6 years from the end of the relationship, reflecting the limitation period for contractual claims in England and Wales |
| Invitations that expire or are revoked without acceptance | 12 months from expiry or revocation, then deleted |
| Accounting and statutory records | 6 years from the end of the accounting period, as required by the Companies Act 2006 and by HMRC |
Where a document is subject to a legal hold, or is needed for a live or anticipated dispute, we keep it until that reason ends.
7. Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing.
We use a small number of service providers who process personal data on our instructions:
| Provider | What they handle |
|---|---|
| Google Ireland Limited and Google LLC | Email, documents and calendars on Google Workspace; website hosting on Firebase Hosting; the cloud infrastructure the client application runs on |
| Airwallex (UK) Limited | Subscription payments, card processing and invoicing. Card details are entered with Airwallex and are never held by Aureneum. |
| Telnyx LLC | Our telephone line and its voicemail, and the text messages that carry activation codes |
We also disclose personal data where we are required to by law, by a regulator, or by a court; and to our professional advisers, meaning accountants, auditors, insurers and solicitors, where they need it and are bound by confidentiality.
8. Transfers outside the United Kingdom
Our providers may process personal data outside the UK, including in the European Economic Area and the United States.
Where that happens, we rely on the UK's adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement, or on the UK Addendum to the European Commission's Standard Contractual Clauses. Under the Data (Use and Access) Act 2025 the test is whether the standard of protection in the destination is not materially lower than under UK law. We satisfy ourselves that it is not before transferring.
You can ask us for a copy of the safeguards that apply to a particular transfer by writing to privacy@aureneum.com.
9. Your rights
Under UK data protection law you have the right to:
- be told how your personal data is used, which is what this notice is for;
- ask for a copy of the personal data we hold about you;
- have inaccurate personal data corrected;
- ask us to delete personal data, where there is no good reason for us to keep it;
- ask us to restrict how we use it while a question about it is resolved;
- ask us to transfer it to you or another organisation in a structured, commonly used, machine-readable format, where it is held by consent or under a contract and processed by automated means;
- withdraw consent at any time, where we rely on consent. Withdrawing does not affect anything done before you withdrew.
Your right to object
You have the right to object at any time to our processing of your personal data where we rely on legitimate interests. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or that we need the data for legal claims.
Where we process your data for direct marketing, you may object at any time and we will stop, without exception. Email privacy@aureneum.com.
There is no charge for exercising these rights. We will respond within one month. If a request is complex or there are several, we may extend by two further months and will tell you why within the first month. We may ask you to confirm your identity before we act, so that we do not disclose your data to somebody else.
10. Complaints
If you are unhappy with how we have handled your personal data, tell us first at privacy@aureneum.com. We will acknowledge your complaint within 30 days and respond without undue delay, as the Data (Use and Access) Act 2025 requires of us. Say clearly that you are making a data protection complaint so that we route it correctly.
You also have the right to complain directly to the UK supervisory authority, and you do not have to come to us first. That authority is the Information Commissioner's Office, which the Data (Use and Access) Act 2025 re-establishes as the Information Commission:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline 0303 123 1113 · ico.org.uk/make-a-complaint
11. Children
This website and our services are directed at businesses and professional users, and are not intended for children. We do not knowingly collect personal data from anyone under 18. UK law sets the threshold for a child's own consent to online services at 13. We set our own threshold higher because nothing we do is aimed at young people. If you believe a child has given us personal data, tell us and we will delete it.
12. Changes to this notice
We review this notice when what we do changes and at least once a year. The issue date at the top of this page tells you which version you are reading. Where a change materially affects how we use personal data we already hold, we will take reasonable steps to tell affected people directly rather than relying on this page alone.