Aureneum Limited
Privacy Notice
Issued 03 August 2026 · Version 2.0
This notice explains how Aureneum Limited collects and uses personal data, and what rights you have over it. It is written to be read rather than skimmed, and it describes only what we actually do.
1. Who we are
Aureneum Limited is the data controller. We are a company registered in England and Wales, company number 16790273, with its registered office at 158 Bedford Road, Kempston, Bedford MK42 8BH, United Kingdom. Our Legal Entity Identifier is 648826X7MMDGCW920112.
Aureneum Limited is the controller for everything done under its name, including our proprietary client application, the Aquila App. Any division or product name we use is a brand of Aureneum Limited, not a separate legal entity, and this notice covers all of them.
Questions, requests and complaints about personal data go to privacy@aureneum.com, or by post to the registered office marked for the attention of the Data Protection Contact. We are not required to appoint a Data Protection Officer and have not appointed one; the mailbox above reaches the person responsible.
2. What this website collects
This website sets no cookies. It runs no analytics, no tracking pixels, no advertising technology and no third-party scripts. It is a static page, and it is served with a policy that blocks scripts entirely. There is no cookie banner because there is nothing to consent to.
Our hosting provider records standard server logs when a page is served. These contain your IP address, the time of the request, the page requested, and your browser's user-agent string. We use them only to keep the site available and to investigate abuse. We do not use them to build a profile of you and we do not attempt to identify you from them.
3. What we collect when you contact us
This website exists so that institutional and professional clients can express interest in Aureneum. It has no forms and no accounts. You express interest by emailing us. When you do, we process the information you choose to give us: your name, your email address, any other contact details you include, your organisation, and the content of the correspondence.
Where we take on a client, counterparty or supplier, we also process the information needed to enter into and perform that relationship, including information required for identity, onboarding and anti-money-laundering checks where those apply to us or to our counterparties.
We do not buy personal data, and we do not collect personal data from public sources to build marketing lists.
4. Becoming, and ceasing to be, a client
Our research library is not published on this website. It is available to onboarded clients through the Aquila App, under tiered access.
Onboarding
Interest is expressed through this website or by email. We then correspond with you to agree your subscription tier and payment arrangement, and issue your access credentials.
In the course of that process we process your name, business contact details, organisation, the tier you hold, your payment arrangement and its status, and records of the correspondence. Once you are using the application we also process your account identifier and authentication records, and the access and security logs the application generates.
Offboarding
A client relationship may end at your request or where a subscription payment is not met. The circumstances in which access ends are set out in the client terms agreed with you.
When access ends we disable the credentials promptly. We keep the underlying records for the periods set out in section 6 below, because we need them for our accounts and in case of a later dispute.
5. Why we process it, and on what lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to enquiries and conduct business correspondence | Legitimate interests (Article 6(1)(f)): our interest in responding to people who contact us and in running the business. We have considered your interests and consider this uncontroversial: you initiated contact and would expect a reply. |
| Onboard you, issue credentials, provide access at your tier, and administer your subscription | Performance of a contract (Article 6(1)(b)) |
| Attempt a failed renewal payment again before ending access | Legitimate interests (Article 6(1)(f)): giving you a fair opportunity to keep access before it lapses |
| Keep authentication, access and security logs for the application | Legitimate interests (Article 6(1)(f)): protecting client accounts and our own systems |
| Keep accounting, tax and statutory records | Legal obligation (Article 6(1)(c)) |
| Keep the website available and investigate abuse | Legitimate interests (Article 6(1)(f)): security and continuity of our own systems |
| Send you research or publications you asked to receive | Consent (Article 6(1)(a)), which you may withdraw at any time |
We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, and we do not profile you.
We do not routinely process special category data. If you volunteer such information in correspondence, we will not use it beyond replying to you.
6. How long we keep it
| Category | Retention |
|---|---|
| Website server logs | Up to 12 months, then deleted |
| General enquiry correspondence that does not become a relationship | 24 months from the last message |
| Application access and authentication logs | 12 months from the event |
| Client, counterparty and supplier correspondence and records | 6 years from the end of the relationship, reflecting the limitation period for contractual claims in England and Wales |
| Accounting and statutory records | 6 years from the end of the accounting period, as required by the Companies Act 2006 and by HMRC |
Where a document is subject to a legal hold, or is needed for a live or anticipated dispute, we keep it until that reason ends.
7. Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing.
We use a small number of service providers who process personal data on our instructions. Our email, documents and calendars are on Google Workspace, and this website is hosted on Google Firebase Hosting. Both are provided by Google Ireland Limited and Google LLC under data processing terms.
We also disclose personal data where we are required to by law, by a regulator, or by a court; and to our professional advisers (accountants, auditors, insurers and solicitors) where they need it and are bound by confidentiality.
8. Transfers outside the United Kingdom
Our providers may process personal data outside the UK, including in the European Economic Area and the United States.
Where that happens, we rely on the UK's adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement, or on the UK Addendum to the European Commission's Standard Contractual Clauses. Under the Data (Use and Access) Act 2025 the test is whether the standard of protection in the destination is not materially lower than under UK law. We satisfy ourselves that it is not before transferring.
You can ask us for a copy of the safeguards that apply to a particular transfer by writing to privacy@aureneum.com.
9. Your rights
Under UK data protection law you have the right to:
- be told how your personal data is used, which is what this notice is for;
- ask for a copy of the personal data we hold about you;
- have inaccurate personal data corrected;
- ask us to delete personal data, where there is no good reason for us to keep it;
- ask us to restrict how we use it while a question about it is resolved;
- ask us to transfer it to you or another organisation in a structured, commonly used, machine-readable format, where it is held by consent or under a contract and processed by automated means;
- withdraw consent at any time, where we rely on consent. Withdrawing does not affect anything done before you withdrew.
Your right to object
You have the right to object at any time to our processing of your personal data where we rely on legitimate interests. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or that we need the data for legal claims.
Where we process your data for direct marketing, you may object at any time and we will stop, without exception. Email privacy@aureneum.com.
There is no charge for exercising these rights. We will respond within one month. If a request is complex or there are several, we may extend by two further months and will tell you why within the first month. We may ask you to confirm your identity before we act, so that we do not disclose your data to somebody else.
10. Complaints
If you are unhappy with how we have handled your personal data, tell us first at privacy@aureneum.com. We will acknowledge your complaint within 30 days and respond without undue delay, as the Data (Use and Access) Act 2025 requires of us. Say clearly that you are making a data protection complaint so that we route it correctly.
You also have the right to complain directly to the UK supervisory authority, and you do not have to come to us first. That authority is the Information Commissioner's Office, which the Data (Use and Access) Act 2025 re-establishes as the Information Commission:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline 0303 123 1113 · ico.org.uk/make-a-complaint
11. Children
This website and our services are directed at businesses and professional users, and are not intended for children. We do not knowingly collect personal data from anyone under 18. UK law sets the threshold for a child's own consent to online services at 13; we set our own threshold higher because nothing we do is aimed at young people. If you believe a child has given us personal data, tell us and we will delete it.
12. Changes to this notice
We review this notice when what we do changes and at least once a year. The issue date at the top of this page tells you which version you are reading. Where a change materially affects how we use personal data we already hold, we will take reasonable steps to tell affected people directly rather than relying on this page alone.