Privacy policy

1. Who controls your data

Plumbline China Ltd, company number 17562617, registered office 128 City Road, London EC1V 2NX, is the data controller. Contact: [email protected].

2. This website collects nothing

This site is static. It sets no cookies, runs no analytics, embeds no third-party scripts, and has no forms. Visiting it leaves no record with us beyond the ordinary server logs kept by our hosting provider.

3. Data about you, our client

What	Why	Lawful basis
Name, business email, company, role	To correspond with you and deliver the engagement	Performance of a contract
Engagement records, correspondence, reports issued	To deliver the work and to evidence what was done	Contract; legitimate interests in defending claims
Payment records	Accounting and tax	Legal obligation
Identity and sanctions screening where required	Legal and regulatory compliance	Legal obligation; legitimate interests

4. Data about people named in company records

Our work involves reading public corporate and court records. Those records name individuals: legal representatives, directors, shareholders, beneficial owners, and parties to litigation. That is personal data, and those individuals are not our clients.

1. Source. Public registers and published judgements, principally the National Enterprise Credit Information Publicity System and China Judgements Online, together with documents the counterparty has itself supplied to our client.
2. Purpose. To establish who controls a company, whether it is what it claims to be, and whether there is a record that bears on our client's decision to contract with it.
3. Lawful basis. Legitimate interests, namely our client's interest in verifying a counterparty before committing funds, and the general interest in the prevention of fraud. We have assessed that interest against the rights of the individuals concerned, taking into account that the data is already public, that it concerns their business rather than private life, and that we do not use it for any purpose beyond the engagement.
4. Minimisation. We record only what bears on the question asked. We do not collect special category data, and we do not seek personal contact details, family information, or anything unrelated to a person's role in the company.
5. Notification. Where data is not obtained from the individual, UK GDPR Article 14 requires that they be informed, subject to exemptions including disproportionate effort and prejudice to the purpose of the processing. We rely on those exemptions, since notifying the subject of a confidential pre-contractual enquiry would defeat its purpose and is not practicable at scale. This position is kept under review.

5. Who we share data with

1. The client who commissioned the engagement.
2. Our professional advisers and insurers, where necessary to obtain advice or to notify a claim.
3. Our accountant and HMRC, for payment and tax records.
4. Service providers who host our systems or process payments, under written terms.
5. A court, regulator or law enforcement body where we are required to disclose.

We do not sell data, and we do not share client identities with anyone for marketing.

6. International transfers

1. Where correspondence is held. Our email is hosted by Zoho Corporation on servers in the United States. Email you send us, the documents attached to it, and the reports we deliver by email are therefore stored in the United States. That transfer is made under the UK Addendum to the EU standard contractual clauses, which forms part of our provider's data processing terms.
2. Our principal is based in China, and work on an engagement is carried out there. Personal data processed in the course of an engagement is therefore processed in China and transferred to the United Kingdom when a report is delivered.
3. Transfers out of the UK are made under the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with a transfer risk assessment, or on the basis of a derogation where one applies.
4. Chinese law governs what may be collected and transferred out of China, including the Personal Information Protection Law and rules on industrial and supply chain information. We work within those rules and decline work that cannot be performed within them.

7. How long we keep it

Record	Retention
Engagement file, including the report and its sources	Six years from delivery, matching the limitation period for contract claims
Working papers from an engagement, other than the engagement file	Deleted within 30 days of delivery
Accounting and tax records	Six years from the end of the accounting period
Correspondence that did not lead to an engagement	Twelve months

We delete or anonymise data at the end of its retention period unless a claim or investigation requires us to keep it.

8. Your rights

You may ask us to give you a copy of the data we hold about you, correct it, delete it, restrict how we use it, or provide it in a portable form. You may object to processing we carry out on the basis of legitimate interests, and we will stop unless we have grounds that override your objection.

Write to [email protected]. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive.

If you are not satisfied with our response you may complain to the Information Commissioner's Office, ico.org.uk/make-a-complaint, or to the supervisory authority where you live or work.

9. Security

Engagement files are held on encrypted devices with access limited to the person doing the work. Reports are delivered to the address the client gives us. We do not hold client payment card details; payments are processed by our payment provider.

10. Changes

We will post any change to this policy on this page with a new version number. Where a change materially affects clients with a live engagement, we will tell them directly.

Version 1.0 · [email protected]