Blacklist Global Logo
ICO Registered · ZB956879 · GDPR Compliant

Privacy Policy

How Blacklist Global collects, uses, and protects your data across all products — Deposit-Free, KYC Screening, B-Pay, and Blacklist OS.

Last updated: July 2026·Effective: July 2026·Verify ICO Registration
1.

Who We Are

Blacklist Global Ltd ("Blacklist Global", "we", "us", "our") is a United Kingdom-based B2B fintech and rental protection platform. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZB956879.

We operate the following products and services: Deposit-Free Rental Protection, KYC & Guest Screening, B-Pay Payment Links, and Blacklist OS — collectively referred to as the "Platform".

We act as both a Data Controller (for partner and end-user data) and a Data Processor (when processing data on behalf of our B2B partners), depending on the context. Data Processing Agreements (DPAs) are available for all B2B partners upon request.

Contact: support@blacklistglobal.co.uk · +44 7897 017709 · Blacklist Global Ltd, United Kingdom
2.

Data We Collect

2.1 Partner & Business Data

Full name, email, phone number, and WhatsApp contact
Company name, trade licence number, and registered business address
Passport, Emirates ID, or other business identity verification documents
Bank account and payment details for payout processing
Wallet transaction history and platform usage records

2.2 Guest & Client Screening Data (KYC Module)

Full name, date of birth, nationality, and identity document details
Passport scans, Emirates ID, driving licence, or equivalent government-issued ID
Liveness detection and biometric facial comparison data (where enabled)
Cross-reference results from global sanctions, PEP, and adverse media databases
Risk classification scores and screening outcomes

2.3 Case & Risk Intelligence Data

Incident reports submitted by verified partner businesses
Supporting evidence files (photos, invoices, rental agreements, correspondence)
Case status, dispute history, and admin review notes
Risk entries in our global rental intelligence database

2.4 B-Pay Payment Data

Payment link metadata (amount, currency, case reference, due date)
Payer name and email address (collected at checkout via Stripe)
Transaction IDs, payment status, and installment history
We do not store card numbers, CVV data, or authentication credentials — all payment data is handled by Stripe (PCI-DSS Level 1 certified)

2.5 Technical & Usage Data

IP address, browser type, device type, and operating system
Platform activity logs and session data
Cookies and similar tracking technologies (see Section 8)
Visitor geolocation data for case tracking and fraud prevention
3.

Lawful Basis for Processing

We process personal data under the following lawful bases under UK GDPR Article 6:

Contractual Necessity: Processing required to deliver services under partner agreements — case management, screening, payment collection, deposit-free coverage.
Legitimate Interest: Risk intelligence database operations, fraud prevention, platform security, and analytics.
Legal Obligation: AML compliance, financial record retention, ICO obligations, and law enforcement cooperation.
Consent: Marketing communications and optional analytics (withdrawable at any time).

For special category data (biometric/liveness data in KYC), we rely on explicit consent obtained at the point of screening, which guests may refuse.

4.

How We Use Your Data

Service Delivery

Processing deposit-free coverage bookings, claims, and payouts
Performing KYC identity verification and risk screening for partner businesses
Generating and processing B-Pay payment links and installment plans
Managing case submissions, admin reviews, and dispute resolution
Maintaining the global rental risk intelligence database

Platform Security & Compliance

Fraud detection, AML monitoring, and sanctions screening
Platform security monitoring and penetration test response
Compliance with ICO, FCA guidance, CBUAE, and FATF requirements

Communications

Transactional emails (case updates, payment confirmations, dispute outcomes)
Follow-up payment reminders via B-Pay (automated, opt-in)
Platform updates and product announcements (opt-out available)
5.

Data Sharing & Disclosure

5.1 Within the Verified Partner Network

Risk intelligence entries are shared with all verified B2B partners in our network on a need-to-know basis
The identity of the submitting partner is kept confidential and visible only to Blacklist Global administrators
Case details are accessible only to the submitting partner and Blacklist Global staff

5.2 Third-Party Service Providers

Stripe: PCI-DSS Level 1 payment processor for B-Pay and case checkout
Resend / Brevo: Transactional email delivery
Supabase: Cloud database and file storage (encrypted at rest)
All processors operate under signed Data Processing Agreements and are GDPR-compliant

5.3 Legal Requirements

Where required by law, court order, or formal government/regulatory request
To protect the rights, property, or safety of Blacklist Global, our partners, or the public
In connection with debt recovery, legal enforcement, or fraud investigation
We never sell personal data to advertisers, data brokers, or unaffiliated third parties. Ever.
6.

Data Retention

Financial records (B-Pay): 7 years — UK financial reporting obligations
KYC screening results: Up to 5 years — AML and regulatory compliance
Risk intelligence entries: 3–7 years — proportional to incident severity, reviewed annually
Case & evidence files: Duration of partner relationship plus 3 years
Partner account data: Duration of account plus 2 years post-termination
Technical logs: 12 months rolling

All retention periods align with ICO guidance and UK GDPR Article 5(1)(e) storage limitation principles. Retention is reviewed annually.

7.

Your Rights Under UK GDPR

As a data subject, you have the following rights under UK GDPR. To exercise any right, contact: support@blacklistglobal.co.uk

Right to Access
Request a full copy of data we hold about you. Responded to within 30 days at no cost.
Right to Rectification
Dispute and correct inaccurate entries. Formal review within 14 business days.
Right to Erasure
Request deletion where no legal obligation requires retention (Art. 17).
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interest, including profiling.
Right to Restrict
Request restriction of processing pending a dispute or review.

You also have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

8.

Cookies & Tracking

Essential cookies: Required for authentication, security, and core platform functionality
Analytics cookies: Used to understand platform usage and improve performance (opt-out available)
Fraud prevention: IP and device fingerprinting for security monitoring

You can control cookies through your browser settings. Disabling essential cookies may impair platform functionality. We do not use third-party advertising cookies.

9.

International Data Transfers

Some of our service providers may process data outside the UK. Where transfers occur, we ensure appropriate safeguards are in place, including:

UK International Data Transfer Agreements (IDTAs)
Adequacy decisions by the UK Government
Standard Contractual Clauses (SCCs) where applicable
10.

Security

AES-256 encryption for all data at rest
TLS 1.3 for all data in transit
Role-based access controls and multi-factor authentication
Quarterly penetration testing by certified third-party security firms
99.9% uptime SLA with real-time incident monitoring

No transmission over the internet is 100% secure. We employ all reasonable and industry-standard measures to protect your data. In the event of a breach affecting your rights, we will notify you and the ICO within 72 hours as required by UK GDPR Article 33.

11.

Children's Privacy

Our services are directed exclusively at businesses (B2B) and individuals aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us immediately.

12.

Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified by email to registered partners and/or via a prominent notice on the platform. The "Last Updated" date at the top of this document reflects the most recent revision. Continued use of the Platform after changes constitutes acceptance.

13.

Contact & Data Protection Enquiries

Data Protection Contact
Phone: +44 7897 017709
Entity: Blacklist Global Ltd, UK
ICO Reg: ZB956879
Regulator
Authority: Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113