Privacy Notice
This Privacy Notice explains how Ullr Intelligence Ltd (“we”, “us”, “our”) collects, uses and protects your personal data. It applies when you engage our desk-based private investigation services, or when we process personal data about you during an investigation instructed by one of our clients.
1. Who we are
- Data controller: Ullr Intelligence Ltd (registered in England & Wales, company no. 17117362)
- Registered office: Prime Apartments, 483 Green Lanes, London N13 4FG
- Email: info@ullrintelligence.co.uk
- Website: www.ullrintelligence.co.uk
- Director: David Nelson
- ICO registration: registered with the Information Commissioner’s Office as a data controller, registration number ZC197792.
We are a UK-registered company providing professional desk-based private investigation and intelligence services.
2. What personal data we collect
- Client data: name, contact details, billing information and case instructions.
- Data-subject data: name, address history, date of birth, employment, financial information, public records and open-source intelligence (OSINT) lawfully obtained during investigations.
- Special category or criminal-convictions data: only where strictly necessary and with appropriate safeguards, including an Appropriate Policy Document (DPA 2018 Schedule 1) where required.
3. How we use your data and our lawful bases
- Providing investigation services to clients: contract and/or legitimate interests (supported by legitimate-interests assessments).
- Legal obligations: for example tax, accounting and responding to data-subject requests.
- Improving our services: legitimate interests, with appropriate balancing.
We do not sell personal data, and we do not use solely automated decision-making with legal or similarly significant effects.
4. Use of AI tools and technology
We use AI tools at two stages of our work: to assist with the analysis and structuring of open-source intelligence, and to assist with producing the written report from the record of that research. This is done under our legitimate interests in delivering efficient, high-quality investigative services, or on your consent where the work is carried out at your request. We apply strict data minimisation. We do not deliberately enter special category or criminal offence data into AI tools as a query, instruction, or supporting context. Where material capable of revealing such data arises by inference within a completed matter record used only for report production, that processing is controlled under our internal AI and data-protection assessments and Appropriate Policy Document. The AI does not make investigative decisions — every material finding is verified by the investigator against its original source before it is relied upon. Our AI processor (xAI / Grok, used via the Hermes agent) is based in the United States and is engaged under written data protection terms incorporating the Standard Contractual Clauses and the UK Addendum. This processing is assessed in our Legitimate Interests Assessments and Transfer Risk Assessments, which are available on request.
4a. Breach and exposure checking
Where an enquiry requires it, and where we have a documented lawful basis to do so, we may check whether an identifier such as an email address or telephone number appears in known data breaches or leaks. We do this by submitting the single identifier to specialist providers based in the European Union, Australia and the United States. What we record is which breach an identifier appears in, its date, and the type of data that breach exposed. Where any password or credential material is returned to us, we assess it and discard it; we never store it, reproduce it in a report, or test it against any account. Where this checking is carried out on your consent, we will tell you about these transfers and their risks before you decide, and you may decline this element while the rest of the enquiry continues. These transfers are assessed in our Transfer Risk Assessments, which are available on request.
5. Investigations and transparency
Due to the nature of private investigation work, there may be circumstances where providing full information to a data subject at the time of collection would prejudice the investigation. In such cases we rely on applicable exemptions under UK GDPR and the Data Protection Act 2018.
6. Data sharing
We may share personal data with trusted sub-contractors under strict confidentiality agreements, professional advisers, secure service providers, or law enforcement and regulators where legally required. We also transfer personal data to the AI processor described at section 4 and, where breach checking is carried out, to the providers described at section 4a. All such transfers are governed by written data protection terms and, where the destination is outside the UK and not covered by adequacy, by the Standard Contractual Clauses and the UK Addendum or, exceptionally and only with your explicit informed consent, by a derogation under Article 49.
7. How long we keep your data
We retain client engagement records for 7 years and investigation case files and reports for 6 years as per our Data Retention and Deletion Policy, or longer if required by law or to defend legal claims.
8. Your rights
You have rights under UK GDPR, including access, rectification, erasure, restriction, portability and objection. You can also complain to the ICO at ico.org.uk. To exercise your rights, contact us using the details above.
9. Changes to this notice
We may update this Privacy Notice from time to time. The current version is always available on our website.