Privacy Notice

1. Who we are

RecoverAble Solutions Ltd t/a RecoverAble Locate, company number 13234996, VAT registration 372 9439 63.

• Registered office: Downsview House, 141–143 Station Road East, Oxted, United Kingdom, RH8 0QE
• Head and operating office: Airivo Chislehurst, 1 Bromley Lane, Chislehurst, BR7 6LH
• Privacy contact: enquiry@recoverablesolutions.co.uk

RecoverAble Locate is a trading name of RecoverAble Solutions Ltd. It is not a separate legal entity. We are the data controller for your account, billing and service records, and a processor for the tracing data you submit.

RecoverAble Solutions Ltd is registered with the Information Commissioner's Office (ICO).

2. Who is responsible for what

• We are an independent controller for account and user data, contract administration, payments and invoices, security and audit, fraud and misuse prevention, legal and compliance records, marketing choices and general business administration.
• We are a processor for Trace Subject data only to the extent we act solely on our business customer's documented tracing instruction, under the Data Processing Schedule in our Terms of Business.
• We are an independent controller where we determine a separate purpose of our own — for example a legal obligation, the security of the service, misuse prevention or defending a legal claim.
• TransUnion International UK Limited is an independent controller for the personal data it processes under the contracted trace service, under its own Bureau Privacy Notice. It is not our sub-processor for that service.

The service is business-to-business only and is not offered to consumers.

3. Customer and user data we hold

• name, email address, organisation and plan;
• subscription and payment references (never the raw card number);
• invoices, VAT and transaction records;
• authentication and sign-in metadata;
• IP address, device and browser information;
• audit records and records of the terms and privacy versions you accepted;
• upload history and account activity;
• support and compliance correspondence;
• your marketing choice.

4. Trace Subject data we process

• the customer's own reference;
• title, name, forename, other names and surname;
• date of birth where provided;
• current, previous and last-known addresses and postcode;
• trace match, address, address-history and related tracing information returned by TransUnion where relevant;
• match confidence and processing status;
• our interpretation and next-step guidance.

Special-category data and criminal-offence data are not intended to be submitted through the standard service and customers are contractually prohibited from doing so without our prior authorisation.

5. Where the data comes from

• our business customer and its authorised users;
• the CSV files customers upload;
• TransUnion tracing and bureau data, and the permitted source datasets TransUnion uses;
• authentication, security and technical logs;
• direct correspondence with us.

6. Purposes and lawful bases

For customer and account data, where we are the controller:

• performance of a contract, or steps before entering one: creating your account, taking payment, providing the service and giving you access to reports and invoices;
• legal obligation: accounting, VAT and tax records, and responding to regulators, courts and law enforcement;
• legitimate interests: security, fraud and misuse prevention, audit, service improvement, defending legal claims, protecting our supplier and platform, and business administration — carried out only after balancing our interests against your rights;
• consent: optional product-update emails, which you can withdraw at any time.

For Trace Subject data, the customer is responsible for identifying and documenting its own lawful basis and for meeting or lawfully excluding transparency obligations. Our acceptance of an upload does not provide the customer with a lawful basis.

7. TransUnion — our tracing data supplier

Our tracing data supplier is TransUnion International UK Limited, company number 03961870, One Park Lane, Leeds, West Yorkshire, LS3 1EP.

How the data flows: the business customer instructs RecoverAble Solutions; we receive the trace identifiers; we send only the data necessary for the trace to TransUnion; TransUnion performs the contracted trace; TransUnion returns the permitted output to us; we create our own RecoverAble Locate Report for the customer.

For this contracted trace service, TransUnion International UK Limited is an independent controller for the personal data it processes under the service, under its own Bureau Privacy Notice. TransUnion is not our sub-processor for that processing. The business customer authorises this disclosure and flow when it submits a trace, and must have its own lawful basis, authority and transparency position in place before submission.

TransUnion's Bureau Privacy Notice expressly covers tracing for debt collection and asset reunification purposes. It also states that client-supplied service data may be retained by TransUnion for up to 15 months for investigating and restoring data or system issues and for handling complaints, claims and enquiries. That retention is controlled by TransUnion and is separate from our own retention periods. TransUnion's notice also explains that data may sometimes be sent to other countries, including outside the EU, subject to the safeguards it describes.

Individuals can exercise TransUnion-specific rights, including access and correction of bureau data, directly through TransUnion's Privacy Centre and consumer enquiry routes:

• TransUnion UK website
• TransUnion Privacy Centre
• TransUnion Bureau Privacy Notice
• TransUnion Retriever tracing product

8. Other recipients

• Trust Payments, for card payment processing once live payment is enabled;
• our cloud database, authentication and secure storage infrastructure provider;
• our approved email delivery provider, once operational;
• professional advisers, accountants, auditors, insurers and cyber-security providers;
• courts, regulators and law enforcement where we are legally required or permitted to disclose;
• a purchaser or successor in a corporate transaction, under confidentiality obligations.

We do not sell customer data or Trace Subject data.

9. International transfers

Some suppliers, including TransUnion group companies and infrastructure providers, may process data outside the United Kingdom. Where we are responsible for a transfer, we rely on a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard, as applicable.

Where TransUnion processes as a controller in its own right, its international transfers are explained in its Bureau Privacy Notice, linked above.

10. How long we keep data

• Abandoned calculator or checkout enquiry records: 12 months, unless needed for fraud prevention or a legal claim. Marketing contact only where consent was given.
• Raw uploaded Trace Subject input and working supplier-response data: normally up to 12 months after the report is completed, then securely deleted or irreversibly anonymised, unless a dispute, legal or regulatory hold, security investigation, customer instruction or law requires longer.
• Completed Locate Reports: available in your account for up to 12 months from completion, then removed from the active service unless a legal hold or contractual dispute requires limited retention. Please download anything you need for your own retention obligations.
• Failed or temporary upload and validation data that never becomes an accepted trace: deleted promptly and no later than 30 days.
• Account and customer relationship data: for the active relationship and up to 6 years afterwards where needed for contractual or legal claims.
• Invoices, VAT, accounting and transaction records, and binding terms-acceptance and audit records: 6 years, or longer where law or an investigation requires.
• Marketing consent and suppression records: only as long as needed to evidence and respect your preference.
• TransUnion's own retention is separately controlled by TransUnion; its current Bureau Privacy Notice states client-supplied data may be held for up to 15 months.

These periods are enforced by a scheduled, idempotent and audited housekeeping process inside the service. Financial, tax and legal audit records are never deleted at the 12-month point.

11. Information for Trace Subjects

If your details were submitted to us for tracing, the business that submitted them is the controller for that tracing and decides the purpose. Under UK GDPR that business is responsible for providing you with privacy information under Articles 13 and 14 where required, and for assessing and documenting any lawful exemption it relies on.

We do not contact Trace Subjects as part of the service. Where we are the controller for a separate purpose, such as security or legal claims, we will provide transparency information or rely on a lawful exemption where one applies.

If you contact us at enquiry@recoverablesolutions.co.uk we will, where we act as processor, pass your request to the relevant customer and assist them in responding.

12. Your rights

Subject to the conditions in UK data protection law, you have the right to access your personal data, to have inaccurate data corrected, to erasure, to restriction of processing, to object to processing, to data portability where applicable, and to withdraw consent at any time where processing is based on consent.

Where we act as processor for tracing data, we may need to pass your request to our customer as controller. Rights relating to TransUnion's own bureau data may need to be exercised with TransUnion through its Privacy Centre.

To exercise a right, contact enquiry@recoverablesolutions.co.uk. You can also complain to the Information Commissioner's Office:

• Make a complaint to the ICO

13. Automated processing and AI

We may use automated and AI-assisted tools to structure, summarise and map trace information into the interpretation and guidance in a Locate Report. We do not make decisions based solely on automated processing that have legal or similarly significant effects on a Trace Subject. Our customer is responsible for human review and for any downstream decision.

14. Security

We use measures appropriate to the sensitivity of the data, including:

• authenticated account access with one-time email sign-in links;
• row-level database isolation so a customer can only reach its own records;
• private document storage with short-lived signed download links issued only after an ownership check;
• server-side handling of all secrets and credentials;
• audit logging of acceptance, access-control and misuse events;
• restricted internal access on a need-to-know basis;
• secure hand-off to Trust Payments, with no raw card details stored by us.

No system can be guaranteed to be completely secure. We keep our measures under review and will notify affected parties and regulators where the law requires.

15. Cookies and analytics

We use essential cookies and browser storage needed for sign-in, session security and the basic operation of the service. We do not use analytics tools, and we use no third-party tracking other than the optional Google Ads measurement described below.

Optional Google Ads measurement. On our bulk tracing page you can choose “Allow measurement” or “No thanks”. It is off unless you choose to allow it, and we store only your choice, when you made it and the version of this notice in your browser. If you allow it, that browser loads the Google Ads tag, provided by Google, on that page and on our payment confirmation page. Google may set advertising cookies so we can count whether an ad click led to a paid order. For a confirmed paid order we send Google only an order reference, the order value excluding VAT and the currency. We do not send your name, email address, payment details or any details of the people you ask us to trace, and we do not use this for ad personalisation or remarketing. Google may process this data outside the UK under its own terms. Our lawful basis is your consent. You can withdraw it at any time by choosing “Ad measurement choices” then “No thanks” at the foot of the bulk tracing page, which stops further measurement in that browser.

16. Children

Account users must be 18 or over. The standard service must not knowingly be used to trace a child, except where doing so is lawful, necessary, permitted by our supplier and expressly authorised by us in advance.

17. Changes, contact and complaints

This notice is version 2026-10-21-privacy-v2.2, effective 21 October 2026. We will update it when our processing changes and will publish the revised version here.

Questions, requests and complaints: enquiry@recoverablesolutions.co.uk, or write to us at Airivo Chislehurst, 1 Bromley Lane, Chislehurst, BR7 6LH. You may also complain to the ICO using the link above.