Privacy Policy

This policy explains what personal information RTBF.uk collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We have tried to write it in plain English rather than legal shorthand. If anything is unclear, please ask us.

1. Who we are

RTBF.uk is a Right to Be Forgotten consultancy operating in the United Kingdom. We are the data controller for the personal information described in this policy, which means we decide why and how it is used.

• Trading name: RTBF.uk
• Registered entity: RTBF UK
• Email: hello@rtbf.uk
• ICO registration: Pending

2. The short version

We collect only what we need to assess and handle a Right to Be Forgotten request. We do not sell your data. We do not use it for advertising. We share it with search engines only where you have instructed us to submit a request on your behalf, and with our service providers only where necessary to run the practice. We keep enquiries we do not take forward for a limited period and then delete them.

3. Information we collect

Information you give us

• Your name, email address and, optionally, a telephone number
• A description of the content you want delisted, including URLs and the search terms affected
• Whether you have previously submitted a Right to Be Forgotten request
• Whether your enquiry relates to a criminal conviction, and any context you choose to provide
• Identity verification documents, where a search engine requires them as part of a submission
• Correspondence between us, including emails and file notes

Information we collect automatically

• Standard server logs (IP address, browser type, pages requested) generated by our hosting provider for security and availability purposes
• Aggregate, non-identifying visit statistics — see section 12 on cookies

We do not ask for information we do not need. In particular, we ask for the minimum detail about any criminal matter at the enquiry stage; fuller detail is only requested once we have agreed to act on your behalf.

4. Sensitive information: criminal offence data

Information about criminal convictions and offences is treated as a special category of personal data under Article 10 UK GDPR and the Data Protection Act 2018. It receives stronger protection than ordinary personal data, and we handle it accordingly.

We process this information only where you have provided it to us voluntarily in connection with a potential or actual Right to Be Forgotten request, and we rely on:

• Your explicit consent, given when you submit an enquiry or engage us; and/or
• the establishment, exercise or defence of legal claims condition under Schedule 1 of the Data Protection Act 2018, where we are preparing or pursuing a delisting request on your behalf.

We maintain an appropriate policy document covering this processing, as required by Schedule 1 Part 4 of the Act, and will provide a copy on request. You can withdraw consent at any time (see section 10), though doing so may mean we can no longer act for you.

Access to criminal offence data is restricted to those working directly on your matter. It is not recorded in general correspondence, not discussed with third parties beyond those named in section 7, and not retained beyond the periods in section 9. Importantly, you should be reassured that we delete any criminal record data you provide us from electronic systems 6 weeks after conclusion of our business with you.

5. Lawful bases for processing

Under Article 6 UK GDPR we rely on the following bases:

• Contract — to provide our services to you once engaged
• Legitimate interests — to respond to enquiries, run and secure our business, and keep basic records; we have assessed that these interests are not overridden by your rights
• Legal obligation — for tax, accounting and record-keeping duties
• Consent — for the processing of criminal offence data, and for any optional communications

6. How we use your information

• To respond to your enquiry and give an initial view on eligibility
• To assess your case against the criteria applied by search engines
• To prepare and submit Right to Be Forgotten requests on your behalf
• To communicate with you about progress, outcomes and next steps
• To prepare complaints to the Information Commissioner's Office where instructed
• To maintain financial and business records
• To detect and prevent misuse of our services

We do not use your information for automated decision-making or profiling, and we do not sell it to anyone.

7. Who we share it with

We share personal information only where necessary:

• Search engines — Google, Microsoft (Bing) and Yahoo, where you have instructed us to submit a request. Their handling of the information is governed by their own privacy policies.
• The Information Commissioner's Office — where you have instructed us to make a complaint.
• Service providers — our hosting provider, email provider and form-processing provider, each acting under a written contract that requires them to protect your data and use it only on our instructions.
• Professional advisers — our accountant, and legal advisers where a matter requires it.
• Legal requirements — where we are required by law or by a competent authority to disclose information.

We never share your information for marketing purposes.

8. International transfers

Our own systems are hosted in the United Kingdom. Some transfers outside the UK may occur where a request is submitted to a search engine established outside the UK, or where a service provider processes data on our behalf in another country. Where this happens, we ensure a lawful transfer mechanism is in place — normally the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses — and that appropriate safeguards apply.

9. How long we keep it

• Enquiries we do not take forward: up to 3 months, then deleted
• Client matter files: 6 years after the matter closes, to deal with any later query or claim. We remove identifying criminal record information from our electronic systems 6 weeks after conclusion of our business with a customer.
• Financial and tax records: 6 years, as required by law
• Website server logs: 30 days, unless needed to investigate a security incident

Where a retention period expires, information is securely deleted or anonymised.

10. Your rights

You have the right to:

• Be informed about how we use your information — this policy does that
• Access a copy of the personal information we hold about you
• Rectify information that is inaccurate or incomplete
• Erase information where there is no good reason for us to continue processing it
• Restrict processing while a concern is investigated
• Object to processing based on legitimate interests
• Data portability — to receive information you gave us in a structured, machine-readable format
• Withdraw consent at any time, where consent is the basis for processing

To exercise any of these, email hello@rtbf.uk. We will respond within one month, and will not charge a fee unless a request is manifestly unfounded or repetitive.

Note that the right to erasure is not absolute: we may need to retain limited records to comply with the law or to establish or defend legal claims.

11. Security

We use encryption in transit across the site, restrict access to client information to those working on the matter, require strong authentication on our accounts, and review our arrangements periodically. No system is perfectly secure; if a breach occurs that is likely to result in a risk to your rights, we will notify you and the ICO as required.

12. Cookies and analytics

This site does not set advertising or tracking cookies, and we do not use third-party analytics that profile you across sites. We use a privacy-focused, cookie-free analytics service to understand aggregate page views. Because no non-essential cookies are set, no cookie banner is required.

Google Fonts are loaded from Google's servers, which means Google receives your IP address when a page loads. If you prefer to avoid this, we can switch to locally hosted fonts on request.

13. Children

Our services are intended for adults. We do not knowingly collect information about anyone under 18. If you believe we have, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised. Material changes will be highlighted on this page.

15. Complaints

If you are unhappy with how we have handled your information, please contact us first — we would like the chance to put it right.

You also have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF