Privacy Policy

Who We Are

Ebis Risk Services Limited is registered in England and Wales under company number 05728189. Our registered office is Level 5A, Maple House, 149 Tottenham Court Road, London W1T 7NF.

For the purposes of applicable data protection legislation, including the UK GDPR and the Data Protection Act 2018, Ebis may act as a controller of personal information processed in connection with this website, enquiries and professional engagements.

Ebis Risk Services Limited has not appointed a statutory Data Protection Officer. Responsibility for data protection compliance rests with the Company's management. Privacy enquiries and data protection requests should be submitted using the contact details set out in this policy.

Scope of This Policy

This policy explains how we may process personal information obtained through this website, telephone and email enquiries, prospective client discussions, professional engagements, business relationships and other lawful sources.

Because Ebis undertakes investigative, intelligence, due diligence, dispute support, asset tracing and risk advisory work, we may receive or obtain information about individuals indirectly, including from clients, professional advisers, public records, corporate records, litigation material, regulatory sources, counterparties and open-source material.

Information We May Process

The personal information we process will depend on the matter. It may include names, contact details, employer or organisation details, professional roles, business relationships, correspondence, instructions, public record information, corporate affiliations, financial or asset-related information, litigation or dispute material and information relevant to an enquiry or assignment.

We do not operate user accounts, newsletter subscriptions or behavioural advertising on this website.

Website Enquiries and Forms

Where you submit information through a contact form, complaint form or other enquiry mechanism on this website, we will process the information you provide in order to respond to your enquiry, administer and investigate complaints, maintain appropriate records, protect our legal rights and interests, and comply with applicable legal and regulatory obligations.

Information submitted through this website is securely transmitted to our website form processing provider, Formspree, which processes submissions on our behalf before delivering them to Ebis Risk Services Limited.

Routine website enquiries that do not result in a professional engagement are normally retained for up to 12 months after our last meaningful contact and are then securely deleted. Where an enquiry results in a professional instruction, the information becomes part of the relevant client file and is retained in accordance with our client record retention arrangements.

Information about cookies and similar technologies is provided in our Cookie Policy.

When you visit this website, our hosting, security and website service providers may automatically record technical information relating to your visit, including your IP address, browser type, device information, pages requested, dates and times of access and similar technical data. We use this information for the security, operation, maintenance and protection of the website, to investigate misuse or unlawful activity, and to diagnose technical issues.

How We Use Personal Information

We may use personal information to assess enquiries, undertake conflict and risk checks, establish and manage client relationships, provide professional services, conduct investigations, support due diligence, asset tracing, dispute support, intelligence gathering, fraud and misconduct matters, sanctions or integrity enquiries and related advisory work.

We may also process personal information to manage our business, maintain records, protect legal rights, comply with legal and regulatory obligations, prevent fraud and ensure the security of our systems and communications.

Lawful Bases

Depending on the circumstances, we may process personal information where it is necessary for legitimate interests, for the performance of a contract or steps prior to entering into a contract, to comply with legal obligations, with consent, or on another lawful basis available under applicable data protection legislation.

Our legitimate interests may include assessing and responding to enquiries, providing professional services, supporting clients and professional advisers, investigating and assessing risk, protecting rights and interests, preventing fraud and maintaining appropriate business records.

Special Category and Sensitive Information

Some matters may involve special category data, criminal offence data or other sensitive information. We only process such information where a lawful basis and applicable condition are available, including where necessary for the establishment, exercise or defence of legal claims, substantial public interest purposes, regulatory compliance, consent or other grounds permitted by law.

Information Obtained Indirectly

In many professional assignments, information is not collected directly from the individual concerned. Where information is obtained indirectly, we consider the transparency requirements and exemptions that may apply under data protection law, including circumstances where providing notice would prejudice an investigation, legal rights, regulatory purposes or other legitimate interests recognised by law.

Sharing Information

We may share personal information with clients, legal advisers, insurers, investigators, analysts, professional advisers, website hosting providers, website form processing providers, IT service providers, courts, regulators, law enforcement agencies or other parties where reasonably necessary for professional purposes or required by law.

We disclose personal information only where necessary for our professional services, our legitimate business activities, compliance with legal obligations, or where otherwise permitted or required by law.

International Transfers

Some assignments and certain technology service providers may involve the processing of personal information outside the United Kingdom. Where personal information is transferred internationally, we will ensure that appropriate safeguards recognised under applicable UK data protection legislation are used where required by law.

Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was processed, including professional, legal, regulatory, insurance, risk management and record-keeping purposes.

Routine website enquiries that do not result in a professional engagement are normally retained for up to 12 months after our last meaningful contact before being securely deleted.

Data protection complaints are retained separately from routine enquiries in accordance with our complaints handling procedures.

Where an enquiry results in a professional instruction, the information becomes part of the relevant client file and is retained in accordance with our client record retention arrangements.

Security

We maintain reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, misuse or loss.

Your Rights

Individuals may have rights under applicable data protection legislation, including rights of access, rectification, erasure, restriction, objection and portability, subject to legal conditions and exemptions.

Where we receive a rights request, we may request information necessary to verify identity or clarify the scope of the request. Searches undertaken in response to requests will be reasonable and proportionate.

We will normally respond to rights requests within one month of receipt. Where permitted by law, this period may be extended where a request is particularly complex or multiple requests are received.

Data Protection Complaints

If you have concerns about how Ebis has handled your personal information, you may submit a data protection complaint through the Contact page on this website, by email to [email protected], or by post to our registered office.

We aim to acknowledge receipt of a data protection complaint within five working days and will investigate and respond without undue delay. We will keep complainants informed of progress where appropriate and provide an outcome once our review is complete.

If you remain dissatisfied, you have the right to complain to the Information Commission (formerly known as the Information Commissioner's Office (ICO)), the United Kingdom's independent regulator for data protection and information rights. Further information is available at www.ico.org.uk.

Contact

Privacy enquiries, rights requests and data protection complaints may be submitted through the Contact page on this website, by email to [email protected], or by post to our registered office.

Changes

This policy may be updated periodically. The current version will be published on this page.

Document Information

Version: 2.0

Effective Date: 1 August 2026

Last Reviewed: 1 August 2026