Privacy Policy

Review International Ltd ("Review International", "we", "us", or "our") is a company registered in England and Wales under company number 16987288, with its registered office at:

Review International owns and operates the COMMANCHOR platform. COMMANCHOR is a proprietary product of Review International Ltd and provides the Commercial Passport, enabling businesses and professionals to build, verify, manage, and share trusted commercial reputations.

This Privacy Policy explains how Review International collects, uses, stores, shares, retains, and otherwise processes personal data in connection with the COMMANCHOR platform and related verification services. It also explains your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection laws.

For the purposes of applicable data protection legislation, Review International Ltd is the Data Controller in relation to the personal data described in this Privacy Policy.

If you have any questions about this Privacy Policy or how we process personal data, please contact us at: [email protected]

Review International Ltd has not appointed a Data Protection Officer because it is not required to do so under applicable law. Privacy enquiries should be directed to the contact details above.

This Privacy Policy should be read together with our Terms of Service, Cookie Policy, and any other policies published on the COMMANCHOR platform.

This Privacy Policy applies to personal data processed by Review International in relation to:

• individuals who create, manage, or use a Business Account or Professional Account on the COMMANCHOR platform;
• businesses and organisations that use the COMMANCHOR platform through their authorised representatives;
• referees and recommenders who are invited to submit References or Recommendations;
• individuals whose personal data is submitted as part of the verification process or supporting documentation;
• authorised viewers of COMMANCHOR (Commercial Passport) profiles; and
• visitors who browse the COMMANCHOR website or otherwise interact with our services.

We use personal data for the following purposes:

• Creating and managing Business and Professional Accounts: Performance of a contract.
• Operating and maintaining COMMANCHOR: Performance of a contract.
• Collecting References and Recommendations: Performance of a contract (in relation to account holders) and Legitimate Interests (in relation to referees and recommenders).
• Verifying identities, commercial or professional relationships, and supporting evidence: Performance of a contract and Legitimate Interests.
• Providing verification services and COMMANCHOR: Performance of a contract.
• Managing subscriptions, verification credits, and payments: Performance of a contract.
• Communicating with users and providing customer support: Performance of a contract and Legitimate Interests.
• Preventing fraud, misuse, and Platform abuse: Legitimate Interests.
• Maintaining Platform security, audit logs, and system integrity: Legitimate Interests.
• Improving the Platform and developing new services: Legitimate Interests.
• Complying with legal and regulatory obligations: Legal Obligation.
• Establishing, exercising, or defending legal claims: Legitimate Interests and Legal Obligation.

Where we rely on Legitimate Interests, those interests include operating and protecting a trustworthy, transparent, and verifiable commercial reputation system, preventing fraud, maintaining Platform security, improving our services, and supporting legitimate commercial due diligence. We have assessed that these interests are not overridden by the rights and freedoms of the individuals whose personal data we process.

Referees and recommenders provide References or Recommendations about an account holder while also providing personal information about themselves.

Accordingly:

• Referees and recommenders are informed before submitting a Reference or Recommendation that it may become part of a published COMMANCHOR.
• Referees and recommenders may request access to the personal data we hold about them.
• Referees and recommenders may request correction of inaccurate personal information relating to themselves.
• Referees and recommenders may object to the processing of their personal data or request restriction of processing, subject to applicable law.
• Referees and recommenders may request that their name or other identifying information be withheld or anonymised where appropriate.

Requests to remove, anonymise, or otherwise restrict the publication of referee or recommender information are considered on a case-by-case basis. We may refuse such a request where continued processing or publication is necessary to preserve the integrity, accuracy, evidential value, or legitimate purpose of a COMMANCHOR, to comply with a legal obligation, to establish, exercise, or defend legal claims, or where we have another lawful basis for continuing to process the information.

We do not use referee or recommender personal data for unrelated direct marketing purposes.

COMMANCHOR is designed to present a fair, balanced, and transparent record of verified commercial and professional trust.

Accordingly:

• References and Recommendations may be filtered using objective criteria, such as industry, geography, relationship type, category, or date.
• Any filtered or audience-specific COMMANCHOR will clearly indicate that it represents only a selected portion of the user's complete trust record.
• References and Recommendations must not be selectively displayed for the purpose of creating a false or misleading impression of the user's commercial or professional reputation.
• The total number of verified References and verified Recommendations will remain visible on every COMMANCHOR, including filtered versions.
• An authorised Viewer may request access to the user's complete COMMANCHOR. Access remains subject to the account holder's consent, applicable privacy settings, and any legal or regulatory requirements.

We do not sell personal data.

We may share personal data where necessary with:

• cloud hosting and infrastructure providers;
• authentication providers, including Google where Google Sign-In is used;
• payment processors and billing providers;
• email, messaging, and communication service providers;
• identity verification providers;
• verification partners acting on behalf of Review International;
• professional advisers, including lawyers, accountants, auditors, and insurers;
• regulatory authorities, law enforcement agencies, courts, or other public authorities where required or permitted by law;
• service providers who support the operation, security, maintenance, or development of the Platform; and
• prospective purchasers, investors, or successors in connection with a merger, acquisition, investment, or other business transfer, subject to appropriate confidentiality obligations.

All third-party service providers and verification partners are required to process personal data only on our instructions where applicable, maintain appropriate security measures, and comply with applicable data protection laws.

Review International operates internationally. Personal data may be processed in the United Kingdom and in other countries where Review International, its verification partners, service providers, account holders, referees, recommenders, or authorised Viewers are located.

Where personal data is transferred outside the United Kingdom to a country that is not subject to a UK adequacy decision, Review International will implement appropriate safeguards in accordance with applicable data protection law. These safeguards may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism recognised by the Information Commissioner's Office.

Further information about international data transfers and the safeguards we apply is available upon request.

COMMANCHOR uses essential cookies and similar technologies that are necessary for the secure operation of the Platform.

These technologies may be used to:

• maintain secure user sessions;
• authenticate users, including through Google Sign-In;
• protect against fraudulent or unauthorised access;
• remember essential user preferences; and
• support the core functionality, security, and reliability of the Platform.

Because these cookies are strictly necessary for the operation of COMMANCHOR, they do not require consent under applicable law. If you disable or block these cookies through your browser settings, some parts of the Platform may not function correctly.

If Review International introduces analytics, performance, functionality, advertising, or marketing cookies in the future, we will update this Privacy Policy and, where required by applicable law, obtain your consent before placing those cookies on your device.

Review International retains personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, prevent fraud, enforce our agreements, and protect the integrity of COMMANCHOR.

Typical retention periods include:

• Account information: For as long as the account remains active and for a reasonable period afterwards where necessary for legal, regulatory, administrative, or security purposes.
• References, Recommendations, and verified trust records: For as long as they form part of a COMMANCHOR or are otherwise retained in accordance with our legal obligations, legitimate interests, or this Privacy Policy.
• Verification records and supporting documentation: For as long as reasonably necessary to demonstrate the integrity of the verification process, comply with legal obligations, resolve disputes, or prevent fraud.
• Billing and payment records: Normally six years in accordance with UK tax and accounting requirements.
• Security, audit, and system logs: For as long as reasonably necessary to maintain Platform security, investigate misuse, comply with legal obligations, or protect the integrity of COMMANCHOR.

When personal data is no longer required, we will securely delete, anonymise, or otherwise dispose of it in accordance with applicable law.

Under applicable data protection law, including the UK GDPR, you may have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data where applicable;
• request restriction of processing in certain circumstances;
• object to processing based on our legitimate interests;
• request the transfer of your personal data to you or another organisation where the right to data portability applies; and
• withdraw your consent at any time where consent is the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise any of these rights, please contact us at: [email protected]

We will normally respond to your request within one month, although this period may be extended where permitted by applicable law.

If you are dissatisfied with the way we have handled your personal data or your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

COMMANCHOR uses automated tools to assist with fraud detection, identity verification, risk assessment, and the operation of the Platform.

Review International does not make decisions that produce legal or similarly significant effects solely through automated processing. Decisions relating to verification, publication, suspension, or other significant actions are subject to appropriate human review and oversight.

COMMANCHOR is intended solely for businesses, professionals, and other users aged 18 years or over.

We do not knowingly collect or process personal data relating to anyone under the age of 18. If we become aware that personal data relating to a person under the age of 18 has been collected through the Platform, we will take reasonable steps to delete that information or otherwise process it in accordance with applicable law.

Review International implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration, or disclosure.

These measures include:

• secure authentication;
• encryption of data in transit;
• encryption of stored data where appropriate;
• role-based access controls;
• audit logging;
• regular system backups;
• monitoring and security measures designed to prevent unauthorised access, alteration, disclosure, or loss of personal data; and
• periodic review of our security practices.

While no method of transmission over the internet or electronic storage can be guaranteed to be completely secure, Review International takes reasonable steps to protect the personal data it processes.

Where required by applicable law, Review International will notify the Information Commissioner's Office and affected individuals of a personal data breach in accordance with its legal obligations.

Review International may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements, our services, or the way we process personal data.

Where changes are material, we will provide reasonable notice before they take effect where required by applicable law.

The latest version of this Privacy Policy will always be published on the COMMANCHOR website and will include the date of its most recent revision. Continued use of the Platform after the updated Privacy Policy takes effect constitutes acknowledgement of the revised Privacy Policy.

If you have any questions about this Privacy Policy, your personal data, or the way Review International processes personal information, please contact us using the details below:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection, if you believe that your personal data has been processed unlawfully.