These Terms of Engagement (the Terms), the written quotation we issue and any document expressly incorporated into that quotation form the contract for an instruction (the Contract). By accepting a quotation in writing, paying any amount due under it or asking us to start work, you confirm that you have authority to bind the named customer and accept the Contract.

Please read sections 4, 13 and 14 carefully. They explain the limits of our services, the customer's responsibilities and the limits of liability.

1The parties

We, us and our mean Al Aksa Services Ltd, trading as Naval Row, a company registered in England and Wales under company number 11326948. Our registered office is 7 West India Dock Road, London E14 8EZ. Our contact email is enquiries@navalrow.co.uk.

You and your mean the business identified as the customer in the accepted quotation. The person accepting the quotation warrants that they are authorised to bind that business.

We provide the services as an independent contractor. Nothing in a Contract creates a partnership, joint venture, employment relationship, fiduciary relationship or general agency. If agreed, we may describe ourselves to a named third party as acting on your behalf for the limited purpose of making an enquiry or coordinating correspondence, but we have no authority to bind you or conclude a transaction for you.

2Contract formation and priority

You provide a brief and we issue a written quotation setting out the customer, scope, deliverable, fee, payment schedule, assumptions and target delivery date. A Contract begins only when that quotation is accepted and any payment required before commencement has cleared.

If documents conflict, the following order applies: any signed data-protection terms or international-transfer terms; the accepted quotation; these Terms. A quotation overrides these Terms only where it expressly identifies the provision being changed.

Proposals, estimates and discussions before acceptance are not binding. Each accepted quotation is a separate Contract unless it says otherwise.

3Services and scope

We provide only the work stated in the accepted quotation. Our current service categories are:

• UK supplier sourcing: identifying potential UK suppliers against an agreed brief, making agreed approaches and presenting information or responses obtained.
• UK supplier verification: reviewing defined public records and the visible business footprint of a named organisation, and reporting dated findings and risk observations. Any physical attendance must be separately stated and priced.
• UK market and prospect research: researching markets, organisations, business functions and legitimately available business contact information against agreed criteria.
• Retained UK desk: a defined monthly allocation of agreed research, sourcing, liaison and coordination support.

We do not purchase or resell goods, take title to goods, hold money for payment to suppliers, act as importer or exporter of record, provide customs brokerage or logistics, or become a party to a contract between you and a supplier unless a later written agreement expressly says otherwise.

Work outside the agreed scope requires a written variation or a new quotation. Unless expressly included, the services do not include mass marketing, automated outreach, product testing, site inspection, translation, regulated activity or professional advice.

4Nature and limits of the services

• No guarantee. We do not guarantee the identity, solvency, honesty, authority, ownership, capacity, product authenticity, legal compliance or future performance of any supplier, prospect, officer or other third party.
• Not formal due diligence. Supplier verification is a defined public-record and business-footprint review. It is not an audit, formal legal or financial due-diligence exercise, credit report, credit reference, valuation, certification, product inspection or assurance engagement.
• No professional advice. We do not provide legal, tax, accounting, investment, financial, insurance, medical, regulatory, customs or export-licensing advice. References to possible issues are prompts for you to obtain suitable professional advice.
• Third-party information. Public registers, websites, databases and third-party responses may be incomplete, delayed, inaccurate or later changed. We identify material limitations we encounter but do not warrant third-party information.
• Supplier responses. Quotations, availability, lead times, specifications and terms supplied by third parties remain theirs. You must confirm them directly before contracting or paying.
• No outcome promise. Sourcing and prospect research do not guarantee that a supplier will quote, that a prospect will respond or buy, or that a market-entry plan will succeed.

Unless the quotation expressly permits wider reliance, a deliverable is prepared for your internal business use and the purpose stated in the quotation. A third party may not rely on it. You may give it to your professional advisers on a confidential, non-reliance basis, but you remain responsible for how it is used.

5Customer responsibilities

You must:

• give us timely, accurate and complete instructions, specifications, company identifiers and other information reasonably required for the work;
• review assumptions and promptly tell us about errors, changes or special risks;
• use the services and deliverables only for a lawful business purpose and not to harass, discriminate against, deceive or intrude upon any person;
• make your own commercial decision and obtain legal, tax, regulatory, technical, product, credit, insurance, customs and trade-control advice where appropriate;
• before ordering, paying for, importing or using goods, verify the counterparty, contract terms, bank details, specifications, conformity, licences, insurance, shipping, customs treatment and destination-country requirements;
• not represent that a Naval Row report is a guarantee, certification, audit, credit reference or formal due-diligence opinion;
• handle any personal data in a deliverable lawfully, securely and only for a compatible business purpose; and
• comply with section 13 and provide ownership, end-use, destination and other compliance information we reasonably request.

We are not responsible for delay or error caused by incomplete, late or incorrect customer information. A target date moves by a reasonable period if your action or approval is late.

6Fees, taxes and payment

Website prices are guide prices only. The accepted quotation fixes the fee and settlement currency. If an amount is displayed in UAE dirhams but the quotation or invoice requires settlement in pounds sterling, the sterling amount stated in the quotation or invoice is due. Your bank or card provider controls any conversion it performs.

Unless the quotation states a different schedule:

• fixed-fee work below AED 3,000, or its quoted equivalent, is payable in full before work begins;
• fixed-fee work of AED 3,000 or more is payable 50% before work begins and 50% before release of the final deliverable;
• retained UK desk fees are payable monthly in advance; and
• an invoice expressly offering credit is due within 14 calendar days of its date.

Fees exclude VAT and agreed disbursements unless the quotation says otherwise. We add UK VAT only where it is chargeable. For general-rule services supplied to a business belonging outside the UK, the place of supply will normally be where the customer belongs, subject to evidence of business status and any applicable exception. You are responsible for any reverse charge, use tax, import tax or similar recipient-side obligation in your jurisdiction.

If law requires you to withhold tax, you must tell us before accepting the quotation, make only the legally required deduction, pay it to the correct authority and promptly provide an official certificate. Correspondent-bank fees, receiving-bank deductions and customer-side conversion charges are your responsibility, so the invoiced amount must reach us except for a withholding required by law.

Travel, paid searches, certified documents and other disbursements are charged only if stated in the quotation or approved by you in writing. We may suspend work or withhold a deliverable while an amount is overdue. We may exercise our statutory rights to interest, fixed compensation and reasonable recovery costs under the Late Payment of Commercial Debts (Interest) Act 1998 where it applies.

7Delivery, acceptance and changes

Delivery periods are measured in working days in England and begin on the later of acceptance, cleared initial payment and receipt of all information reasonably needed to start. A target delivery date is an estimate unless the quotation expressly states that time is of the essence.

If a public source is unavailable, a third party does not respond, the brief changes or another circumstance affects delivery, we will explain the material effect and provide a revised target date or options. We do not expand scope or incur extra fees without written approval.

You must review the deliverable promptly and tell us within 10 working days of any material failure to match the agreed scope. If it does not materially conform, our first obligation is to correct or re-perform the affected part within a reasonable time. This period does not remove any right that cannot lawfully be restricted.

8Cancellation and refunds

You may cancel a one-off instruction by email at any time before final delivery. We will refund prepaid fees after deducting:

• the reasonable proportion of the fixed fee attributable to work completed up to cancellation; and
• non-cancellable third-party costs that were included in the quotation or approved by you.

If no work has started and no approved cost has been committed, we will refund the prepaid fee in full. If completed work and committed costs equal or exceed the amount paid, no refund is due and any approved unpaid amount remains payable.

After a conforming final deliverable has been supplied, the fee is non-refundable. If we materially breach the Contract and do not correct the breach within a reasonable opportunity, you may end the affected Contract and receive a refund for the part of the service not properly supplied.

Refunds are made to the original payment method or originating account in the original settlement currency. We do not reimburse exchange-rate movements or third-party payment charges outside our control. Consumer cooling-off rights do not apply because we contract only with businesses.

9Retained UK desk

A retained UK desk covers only the monthly hours, activities, service times and priorities in the quotation. Time is recorded in reasonable increments. Unused time expires at the end of the month and does not carry forward or convert to cash unless the quotation expressly says otherwise. Work beyond the allocation requires approval and is charged at the quoted additional rate.

After any minimum term stated in the quotation, either party may end a retainer on 30 days' written notice. Fees for a monthly service period that has begun are not refunded merely because you use fewer hours, but if we end the retainer without your breach we refund the fair value of any prepaid service we will not provide.

10Confidentiality

Each party must keep the other party's non-public commercial, technical and financial information confidential and use it only for the Contract. This does not apply to information that the receiving party can show:

• was lawfully known without restriction before disclosure;
• is or becomes public other than through breach of the Contract;
• is lawfully received from a third party without a duty of confidence; or
• is independently developed without using the confidential information.

A party may disclose confidential information to personnel, professional advisers, insurers and subcontractors who need it and are bound by confidentiality, and where required by law, court or competent authority. Where lawful, the disclosing party will be given advance notice of a compelled disclosure.

We will not identify you to a supplier or prospect unless the agreed work reasonably requires it or you approve it. We may say that we act for an unnamed client. These duties last for five years after the Contract ends; duties concerning trade secrets continue while the information remains a trade secret.

11Intellectual property

Each party keeps ownership of materials and intellectual property it owned or developed independently of the Contract. You grant us a non-exclusive licence to use materials you supply only as needed to perform the Contract and confirm that our permitted use will not infringe another person's rights.

We retain ownership of our methods, know-how, research processes, templates, layouts, tools and generic material. When all fees for an instruction are paid, we grant you a perpetual, non-exclusive, non-transferable licence to use the final deliverable within your organisation for the purpose stated in the quotation. You may share it with professional advisers under section 4. You may not sell, publish, white-label or commercially redistribute it, or remove source, limitation or authorship notices, without our written permission.

Third-party records, quotations, logos and other third-party material remain subject to the rights of their owners. No Contract transfers rights in them.

12Data protection

Each party must comply with the data-protection and electronic-marketing law that applies to it. Unless a quotation or separate data-processing agreement expressly says otherwise, each party acts as an independent controller for personal data it determines to process for its own purposes.

We process personal data as described in the Privacy Notice. You must not send patient data, health information, passport copies, bank credentials, criminal-record information or other special-category or highly sensitive personal data unless we have first agreed the necessity, lawful basis, security method and written terms.

Where a deliverable contains business-contact or public-record personal data, you must:

• use it only for the lawful purpose stated in the quotation;
• establish and document your own lawful basis and provide privacy information where required;
• comply with applicable direct-marketing and communications rules, including opt-outs and preference-service screening;
• not use it for solely automated decisions producing legal or similarly significant effects without the safeguards required by law;
• keep it secure, restrict access and delete it when no longer needed; and
• not sell, publish or disclose it to another person except lawfully and for the agreed purpose.

If our performance would involve processing personal data solely on your documented instructions as a processor, the parties must put compliant processor terms in place before that processing begins.

If we initiate a restricted transfer of personal data to you outside the UK, we will use an available UK adequacy regulation, an applicable legal exception or appropriate safeguards. Where the International Data Transfer Agreement is the selected safeguard, the schedule at the end of these Terms applies. We will not make a restricted transfer where the requirements of UK data-protection law cannot be met.

13Sanctions, bribery and trade controls

Each party must comply with the anti-bribery, sanctions and export-control laws applicable to it and the instruction, including the Bribery Act 2010 where applicable. Neither party will offer, request, make or accept a bribe or facilitation payment in connection with the Contract.

You remain solely responsible for determining whether goods, software, technology, destinations, end users, end uses, payments or services require a licence, registration, filing or restriction, and for obtaining it. Our sourcing or research is not an export-control, customs or sanctions opinion.

You must promptly disclose any relevant destination, end use, ownership or control issue and provide information reasonably requested for screening. We may refuse, pause or end work where we reasonably consider that continuing could breach law, expose either party to enforcement risk, involve a designated or restricted person, or facilitate circumvention. We are not required to disclose confidential screening criteria or take any step prohibited by law.

If we end work under this section because of information you withheld, misrepresented or should reasonably have identified, fees for work done and approved committed costs remain payable. Otherwise, we refund prepaid fees for work we will not perform, unless law prohibits the refund.

14Liability

Subject to the paragraph above:

• our total aggregate liability arising out of or in connection with one Contract, whether in contract, tort (including negligence), breach of statutory duty, misrepresentation, restitution or otherwise, is limited to the greater of GBP 10,000 and 100% of the fees paid or payable under that Contract;
• for a rolling retainer, the fees used for that calculation are those paid or payable for the 12 months immediately before the event giving rise to the claim;
• we are not liable for loss of profit, revenue, sales, business, contract, opportunity, anticipated saving, goodwill or reputation, or for indirect or consequential loss;
• we are not liable for a supplier's, prospect's or other third party's act, omission, misrepresentation, insolvency, goods, services or failure, or for a transaction you decide to enter;
• we are not liable to the extent loss results from your breach, decision, delay, supplied information, failure to follow a stated limitation or recommendation, or use outside the agreed purpose; and
• we are not liable for information that was unavailable, inaccurate or not reasonably discoverable in the agreed sources at the relevant time, provided we performed the service with reasonable care and skill.

The exclusions apply whether the relevant loss is direct or indirect where that is stated. Nothing in this section excludes your obligation to pay fees properly due. Each party must take reasonable steps to mitigate loss.

The fee and liability allocation reflect the limited, research-based nature of the service. If you require a higher cap, ask before acceptance; any different cap and fee must be expressly stated in the quotation.

15Suspension and termination

Either party may terminate a Contract immediately by written notice if the other:

• commits a material breach that cannot be remedied, or fails to remedy a remediable material breach within 14 days after written notice;
• becomes insolvent, ceases business or enters an analogous formal process; or
• cannot lawfully continue the Contract.

We may suspend work while an invoice is overdue, required information or approval is missing, or a material legal, security, sanctions or conflict concern is assessed. We will give notice where lawful and reasonably practicable.

Termination does not affect accrued rights. You must pay for work properly performed and approved committed costs up to termination. We return any balance for work not performed, subject to sections 8 and 13. Sections intended to survive, including confidentiality, intellectual property, data protection, liability, payment and law, continue.

16Events outside reasonable control

Neither party is liable for delay or failure caused by an event beyond its reasonable control, including failure of a public register or communications network, cyber incident despite reasonable precautions, industrial action, transport disruption, natural event, epidemic, war, civil disorder, government action or change in law. The affected party must notify the other, take reasonable steps to reduce the effect and resume performance when practicable.

This section does not excuse payment already due or duties of confidentiality and data security. If the event materially prevents performance for more than 30 consecutive days, either party may end the affected Contract; section 15 then applies.

17General terms

• Entire agreement. The Contract is the entire agreement about its subject and replaces earlier discussions. Neither party relies on a statement not set out in the Contract, without limiting liability for fraud.
• Changes. A change to an existing Contract must be agreed in writing by authorised representatives. Website updates apply only to Contracts formed after the updated version takes effect.
• Subcontracting. We may use suitably bound personnel or subcontractors and remain responsible for their contracted work. We comply with section 12 when personal data is involved.
• Assignment. Neither party may transfer a Contract without the other's written consent, not to be unreasonably withheld, except that we may transfer it with our business on written notice if this does not materially reduce your rights.
• No waiver. Delay in enforcing a right is not a waiver. A waiver must be in writing and applies only to the stated instance.
• Severance. If a provision is unenforceable, it is treated as modified to the minimum extent needed and the rest remains effective.
• Third-party rights. No person other than the parties may enforce the Contract under the Contracts (Rights of Third Parties) Act 1999, except that this does not restrict rights granted to individuals by an incorporated International Data Transfer Agreement.
• Notices. Operational notices may be sent by email to the addresses used for the quotation. A termination, breach or legal notice must also be clearly headed as such. An email is received when sent if no delivery-failure message is received, or on the next working day if sent outside 09:00–17:00 London time.

18Complaints, governing law and jurisdiction

If you are dissatisfied, email enquiries@navalrow.co.uk with the quotation or invoice reference, the issue and the outcome sought. We will acknowledge and investigate the complaint promptly and keep you informed where more time is needed. Data-protection complaints are handled under the separate procedure in the Privacy Notice.

Each Contract and any non-contractual obligation arising from it are governed by the law of England and Wales. Subject to any mandatory right in an incorporated International Data Transfer Agreement, the courts of England and Wales have exclusive jurisdiction.

---

Schedule 1 to Document A

International Data Transfer Schedule

Applies only when expressly engaged by section 12 of the Terms.

This schedule applies where we, as a UK controller, initiate a restricted transfer of personal data in a deliverable to you as a separate controller, the destination is not covered by UK adequacy regulations, no applicable exception is relied upon, and the International Data Transfer Agreement (IDTA) is the selected safeguard.

Acceptance of the Contract records each party's intention to be legally bound by the IDTA. The Contract supplies the information required by Part 1 of the IDTA as follows.

AParties and signatures

Exporter	Al Aksa Services Ltd, trading as Naval Row, company number 11326948, 7 West India Dock Road, London E14 8EZ; enquiries@navalrow.co.uk. Controller. The person accepting for us is the authorised representative identified in the quotation or acceptance email.
Importer	The customer legal entity named in the accepted quotation, at its address and in its destination country stated there. Controller. Its data-protection contact is the customer contact stated in the quotation or, if different, a contact it gives us in writing.
Signature and start date	Each party signs by its authorised acceptance of the Contract. The IDTA starts immediately before the first restricted transfer under that Contract.

BTransfer details

UK law and courts	England and Wales.
Linked agreement	The Contract. The term of the IDTA follows the Contract and any period during which either party retains transferred data.
Data subjects	Client and supplier personnel; company directors, officers and persons with significant control appearing in public records; professional or business contacts relevant to the agreed research; and people communicating about the instruction.
Data	Name, employer or business association, business role, public appointment details, public business address, professional contact details, correspondence, source references and factual business-context notes. No special-category or criminal-offence data is intended to be transferred.
Purpose and use	Receiving and using the agreed sourcing, verification, market or prospect-research deliverable for the customer's stated internal business purpose. Direct marketing is not an authorised purpose unless the importer independently establishes that it is lawful.
Method and frequency	Encrypted web service, access-controlled cloud link or business email, once or periodically during the Contract as the quotation requires.
Retention	The exporter applies the periods in the Privacy Notice. The importer must keep the data only while necessary for the stated purpose and its documented legal obligations, and then securely delete or anonymise it.
Onward transfers	Not permitted except to the importer's bound personnel and professional advisers who need the data for the stated purpose, or where a further transfer is otherwise lawful under the IDTA and applicable law.

CSecurity requirements

Each party must apply security appropriate to the risk, including access limited to authorised personnel, strong authentication for relevant accounts, supported and updated devices, protection in transit using current standard encryption where available, secure backup appropriate to its role, staff confidentiality, incident handling and secure deletion. The importer must not place the deliverable on a public or unrestricted system.

Each party will give the other contact details for security and rights requests on request, and will provide reasonable cooperation concerning a personal-data breach, rights request or regulator enquiry affecting the transferred data.

DMandatory clauses and ending the IDTA

The following is incorporated without amendment:

Parts 2 and 3 of the Approved IDTA are left blank. The exporter may end the IDTA under section 29.2 of the Mandatory Clauses if a revised Approved IDTA applies. The Mandatory Clauses prevail over the rest of the Contract to the extent required by the IDTA.

Before relying on this schedule, we will complete the assessment required by UK law and apply any additional protection needed for the relevant destination and transfer. If the required standard cannot be met, we may remove personal data from the deliverable, use another lawful mechanism or decline the affected transfer.

---

Document B

Privacy Notice

How Al Aksa Services Ltd handles personal data. Version 1.0. Effective and last updated 20 August 2026.

1Who is responsible

Al Aksa Services Ltd, trading as Naval Row, is the controller responsible for the processing described in this notice. We are registered in England and Wales under company number 11326948. Our registered office is 7 West India Dock Road, London E14 8EZ.

For privacy questions, rights requests or a data-protection complaint, email enquiries@navalrow.co.uk or write to the registered office, marking the correspondence “Data protection”.

This notice covers website visitors, people who enquire or work for clients, supplier and prospect contacts, company officers and other people whose business-context information appears in our sourcing, verification or research work.

2Personal data we collect and its sources

Clients, enquirers and their personnel

We may collect name, employer, job title, work contact details, WhatsApp or telephone number, enquiry and instruction content, correspondence, contract and billing records, payment status, and compliance information reasonably needed for sanctions, conflict or fraud checks. We obtain it from you, your organisation, your authorised colleagues and our communications or payment providers. We do not receive full card details from a card processor.

People identified in sourcing, verification and research

We may collect name, business role, employer or company association, appointment dates, public business address, professional contact details, relevant public filing information, source links, communications and factual business-context notes. Sources may include Companies House, The Gazette, the Insolvency Service, official sanctions or regulatory lists, company and professional websites, public professional profiles, reputable publications, the instructing client and direct business correspondence.

Website visitors

Our hosting and network providers may process IP address, browser and device information, requested page, referral information, and date and time in server or security logs. The current static pages do not use analytics, advertising tags, cookies or browser storage. The enquiry form opens your own email application; it does not submit the form to a website database.

Sensitive information

Our standard services are not designed to collect special-category data, criminal-offence data, patient information, passwords, bank credentials or identity documents. Please do not send them. If unsolicited sensitive information is received, we will restrict, return or delete it unless a valid legal reason requires another course. We will not intentionally include special-category or criminal-offence data in a deliverable without first identifying the necessity, lawful basis, additional legal condition and safeguards.

3Why we use personal data and our lawful bases

Purpose	Lawful basis
Enquiries, quotations and relationship management	Steps at the request of a prospective contracting individual where applicable; and our legitimate interests in responding to business enquiries, administering relationships and keeping appropriate records.
Delivering and administering services	Performance of a contract where the individual is the contracting party; and our legitimate interests and those of the client in carrying out the business service where contacts act for an organisation.
Supplier sourcing, company verification and market or prospect research	Our legitimate interests and those of clients in identifying potential business counterparties, understanding markets, making proportionate pre-contract checks, preventing fraud and making informed business decisions. We limit the work to relevant business-context information and assess the interests, necessity and effect on individuals.
Business communications with suppliers and other organisations	Legitimate interests in carrying out an accepted instruction, subject to applicable electronic-communications and direct-marketing rules.
Payments, accounting, tax, legal claims, complaints and compliance	Performance of a contract, compliance with legal obligations, and legitimate interests in being paid, protecting legal rights, resolving complaints, preventing misuse and complying with sanctions or other applicable rules.
Service updates and B2B marketing	Consent where electronic-marketing law requires it; otherwise our legitimate interests in promoting relevant services to business contacts after applying the required balancing test. Every message will identify us and provide an easy opt-out.
Website and information security	Legitimate interests in operating a secure, reliable website and communications service, and legal obligations where applicable.

Where we rely on legitimate interests, you may ask for information about our assessment and may object as explained in section 9. We do not sell personal data or disclose it for another organisation's unrelated marketing.

4Research obtained indirectly

Much of the business-context data used in verification and research comes from public or third-party sources rather than directly from the individual. Public availability does not by itself remove the right to privacy information.

Where required, we will make this notice available to the individual within a reasonable period and no later than one month after obtaining the data, at our first communication with them, or before the first disclosure, whichever applies first. We may not contact an individual where they already have the information or where a documented legal exception applies.

If providing individual notice would be impossible or involve disproportionate effort, we will rely on that exception only after assessing and documenting the circumstances, completing a data-protection impact assessment where required, and applying appropriate safeguards. These may include publishing this notice, minimising the data, limiting disclosure and retention, recording sources and making rights and objections easy to exercise.

5Who receives personal data

We disclose personal data only where relevant to the stated purpose and may share it with:

• the instructing client and its authorised personnel;
• a supplier, prospect or other business contact where an agreed approach requires communication;
• providers supporting hosting, email, cloud storage, communications, secure file delivery, payments, bookkeeping and business administration;
• confidential professional advisers, insurers and appropriately bound subcontractors;
• banks and payment networks for transactions and fraud prevention;
• courts, regulators, law-enforcement bodies, tax authorities or other recipients where disclosure is required or permitted by law; and
• a genuine buyer, investor or successor in a proposed business reorganisation, under appropriate confidentiality and data-protection controls.

A client receiving a report normally acts as a separate controller and is responsible for its own use, retention, disclosure and marketing compliance. Service providers acting as our processors may use the data only for contracted services and under appropriate obligations.

6International transfers

Our clients and some service providers may be outside the UK, including in the UAE or another Gulf country. A transfer to a separate organisation outside the UK is made only where the destination or recipient is covered by UK adequacy regulations, an appropriate safeguard is in place, or a specific legal exception validly applies.

Appropriate safeguards may include the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Where required, we complete the applicable transfer-risk or data-protection assessment and adopt additional technical, organisational or contractual protection. We do not treat the fact that a client is overseas, or that information was public, as sufficient on its own.

Where the IDTA is the selected safeguard for a controller-to-controller transfer to a client, the International Data Transfer Schedule forms part of the Contract. You may contact us for information about the safeguard relevant to your personal data, subject to protection of confidential security information.

7How long we keep personal data

• Enquiries that do not become instructions: up to 12 months after the last substantive contact.
• Client, contract, delivered-report, complaint and core service records: six years after completion or termination, unless a longer period is required for an active claim or legal obligation.
• Accounting and tax records: six years after the end of the relevant financial period, or longer if law or an authority requires.
• Working research material not included in the final deliverable: normally up to 12 months after delivery, then deleted or anonymised unless needed for a query, claim or legal obligation.
• Marketing contacts: until opt-out or, without meaningful interaction, for up to 24 months. We may then keep a minimal suppression record so that the opt-out continues to be respected.
• Website and security logs under our control: only as long as reasonably needed for security and troubleshooting, normally no more than 12 months.

When a period ends, we delete or anonymise the data unless a legal hold, dispute, fraud concern or mandatory retention rule requires limited continued retention. Backups are overwritten on their normal cycle and remain protected while retained.

8Security

We use technical and organisational measures appropriate to the nature and risk of the data, including access restriction, account protection, confidentiality duties, supported systems, secure transfer methods where appropriate, backup and incident procedures. No internet or email system is completely risk-free, so please do not send sensitive information through ordinary email or the website form.

9Your rights

Depending on the circumstances, you may have the right to:

• be informed and obtain access to your personal data;
• correct inaccurate or incomplete data;
• ask for deletion or restriction;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time where consent is the basis, without affecting earlier lawful processing; and
• receive safeguards in relation to qualifying solely automated decisions.

These rights are not absolute and exemptions may apply, including where data must be retained for legal obligations or claims, or disclosure would adversely affect another person's rights. We do not use personal data to make solely automated decisions that produce legal or similarly significant effects.

Send a request to enquiries@navalrow.co.uk. We may ask for proportionate information to confirm identity and clarify the request. We normally respond within one month after receiving the request or any reasonably required identification or clarification, and may extend the period where the law permits. We do not normally charge a fee.

10Direct marketing

We may send relevant Naval Row B2B service information where permitted by the UK GDPR and the Privacy and Electronic Communications Regulations. We seek consent where the rules require it, including for many messages to sole traders and certain partnerships, unless a valid exception applies. For corporate subscribers, we may rely on legitimate interests after considering reasonable expectations and impact.

We screen and respect opt-outs and must not conceal our identity. You can stop marketing at any time by replying “unsubscribe” or emailing enquiries@navalrow.co.uk. Service, legal and invoice communications are not marketing.

11Cookies, external links and communications

The current static Naval Row pages do not set cookies, use browser storage, run analytics or serve behavioural advertising, so the pages do not display a cookie-consent banner. If non-exempt storage or access technology is introduced, we will update the information and obtain consent where required before using it.

A WhatsApp link opens a separate service only when you select it. A mail link opens your chosen email service. Those providers process information under their own terms and privacy notices, and may operate outside the UK. We are responsible for our later handling of messages we receive, but not for a third-party service's independent processing. Other external links are provided for convenience; check the destination's privacy information.

12Children

Our website and services are for business users and are not directed to children. We do not knowingly collect children's personal data. If you believe a child has sent us data, contact us so we can assess and delete it where appropriate.

13Data-protection complaints

You can make a data-protection complaint by emailing enquiries@navalrow.co.uk or writing to our registered office. Please describe what happened, identify the data or communication concerned and state the outcome you seek. We will facilitate the complaint, acknowledge it within 30 days, make appropriate enquiries without undue delay, keep you informed where appropriate and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office. You can use the ICO's complaint service, call 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would welcome the opportunity to address the issue first, but you do not have to contact us before exercising a right to complain to the ICO.

14Changes to this notice

We may update this notice to reflect changes in services, providers or law. The current version will be posted on this page with its effective and last-updated date. A material change affecting existing contacts will be communicated directly where required.