● Confidential information portal
This notice explains what personal data we record about you when you take part in the confidential process to which you have been invited — from your initial request for access, through the creation of your account and your acceptance of our non-disclosure agreement, to any expression of interest you submit.
IQ Studios (UK) Ltd ("IQ Studios", "we", "us") is the controller of the personal data described in this notice.
This notice covers the personal data we process in connection with your participation in the confidential process, as described in the sections below.
Our general website privacy notice covers enquiries made through our public website, cookies, analytics and server logs. Where those matters apply to your use of this portal, that notice applies alongside this one. This notice takes precedence in the event of any inconsistency in relation to the portal.
If you submit an access request through our confidential opportunity page, we collect:
We use this to assess your request, to contact you about it, and to protect the form against automated abuse. Where a submission is blocked by our automated anti-spam checks, we log the IP address and the reason.
We may also receive your name, role, organisation and contact details from your organisation, one of its advisers or another person involved in the process, where they ask us to invite you to the portal.
If we grant you access, we create a user account for you on our website. We hold:
Sessions expire automatically after six hours, after which you will need to sign in again.
Before detailed information is released to you, you are asked to accept our non-disclosure agreement. When you accept it, we keep a detailed record of your acceptance as evidence of what was agreed, by whom and when. That record comprises:
A copy of the agreement and your acceptance record is emailed to you at the time of acceptance, and remains available to download from within the portal.
Access to the confidential information is reviewed and decided by a person; it is not automated. We record the outcome, the date and time of the decision in UTC, who made it, and the specific acceptance record and agreement version to which it relates.
If you submit an expression of interest, we collect the information you provide. This may include your organisation and contact details, the nature of your interest, any indicative offer, your proposed transaction structure, how you anticipate funding it, the basis of your offer, your proposed timescale, whether you would like a viewing, and any further comments. We use this to evaluate your interest and to progress discussions with you.
In addition to the acceptance record described above, we currently record:
We do not currently log the pages you view within the portal or the documents you open. Standard web server logs, which record IP addresses, pages requested and timestamps, are kept by our hosting provider as described in our website privacy notice.
We use these records to secure the portal, to detect misuse, and to administer the process. Our non-disclosure agreement requires you not to share your credentials or access links; activity records help us identify where that may have occurred.
If we introduce more detailed activity logging in future, we will update this notice before doing so.
| What we do | Lawful basis |
|---|---|
| Assessing access requests and administering the process | Legitimate interests — conducting and controlling a confidential process |
| Creating and administering portal accounts | Legitimate interests — providing controlled access to confidential information |
| Recording your acceptance of the non-disclosure agreement and retaining evidence of it | Legitimate interests — recording and evidencing acceptance of the agreement, and establishing, exercising or defending legal rights |
| Evaluating expressions of interest and progressing discussions | Legitimate interests — pursuing a potential transaction |
| Securing the portal and detecting misuse | Legitimate interests — protecting confidential information and our systems |
| Complying with legal or regulatory obligations, and responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your interests, rights and freedoms. You can ask us for further information about that assessment, and you have the right to object to processing on this basis (see section 13).
We do not sell your personal data. We may disclose it, where necessary and lawful, to:
Where a service provider acts as our processor, it processes personal data on our instructions and is subject to contractual obligations concerning confidentiality and security. Other recipients may process personal data as controllers in their own right.
Where personal data is transferred outside the United Kingdom, we use a transfer mechanism recognised under UK data protection law. Depending on the circumstances, this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, together with any required transfer risk assessment. You can ask us which mechanism applies to a particular transfer.
| Information | Retention period |
|---|---|
| Non-disclosure agreement acceptance records, including the retained agreement text and audit record | The term of the agreement, and six years thereafter |
| Expressions of interest and related correspondence | The duration of the process, and six years thereafter |
| Access requests that do not proceed to an account | 12 months from the date of the request |
| Portal accounts and sign-in records | For the duration of the process, after which accounts are closed. Sign-in records forming part of an acceptance record are retained with that record |
| Portal security logs | 90 days, unless retained longer in connection with a security incident, a suspected breach of the non-disclosure agreement, or an actual or anticipated legal claim |
The six-year periods reflect the general limitation period for bringing a claim founded on a simple contract under the Limitation Act 1980, which runs from the date a cause of action arises. We may retain records for longer where reasonably necessary in connection with an actual or anticipated legal claim. Where we no longer need personal data, we delete it or, where appropriate, anonymise it.
You have the right to:
These rights are not absolute. In particular, we may need to retain your acceptance record even if you ask us to erase your data, because that record is evidence of an agreement that remains in force and may be needed to establish, exercise or defend legal rights. If we cannot meet a request in full, we will explain why.
To exercise any of these rights, contact info@iqstudios.co.uk. We will respond within one month, and will tell you if we need longer.
We do not make decisions about you by solely automated means, and we do not carry out profiling that has a legal or similarly significant effect on you. Decisions about your access are taken by a person.
Automated checks are applied to our forms to detect and block spam and automated abuse. If a legitimate submission is blocked, you can contact us directly at info@iqstudios.co.uk.
The portal is served over an encrypted connection. Access is restricted to individual accounts issued by us, with passwords stored in hashed form and sessions that expire after six hours. Confidential content is released only after a person has reviewed and approved the request, and access can be suspended or withdrawn at any time. Access to personal data within our organisation is limited to those who need it.
You do not have to give us your personal data. However, we cannot assess an access request, create an account for you, or release confidential information to you without the information described above.
We may update this notice from time to time. The version number and date at the top of this page show when it was last changed. Where changes are significant, we will take reasonable steps to bring them to the attention of the people affected.
If you have a concern or complaint about how we have handled your personal data, you can make a data protection complaint by contacting us at info@iqstudios.co.uk. We will acknowledge your complaint within 30 days and will investigate and respond without undue delay, keeping you informed as appropriate.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113