Privacy Policy

BW International Ltd ("BW Horizons," "we," "us," or "our") is committed to protecting the privacy of our members and platform users. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

BW Horizons acts as the data controller for personal data processed through the Platform.

1. Data We Collect

We collect the following categories of data:

• Account and Identity Data: Name, email address, job title, company name, company registration number, and any KYC/AML documentation submitted during verification.
• Professional and Financial Data: Investment mandates, deal history, offer and request submissions, transaction communications, and document vault contents.
• Payment Data: Billing details processed by Stripe. We do not store full card numbers; payment data is held by Stripe under their own PCI-DSS certification.
• Usage Data: IP addresses, browser type, device identifiers, pages visited, features used, and interaction timestamps collected via server logs and analytics.
• Communications Data: Messages, support tickets, and correspondence with our team.

2. Legal Basis for Processing

We process personal data on the following legal bases:

• Contract performance — to provide and maintain your subscription;
• Legal obligation — to comply with AML, sanctions screening, and UK regulatory requirements;
• Legitimate interests — to improve the Platform, prevent fraud, and ensure security;
• Consent — for optional communications where you have opted in.

3. How We Use Your Data

Your data is used to:

• Provision and operate your account and subscription;
• Conduct KYC/AML and sanctions screening as required by law;
• Process payments and manage billing;
• Deliver platform notifications, deal alerts, and product updates;
• Detect and prevent fraud, abuse, and security threats;
• Analyse usage to improve Platform performance and features;
• Comply with legal and regulatory obligations.

Content screening and moderation

Text you post or send on the Platform — usernames, listings, requests, mining concession listings, inquiries and messages — is screened automatically against a list of prohibited language when you submit it. Text containing certain terms is rejected; text containing others is published and referred to our team for review. We do this to keep the Platform safe and to prevent abuse, harassment and fraud, on the basis of our legitimate interests and those of our members.

Automated screening never removes content that is already published or restricts your account on its own. Decisions to remove content or to suspend or close an account are made by a member of our team after human review, and we tell you the reasons for them. When you report content or a member, we record your report, the content concerned and the outcome so that we can review it and act on it.

4. Data Sharing

We do not sell your personal data. We share data only in the following circumstances:

• Service providers: Trusted processors that operate on our behalf under data processing agreements, including Supabase (cloud database), Vercel (hosting), Stripe (payments on our website), Resend (transactional email), RevenueCat (United States; manages subscriptions purchased in our iOS app and confirms their status to us), and Expo (United States) with the Apple Push Notification service (delivery of push notifications to your device). Subscriptions purchased in our iOS app are processed by Apple through the App Store; Apple acts as an independent controller under its own terms and privacy policy, and we do not receive your payment card details.
• OpenAI (OpenAI, L.L.C., United States). To suggest relevant offers and requests to members, our servers send the content of listings (title, category, specifications, Incoterm, origin, destination and description) to OpenAI's API to create numerical representations of the text (embeddings). OpenAI processes this data on our behalf as a processor and, under its API terms, does not use it to train its models. No messages, documents or account details are sent. Transfers to the United States are based on the European Commission's Standard Contractual Clauses.
• KYC/AML partners: Identity verification and screening services where required for regulatory compliance.
• Legal requirements: Where required by law, court order, or a regulatory authority with jurisdiction.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to continued data protection obligations.

Counterparty identities and deal communications are never disclosed to other members without explicit consent.

5. International Transfers

Some of our service providers operate outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements (IDTAs) or adequacy decisions. Our database and file storage are hosted by Supabase in the European Union (Ireland). Our website and server API are hosted by Vercel in the United States, and some of the service providers listed in Section 4, including OpenAI, RevenueCat, Stripe, Resend and Expo, process data in the United States. Where personal data is transferred outside the United Kingdom or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or another lawful transfer mechanism.

6. Data Retention

We retain personal data for as long as necessary to provide the service and fulfil legal obligations:

• Active account data: retained for the duration of your subscription plus 7 years for financial records;
• KYC/AML records: retained for a minimum of 5 years post-relationship as required by UK AML regulations;
• Usage and log data: retained for up to 12 months;
• Deleted accounts: personal data anonymised or deleted within 30 days of account closure, subject to legal holds.

7. Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — request correction of inaccurate or incomplete data;
• Erasure — request deletion where data is no longer necessary or consent is withdrawn;
• Restriction — request limited processing in certain circumstances;
• Portability — receive your data in a structured, machine-readable format;
• Objection — object to processing based on legitimate interests;
• Withdraw consent — where processing is consent-based, withdraw at any time.

To exercise any right, contact us at support@bwhorizons.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

We employ industry-standard technical and organisational measures to protect your data, including encryption at rest and in transit (TLS 1.2+), role-based access controls, regular security assessments, and isolated database environments. We are working towards SOC 2 Type II certification.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay.

9. Cookies and Tracking

The Platform uses only cookies that are strictly necessary to sign you in and keep your session secure. We do not use analytics, advertising or tracking tools. We store a few preferences in your browser's local storage, such as your chosen units, your last valuation calculator inputs and the layout of the side menu, so the site remembers them; this information stays on your device. Our fonts and icons are served from our own servers. Some pages load maps from Mapbox, which also receives map usage events, and listing photos in our mobile app are loaded from Pexels. These providers receive your IP address when they deliver that content.

10. Children's Privacy

The Platform is intended exclusively for business users. We do not knowingly collect personal data from individuals under the age of 18. If we become aware of such data, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes via email or in-platform notice at least 14 days before they take effect.

12. Contact

Data Controller: BW International Ltd, United Kingdom
Privacy & general enquiries: support@bwhorizons.com