Privacy notice
Last updated: 12 November 2026
1. Who we are
Q International Service Ltd (“QINTSERV”, “we”, “us”) is the controller of the personal data described in this notice.
- Company: private limited company registered in England and Wales, company number 15729929
- Registered office: 124 City Road, London EC1V 2NX, United Kingdom
- ICO registration: we are registered with the Information Commissioner’s Office (ICO) as a data controller under reference ZB799460
- Data protection contact: info@qintserv.com (subject line “Data protection”) · +44 20 3545 7977 · by post to our registered office
We are not required to appoint a data protection officer and have not done so. Our director is responsible for data protection.
2. Scope of this notice
This notice explains how we handle personal data when you visit qintserv.com, contact us, subscribe to our briefings, use our client services, ask for a valuation or list a company, apply for a role, or are mentioned in public sources we analyse.
We process personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended by the Data (Use and Access) Act 2025.
Our services are aimed at professional investors, advisers and businesses in the United Kingdom and the United States. We do not direct our services at individuals in the European Union.
Most of the information we work with is about companies, not people. Information about a company is personal data only where it relates to an identifiable individual, for example a managing director, a shareholder or a sole trader.
3. What we collect, why, and on what lawful basis
The table below lists each activity, the personal data involved, why we use it and the lawful basis under Article 6 UK GDPR.
| Activity | Personal data | Purpose | Lawful basis |
|---|---|---|---|
| Visiting our website | IP address, browser and device data, pages requested, date and time, security signals | Delivering the website, keeping it secure, preventing abuse | Legitimate interests (running a secure website) |
| Contacting us (form, email, phone, LinkedIn) | Name, business email, phone number, company, role, your message | Answering your enquiry, managing business relationships | Legitimate interests; steps before a contract where you ask about our services |
| Daily Briefing and other newsletters | Email address, name if given, sign-up and confirmation time, unsubscribe record | Sending the briefing you asked for | Consent (double opt-in), which you can withdraw at any time through the link in every email |
| Client accounts, trials and subscriptions | Name, business email, company, role, login details (passwords are stored hashed), settings, watchlists and saved theses, usage logs, billing contact, subscription and payment status | Providing the service, managing trials and billing, support | Contract; legal obligation (accounting and tax records); legitimate interests (preventing fraud and misuse, improving the service) |
| Valuation requests and company listings | Owner’s name and contact details, company details, financial figures, information on succession or sale plans | Producing the valuation report you request, managing your listing, and using company figures in anonymised and aggregated form in analyses for professional investors | Contract or steps before a contract (the report and listing); legitimate interests (anonymised analysis) |
| Expressions of interest in a listing | Name, firm, contact details, your message | Handling your interest and following up with you | Legitimate interests; steps before a contract |
| Job applications | CV, contact details, qualifications, interview notes | Assessing your application | Steps before a contract; legitimate interests |
| Company intelligence from public sources | Names and roles of individuals connected with a company (see section 4) | Building company profiles, scores and alerts for professional clients | Legitimate interests |
| Running our business | Contracts, invoices, correspondence | Accounting, tax, legal compliance, establishing or defending legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against yours. You can ask us for details of that assessment.
You do not have to give us personal data. Without the details needed for an account, a report or a subscription, however, we cannot provide that service.
We do not ask for special category data (for example health or political opinions). Please do not include it in forms or messages.
4. Company intelligence from public sources
This section is for people we have not heard from directly, such as managing directors, shareholders, authorised signatories or insolvency practitioners named in public sources. It gives the information required by Article 14 UK GDPR.
What we do. QINTSERV analyses companies (legal entities). We monitor public sources for events such as insolvencies, closures, sale processes and changes of management, and match them to company profiles. We never score, rate or profile individuals. Sole traders and other natural persons are excluded from our scores.
Personal data involved. Names, roles and business addresses of individuals as they appear in public sources, and the fact that an individual holds a role in more than one company.
Sources. Regional and national news websites, the GDELT global news database, public company and insolvency registers, published annual accounts, company websites, and register data obtained through licensed data providers such as OpenRegister.
Why we use it. Only to identify the right company, to link related companies (for example a parent and its subsidiary, or two companies with the same managing director) and to derive company-level indicators. Links between companies that are based on a shared individual are stored in a separate, restricted form and are not shown to clients.
What clients see. Company-level scores, signals and our own English summaries, each with a link to the original public source. We do not show clients the names or personal details of individuals as part of our scores, feeds or data exports, except where they appear in the linked original source.
Lawful basis. Legitimate interests: providing professional investors and advisers with accurate, explainable information on companies, using data that is already public and relates to people in their business roles.
Why we do not contact you individually. Contacting every person named in public sources would involve disproportionate effort (Article 14(5)(b) UK GDPR). We publish this notice instead.
Your choices. You can object to this processing, ask what we hold about you, or ask us to correct an entry (see section 11). Companies can also ask us to correct a score or signal.
5. Automated processing and AI
We make no decisions about individuals based solely on automated processing that have legal or similarly significant effects on them (Articles 22A to 22D UK GDPR).
Our Horizon scores and valuations are calculated automatically, but they concern companies, not people. They are statistical assessments for professional clients, not credit ratings or investment advice. Every score lists the signals behind it.
All figures, scores and valuations are calculated by our own deterministic code. We do not currently use AI models to process personal data. If we introduce AI-assisted classification or summaries, we will update this notice and label AI-generated content as such.
6. Who we share personal data with
We do not sell personal data. We share it only with the service providers and recipients below, and only as far as needed.
Service providers acting on our instructions (processors). Each is bound by a data processing agreement.
| Provider | What they do for us | Data involved | Where |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting and delivery, security and bot protection, databases, background jobs | All data processed through our website and platform | Global network, US company |
| Google (Google Workspace) | Business email, calendar, documents and file storage | Correspondence, contact details, business documents | EEA and US |
| Resend (Plus Five Five, Inc.) | Sending emails: account and transaction emails, briefings, valuation reports | Email address, name, email content | US |
Payments. Card payments are handled by Stripe (Stripe Payments UK Ltd and its affiliates) on Stripe’s own secure checkout pages. We never see or store your full card details. Stripe processes payment data on our behalf and also acts as an independent controller for its own purposes, such as fraud prevention and meeting financial regulations. See Stripe’s privacy policy.
Other recipients.
- Professional advisers such as accountants, lawyers and auditors, and our bank, where needed for their services
- Authorities such as HM Revenue & Customs, Companies House, the ICO, courts or law enforcement, where the law requires it
- Prospective investors, buyers or successors of our business, under confidentiality and only as far as needed for due diligence
- Our clients receive company-level information and anonymised, aggregated figures only (see sections 3 and 4)
- LinkedIn, if you interact with our company page. LinkedIn processes that data under its own privacy policy; for page statistics LinkedIn and we may be joint controllers
7. International transfers
We are based in the United Kingdom. Some of our providers process data in other countries, mainly the United States and the European Economic Area (EEA). We protect these transfers as follows:
- United States: Cloudflare, Stripe, Google and Resend are certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which UK law recognises as providing adequate protection. Where a transfer is not covered by the data bridge, we rely on the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which our providers include in their data processing agreements.
- EEA: UK law recognises the EEA as providing adequate protection, so no further safeguards are needed.
- Cloudflare’s global network: requests may be handled in Cloudflare data centres close to the visitor, under the safeguards in Cloudflare’s data processing agreement.
You can ask us for a copy of the relevant safeguards.
8. How long we keep personal data
We keep personal data only as long as we need it. After that we delete or anonymise it.
| Data | How long |
|---|---|
| Website and security logs | Short-term only, generally no longer than 30 days |
| Enquiries and business contacts | 2 years after our last contact, unless a business relationship continues |
| Newsletter subscriptions | Until you unsubscribe; we keep your email address on a suppression list so we do not email you again |
| Client accounts and subscriptions | For the life of the account, then 6 years (the limitation period for contract claims) |
| Invoices and accounting records | 6 years from the end of the financial year they relate to (tax law; company law requires at least 3 years) |
| Valuation requests and listings | 3 years after our last contact; anonymised figures may be kept longer, as they no longer identify anyone |
| Job applications | 6 months after the recruitment decision, unless you agree to a longer period |
| Personal data in public-source company records | As long as the related company profile is maintained; reviewed at least once a year |
| Emails sent through Resend | Delivery logs for 30 days at Resend |
9. Cookies and similar technologies
We use only cookies that are strictly necessary for the website to work. Under PECR these do not need your consent.
| Cookie | Set by | Purpose |
|---|---|---|
| qis_session | QINTSERV | Keeps you signed in to your client account; deleted when you sign out or the session expires |
| Security cookies, such as __cf_bm | Cloudflare | Distinguish people from bots and protect the site against attacks |
| Stripe cookies | Stripe, on its own checkout pages | Fraud prevention during payment |
We do not use analytics cookies, advertising cookies or cross-site tracking. If we introduce cookies that only collect statistics to improve our website, we will describe them here and give you a simple, free way to object, as PECR allows. Any other non-essential cookies will be set only with your consent.
You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the website, such as sign-in, from working.
10. Security
We protect personal data with encrypted connections (TLS), access restricted to people who need it, hashed passwords, separate restricted storage for person-based links between companies, and contracts with every processor. If a personal data breach is likely to put your rights at risk, we report it to the ICO within 72 hours and, where the risk is high, tell you without undue delay.
11. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and receive a copy
- rectification of inaccurate or incomplete data
- erasure of your data in certain circumstances
- restriction of processing in certain circumstances
- data portability for data you gave us, where we process it on the basis of consent or contract
- withdraw consent at any time, without affecting earlier processing
Your right to object. Where we rely on legitimate interests, including for company intelligence from public sources (section 4), you can object to the processing on grounds relating to your particular situation. We will then stop unless we have compelling legitimate grounds that override your interests, or need the data for legal claims. You can object to direct marketing at any time, and we will always stop.
To use any of these rights, email info@qintserv.com with the subject “Data protection request”, or use our contact form. We may ask you to confirm your identity first. We reply within one month of receiving your request (or your identity confirmation, if we needed it). For complex or multiple requests we may extend this by up to two further months; if so, we will tell you within the first month. We will carry out a reasonable and proportionate search for your data. Requests are free unless they are manifestly unfounded or excessive.
12. Complaints
If you are unhappy with how we handle your personal data, please tell us first. Email info@qintserv.com with the subject “Data protection complaint”, or use our contact form and choose “Data protection request or complaint”. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome.
You also have the right to complain to the UK regulator at any time, whether or not you have complained to us first:
Information Commission’s Office (ICO) · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk/make-a-complaint
13. Children, changes and contact
Our services are for businesses and professionals. They are not directed at anyone under 18, and we do not knowingly collect children’s data.
We update this notice when our services, our providers or the law change. We will tell registered clients and subscribers about significant changes by email.
Questions about this notice: info@qintserv.com · +44 20 3545 7977 · Q International Service Ltd, 124 City Road, London EC1V 2NX, United Kingdom.