Version [version number] · Effective [effective date]
This policy explains how LakeHouse Intelligence uses personal data when it is the data controller: for its own website, clients, client contacts, portal users and business records. LakeHouse Intelligence is a technology and data audit, fix and reporting company for private equity funds and the companies they buy. Section 2 explains the different position for personal data inside the systems LakeHouse Intelligence reviews for its clients. Our legal and contact details, and our ICO registration number, are in section 13.
[where this policy is published, e.g. the LakeHouse Intelligence website and the client portal, and which copy is authoritative]
1. The data we hold as controller
| Category | Whose data | Examples |
|---|---|---|
| Website enquiries | People who email us from the website | Whatever you include in your email: usually name, work email, company, role and message. The website has no contact form. |
| Client and prospect contacts | People at funds, buyers, targets and standalone clients we deal with | Name, work email, phone, company, role, the engagements you are involved in, notes of meetings and calls |
| Contracts and correspondence | Anyone who signs or is named in our contracts, or who writes to us or is copied in | Names, signatures, job titles, email content and attachments, logged against the client account |
| Client staff named in correspondence | Staff of our clients mentioned in emails, documents or meeting notes | Name, role, what was said about the engagement |
| Consent, approval and upload links | Client admins, named approvers and contacts who use our single-purpose links | Name, work email, the access you granted or approved, the time, your IP address and browser, files you uploaded |
| Interviewees | People we interview during a review | Name, role, interview date, the questions asked and the answers recorded |
| Client portal users | Fund and buyer users of the client portal | Name, work email, company, sign-in identifier from your organisation's single sign-on, MFA status, sign-in history, pages and reports viewed |
| Billing | Billing contacts at our clients | Name, work email, billing address, invoices and payments. [payment terms, invoicing method and any payment provider] |
| Company and people checks | Officers and people with significant control of companies we check, only where a client buys this option | Name, role, date of birth month and year, nationality and appointments from Companies House; possible matches against the UK Sanctions List and the auditor's decision on them [confirm whether LakeHouse Intelligence is controller or the fund's processor for these checks] |
| Technical | Visitors to our website and users of our client-facing pages | IP address, browser, device, security logs, strictly necessary cookies (section 5) |
You do not have to give us your personal data, but without your contact details we cannot reply to you, run an engagement with your organisation or give you portal access.
2. Personal data inside our clients' systems
When we review or work on a company's systems (for example its user directory, file stores, CRM, finance and HR systems, code repositories and the documents it uploads), that company is the controller of the personal data in them and we act as its processor under a data processing agreement. This covers staff, contractors, leavers, customer and supplier contacts, and anyone else named in those systems.
If your data is held in the systems of a company we work for, that company is responsible for telling you about it and for answering your requests, and we help it to do so. Its own privacy notice applies.
How we treat that data:
- We read it with read-only access that the company grants and can revoke at any time. We change a system only in our separate, controlled fix mode with the company's written consent and named approvers.
- We copy only what each piece of work needs, and personal data is masked by default in what our people and AI tools see and in every report.
- Before a company is bought, we do not collect email or chat content, and we do not give raw records to the buyer or fund.
- We do not collect individual pay.
- The data is held in Google Cloud in London (or an EU region if the company asks), in a separate cloud project for each review with its own encryption key.
- When a review ends we delete the review data, destroy its encryption key and give the company a deletion certificate.
What we keep after deletion: we keep our own record of the work as a business record, so we can show how we reached each conclusion and defend our work if it is challenged. That record holds hashes (digital fingerprints) of what we saw, the short evidence excerpts cited in our reports with personal data masked, our findings and reports, the full output of every AI step (which may quote masked content), and, for changes we made, the before and after state with people shown only as internal IDs. For this record we are a controller and our lawful basis is legitimate interests (section 3). It is kept for the period in section 8. [solicitor to confirm that LakeHouse Intelligence is controller of these retained records, OQ-PLT-21]
3. How we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Replying to enquiries and discussing possible work | Legitimate interests (responding to business enquiries and developing our business) |
| Running engagements, managing client relationships and contracts | Performance of a contract where you are the client; otherwise legitimate interests (working with the organisation you represent) |
| Sending and recording consent, approval and upload links, and recording what was granted or approved | Legitimate interests (running the engagement securely and keeping proof of authority for every access and change) |
| Recording interviews | Legitimate interests (assessing the company's controls as part of the engagement) |
| Giving portal users access and keeping the portal secure | Performance of a contract with your organisation; legitimate interests (security) |
| Company and people checks, where bought | [lawful basis, likely legitimate interests of the client in knowing who it deals with; confirm with solicitor] |
| Keeping our audit ledger, contracts and correspondence after an engagement | Legitimate interests (being able to show and defend our work, and meeting our insurer's requirements); for financial records, legal obligation |
| Invoicing and accounts | Performance of a contract; legal obligation (tax and accounting) |
| Security of our systems and fraud prevention | Legitimate interests (running secure services) |
| Marketing emails, if we send any | Consent, or legitimate interests for existing business contacts where the law allows, with an easy way to opt out [decide whether LakeHouse Intelligence will send marketing email] |
You can ask us for details of the balancing test for any purpose that relies on legitimate interests.
4. AI
We use Claude models made by Anthropic, through Google Cloud Vertex AI in a UK or EU region, to help our staff classify data, draft findings and answer questions about one engagement. Client data is never used to train AI models. Every AI output is reviewed by a named auditor before it is used, and every AI call is logged.
We do not make decisions about you by automated means that produce legal or similarly significant effects. Our findings are about a company's systems and controls and are made by people.
5. Cookies
Our website sets no cookies and uses no analytics, advertising or tracking. It loads its fonts from Google Fonts, so your browser sends your IP address to Google when the page loads. [decide whether to serve the fonts from our own server so no visitor data goes to Google] If we ever add analytics or other non-essential cookies, we will ask for your consent first.
The client portal and our consent, approval and upload pages use strictly necessary cookies to keep you signed in and to protect the pages. These are needed for the service you have asked for, so they do not need consent under the Privacy and Electronic Communications Regulations. [confirm the cookies actually set once the portal and link pages are built]
6. Who we share it with
We do not sell personal data. We share it only as follows:
- Our service providers (processors), under data processing agreements: Google Cloud (hosting and storage, London), Google Cloud Vertex AI (AI models, UK or EU region), [email provider], [e-signature provider], [payment provider, if any], [accounting software]. The current list is in our Sub-processor Register.
- The parties to an engagement, as needed to run it: for example, the fund and buyer see the names of the target contacts who are working with us, and a company sees who at LakeHouse Intelligence is assigned to it. Before a deal completes, a target's reports go only to the named deal team.
- Partners we refer a client to, only with the client's agreement. The partner contracts with the client directly.
- Professional advisers, insurers and accountants, where we need advice, need to handle a claim or must meet our accounting obligations.
- Regulators, courts and law enforcement, where the law requires it.
- A buyer or investor in LakeHouse Intelligence, under confidentiality, if our business is sold or financed.
7. International transfers
We host client data and our own data in the United Kingdom (Google Cloud London region) by default. Some of our providers may process limited data outside the UK, for example for support or email delivery. Where they do, we use an appropriate safeguard: an adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us which safeguard applies to a provider. [list actual transfers once the email, e-signature and payment providers are chosen]
8. How long we keep it
| Data | Retention |
|---|---|
| Website enquiries that do not lead to work | [period, ARC used 2 years] from the enquiry |
| Client and prospect contacts | While we have a business relationship, then [period] |
| Data inside a client's systems (section 2) | Deleted when the review ends, with a deletion certificate to the client; a company's long-lived data space is deleted when its last fix or upkeep engagement ends |
| Audit ledger, cited evidence excerpts (masked), hashes, contracts, correspondence and issued documents | At least 6 years after the engagement ends, and longer if our insurer or lawyers advise it [confirm period and when it starts, OQ-PLT-15, OQ-PLT-42, OQ-CC-08] |
| Records of consents, approvals and uploads through our links | As for the audit ledger |
| Portal accounts | While the account is active, then deleted within [period] of closure; sign-in history as for the audit ledger [confirm] |
| Financial and transaction records | 6 years after the end of the financial year they relate to, as UK law requires |
| Security logs | [period] |
If we are under a legal hold (for example because of a claim or court order), we keep the data it covers until the hold ends.
9. Your rights
Under UK GDPR you have the right to access, correct, erase, restrict or object to our use of your personal data, and to data portability, subject to the conditions and exceptions in the law.
Some of these rights are limited for our audit ledger. It is append-only and locked for its retention period so that it can be relied on as evidence, and we keep it to be able to defend legal claims. We can add a correction to it, but we cannot delete entries before the end of the period. [OQ-PLT-21, how erasure and rectification apply to retention-locked records]
Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds to continue or need the data for legal claims.
If your request is about data inside a company's systems that we hold as its processor, we will pass it to that company and help it to respond.
To exercise any right, contact us using the details in section 13. We reply within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we would welcome the chance to help first.
10. Security
We protect personal data with measures including: separate encrypted cloud projects for each client review; hosting in the UK by default; staff sign-in with single sign-on and multi-factor authentication from managed devices only; access only to the engagements a person is assigned to, with any wider access logged; masking of personal data by default; read-only access to client systems by default; and an append-only, tamper-evident audit log. We will tell you and the ICO about a personal data breach where the law requires it.
11. Children
Our services are for businesses and are not directed at children.
12. Changes to this policy
We may update this policy. The current version, with its version number and date, is always at [URL].
13. Legal information and contact
The data controller is [LakeHouse Intelligence legal entity name], a [company type] registered in England and Wales, company number [company number], registered office [registered office].
Registered with the UK Information Commissioner's Office, registration number [ICO registration number].
Privacy enquiries and data rights requests: [data protection contact name or role, and email address].