Privacy Policy

Policy Owner: Data Protection Officer
Effective Date: 02 October 2026

1. Introduction

This Privacy Policy explains how Bracket Group LTD (bracket.co.uk, “we”, “us”, “our”, or “the Company”) collects, uses, processes, and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable UK data protection laws.

As a B2B SaaS provider operating in the UK and EU, we are committed to protecting the security, confidentiality, and privacy of your personal data. This policy applies to all personal data we process in connection with our services.

2. Data Controller Information

Data Controller: Bracket Group LTD
Registered Address: 86-90 Paul Street, London, EC2A 4NE
Email: info@bracket.co.uk
Phone: 0203 966 8312

3. Data Protection Officer (DPO)

Name: Martin Lee
Title: Data Protection Officer
Email: dpo@bracket.co.uk
Phone: 0203 966 8312

Our DPO is responsible for monitoring compliance and handling data protection enquiries.

4. EU and UK Representatives

Name: Pierre Anderson
Address: 86-90 Paul Street, London, EC2A 4NE
Email: panderson@bracket.co.uk
Phone: 0203 966 8312

5. Categories of Personal Data We Collect

5.1 Account and Contact Information

• Name and job title
• Business email address
• Business phone number
• Company name and address
• Billing and payment details

5.2 Technical Information

• IP address and device identifiers
• Browser type and operating system
• Login credentials
• Usage analytics

5.3 Service Usage Data

• Application logs
• Feature usage patterns
• Support history
• Preferences and settings

5.4 Communication Data

• Email and chat correspondence
• Survey responses
• Marketing preferences

6. Purposes of Processing and Legal Bases

6.1 Service Provision — Article 6(1)(b)

We process personal data for:

• Providing SaaS services
• Account management
• Billing and payments
• Customer support

6.2 Legitimate Interests — Article 6(1)(f)

We process personal data for:

• Improving services
• Analytics and performance monitoring
• Security and fraud prevention
• Business development and marketing

6.3 Legal Obligations — Article 6(1)(c)

We process personal data for:

• Tax and accounting compliance
• Legal and regulatory requirements
• Record keeping

6.4 Consent — Article 6(1)(a)

We may process personal data based on your consent for:

• Marketing communications
• Optional data collection
• Cookies and tracking technologies

6.5 Open Banking and Account Information Services

Where you connect a payment account, Bracket Group Ltd acts as an agent of Plaid Financial Ltd., an FCA-authorised payment institution (Firm Reference Number: 804718).

We and Plaid may access and process account data such as account identifiers, balances, and transactions to provide services including reporting, reconciliation, fraud prevention, and compliance.

Processing is based on your consent and/or the performance of a contract. You are responsible for ensuring you are authorised to connect the account.

6.6 Right to Withdraw Consent

You may withdraw your consent at any time.

This does not affect the lawfulness of processing carried out before your consent was withdrawn. Some services may no longer be available if consent is withdrawn.

6.7 Whether You Must Provide Personal Data

Some personal data is required to provide our services and meet our legal obligations.

Without this information, we may not be able to provide certain services.

6.8 Automated Decision-Making and Profiling

We use analytics and automated processing for fraud detection and service improvement.

We do not make decisions with legal or similarly significant effects solely based on automated processing.

Certain optional features within the Bracket FX platform use AI-assisted processing to provide functionality such as summarisation and analysis of platform data. These features are activated by user action.

AI processing is provided through Azure AI Foundry and is subject to Bracket’s Azure security and access controls.

Customer data is not used to train internal AI models and is not shared with other third parties for this purpose.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected and to meet applicable legal, contractual, and regulatory requirements.

• Account data: Retained for the duration of the customer relationship and for up to six years after it ends, to meet legal and accounting obligations and to establish, exercise, or defend legal claims.
• Customer and service data: Retained for as long as required to provide the services and meet contractual, legal, and legitimate business requirements.
• Service usage data: Retained for as long as reasonably required to support service delivery, troubleshooting, and product improvement.
• Support communications: Retained for as long as reasonably required for customer support, record keeping, and dispute resolution.
• Marketing data: Retained while relevant to our business relationship or until consent is withdrawn, where applicable.
• Financial and accounting records: Retained for six years as required by tax and accounting regulations.

8. Data Subject Rights

You have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of your personal data
• Restrict processing
• Request data portability
• Object to processing
• Exercise rights related to automated decision-making

9. Exercising Your Rights

To exercise your rights, contact us using the details below.

Email: info@bracket.co.uk
Mail: Data Protection Officer, 86-90 Paul Street, London

We aim to respond to valid requests within one month.

9.1 Identity Verification

We may verify your identity before processing a request.

9.2 Requests by Authorised Agents

Where a request is made on your behalf, we may require proof of authorisation and identity.

10. International Data Transfers

We may transfer personal data outside the UK and EEA where appropriate safeguards are in place.

10.1 Safeguards

These safeguards may include:

• Adequacy decisions
• Standard Contractual Clauses
• Binding Corporate Rules

10.2 Processing Locations

Bracket's primary production infrastructure and customer data are hosted in Microsoft Azure UK South.

Some subprocessors may process customer data in other jurisdictions, as detailed in our Data Processing Agreement.

11. Security Measures

We use appropriate technical and organisational measures to protect personal data.

Technical Measures

• Encryption at rest and in transit
• Multi-factor authentication
• Security monitoring and testing

Organisational Measures

• Staff training
• Access controls
• Incident response procedures

Data Classification

Data is classified and protected according to its level of sensitivity.

12. Third-Party Data Processors

We use trusted third-party providers for services including:

• Cloud hosting
• Analytics
• Payments
• Communication services

All processors are subject to appropriate data protection agreements.

13. Data Breach Notification

In the event of a personal data breach, we will:

• Assess and contain the breach
• Notify relevant authorities within 72 hours where required
• Inform affected individuals where necessary

Security contact: security@bracket.co.uk

14. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Enable website and platform functionality
• Store preferences
• Analyse usage

15. Marketing Communications

We may send marketing communications based on your consent or our legitimate interests, where permitted by law.

You can opt out at any time through:

• The unsubscribe link in marketing emails
• Your account settings
• Emailing privacy@bracket.co.uk

16. Data Protection by Design and Default

We apply privacy and data protection principles throughout the design and operation of our services, including:

• Data minimisation
• Privacy-first defaults
• Data Protection Impact Assessments

17. Children’s Privacy

Our services are not intended for individuals under the age of 16.

We do not knowingly collect personal data from individuals under 16.

18. Complaints and Supervisory Authority

If you have a concern about how we handle your personal data, contact us at:

privacy@bracket.co.uk

You may also contact the UK Information Commissioner’s Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Where changes are significant, we will take appropriate steps to notify users.

20. Contact Information

General: info@bracket.co.uk
Privacy: privacy@bracket.co.uk
Address: 86-90 Paul Street, London

Version History

Version: 1.1
Date: 02 October 2026
Author: Pierre Anderson
Approved By: Martin Lee

‍