DeepDive Service Privacy Notice

This notice was last updated on 02 Nov 2026.

Contents

1. About this notice
2. What we do
3. Who uses DeepDive
4. Whose personal data we process
5. What personal data we process
6. Where we get personal data from
7. Our lawful basis
8. Who we share personal data with
9. International transfers
10. How long we keep personal data
11. Security
12. Your rights
13. Complaints
14. Contact us

1. About this notice

This notice explains how Deep Dive Data Services Limited ("Deep Dive", "we", "us") collects and uses personal data to provide DeepDive, our due diligence and investigative reporting service. We are registered in England and Wales under company number 16513102, with our registered office at Trinity House, School Hill, Lewes, Sussex BN7 2NN. Our ICO registration number is ZB968441.

You may be reading this because an organisation has told you it uses DeepDive, or because you want to know whether we may have produced a report about you. Most of the people whose data we process have never dealt with us, and we do not collect data from them directly. The law requires us to explain how we use personal data obtained from other sources, and this notice is one of the ways we do that.

This notice covers the DeepDive service only. Our separate website privacy policy explains how we handle personal data of website visitors, customer contacts and people who get in touch with us.

We review this notice at least once a year, and sooner if the law or our processing changes. References to the UK GDPR are to the UK GDPR as amended by the Data (Use and Access) Act 2025.

2. What we do

Organisations often need to find out about a person before they deal with them. A bank may need to check a new client under anti-money laundering rules. An investor may want to look into the directors of a company it plans to back. An employer may want to screen a candidate. Many organisations still do this by searching the internet by hand, which is slow and easy to get wrong. DeepDive does this work automatically.

A typical example:

1. A law firm is taking on a new client and must carry out enhanced due diligence on the client's director.
2. The firm gives DeepDive the director's name and some keywords that help us identify the right person, such as a company name or a country.
3. DeepDive runs searches through major search engines, in several languages where relevant, and retrieves the web pages those searches return. It also checks company registers, and, where the customer’s account is set up for screening, sanctions, politically exposed person (PEP) and regulatory enforcement lists.
4. Our software reads the retrieved content, works out which information genuinely relates to the director and not to someone with a similar name, and extracts the relevant statements.
5. We put those statements into a structured report for the firm. Each statement is linked to its source so the firm can check it.
6. The firm reviews the report, checks any important findings against other sources, and makes its own decision.

A report may draw attention to things the customer should look at, such as a possible sanctions match or adverse media coverage. DeepDive does not score or rate people, does not recommend any decision, and makes no decisions itself. Our customers are contractually barred from making decisions about a person based only on a DeepDive report.

Customers can also ask to have a report on a person re-run on a schedule; each re-run produces a new report. They can ask questions about a completed report using a chatbot, which answers from the statements gathered for that report, each with its source, and cites the sources it relies on.

We do not use personal data collected through DeepDive to train artificial intelligence models.

3. Who uses DeepDive

We only provide DeepDive to organisations that we have vetted and whose purposes fall within the following uses.

In each case, agencies and other third parties working on behalf of such an organisation may also use DeepDive.

Before we give a customer access, we verify its identity and, where relevant, its regulatory status. We also confirm that it is registered with the appropriate data protection authorities and record which of the uses above it may use DeepDive for. Customers must not use DeepDive to report on anyone under 18 without our prior written approval.

4. Whose personal data we process

We process personal data about people who are the subject of a DeepDive search. We also process data about people connected with an organisation that is the subject of a search, such as its directors, officers and shareholders, and about people linked to the subject, such as business associates or relatives. We include connected and linked people only where they are relevant to the customer's use, and only in terms of their connection with the subject. We also keep a short record of people with the same or a similar name whom our system considered and ruled out as the subject. Web pages we retrieve may also name other people who have no connection with the subject; we do not use their data, and we delete those pages one year after the report (section 10).

5. What personal data we process

Most of this information comes from publicly accessible websites. Because web pages can contain almost anything, our system may briefly process other information before it can tell whether that information relates to the person searched for and whether it is relevant. Anything that does not relate to the subject, or is not relevant to the customer's use, is left out of the report and deleted on the timescales in section 10.

6. Where we get personal data from

7. Our lawful basis

Deep Dive is a controller of the personal data we process to produce DeepDive reports. Each customer is a separate controller for its own use of the reports we give it.

We rely on legitimate interests (Article 6(1)(f) UK GDPR). We have a legitimate interest in providing DeepDive. Our customers and the wider public have legitimate interests in preventing and detecting fraud, money laundering, terrorist financing and other crime, in carrying out proper due diligence, and in supporting lawful investigation and journalism.

We have carried out a legitimate interests assessment, backed by a data protection impact assessment. In it we took into account that most people we report on have no relationship with us, may not expect to be the subject of an automated report, and may not know that one exists. We concluded that our interests are not overridden, given the safeguards described in this notice. These safeguards include customer vetting, contractual restrictions on how customers use reports, filtering out irrelevant and sensitive information, linking every statement to its source, and limits on how long we keep data. You can ask us for more information about this assessment.

Our customers must have their own lawful basis for each search. This may be compliance with a legal obligation, legitimate interests, a public task, or the journalism provisions of the Data Protection Act 2018, depending on the use.

Special category data. Our system is designed to recognise special category data. It includes such data in a report only where the data is relevant to the customer's verified use and one of these conditions applies. The first is substantial public interest (Article 9(2)(g)), where a condition in Part 2 of Schedule 1 to the Data Protection Act 2018 is met. The second is the establishment, exercise or defence of legal claims (Article 9(2)(f)), for litigation-related enquiries only. The third is that the person has manifestly made the information public themselves (Article 9(2)(e)). If no condition applies the information is excluded from the report.

Criminal offence data. We apply the same approach to information about criminal allegations, proceedings and convictions, under Article 10 UK GDPR and section 10(5) of the Data Protection Act 2018. The Schedule 1 conditions we rely on, limited to those that fit the customer's verified use, are:

• paragraph 10: preventing or detecting unlawful acts;
• paragraph 11: protecting the public against dishonesty and malpractice, only where the enquiry is connected with a protective function;
• paragraph 12: regulatory requirements relating to unlawful acts and dishonesty;
• paragraph 13: journalism in connection with unlawful acts and dishonesty;
• paragraph 32: information manifestly made public by the person themselves;
• paragraph 33: legal claims.

Each item of criminal offence data in a report shows its status (for example allegation, charge, conviction or acquittal) and the date of the most recent event, so that an allegation is not mistaken for a finding. Spent convictions are left out of employment screening reports unless the customer confirms the role is one for which they may lawfully be considered. In other reports, a spent conviction is included only where it is relevant to the enquiry, and is marked as spent or possibly spent. We keep an appropriate policy document covering this processing, as the Act requires.

Individuals in the EU. We are established only in the UK. When we report on a person in the EU, we do not offer goods or services to that person or monitor their behaviour: a report is a single review of published information, made for one customer’s enquiry, and we keep no database of people. Our processing is therefore governed by the UK GDPR and the Data Protection Act 2018, and we apply the same conditions and safeguards to every report, wherever the person lives. A customer established in the EU is subject to the EU GDPR for its own use of a report, and must be authorised under the law that applies to it before obtaining criminal offence data.

Automated decision-making. We do not make decisions about anyone, whether automated or otherwise. .

Profiling. We do not carry out profiling because we do not evaluate, score or rate anyone. Customers must independently confirm any significant finding before acting on it, and must not take any significant decision about a person based solely on a DeepDive report.

8. Who we share personal data with

A report is given only to the customer that asked for it, unless that customer asks us to share it with someone else. Customers may not pass reports on without our agreement. We do not sell personal data or use it for marketing.

We use the following service providers to run DeepDive. They process data on our instructions under written contracts.

The commercial data providers listed in section 6 are independent controllers of their own data, not our service providers. To search them, we send them the person’s name and date of birth (or year of birth), and a provider may keep a record of each search on its own systems. For Companies House, we use our own copy of the public register.

We may also disclose personal data to law enforcement agencies, regulators or courts where the law requires it or where it is necessary to establish, exercise or defend legal claims. If Deep Dive is sold or restructured, we may disclose it to a potential buyer or its advisers, who may use it only for the purposes described in this notice.

9. International transfers

Some of our service providers are in the United States. Before transferring personal data there, we check that the protection it will receive is not materially lower than in the UK. We also put one of the following safeguards in place: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment; or the UK Extension to the EU-US Data Privacy Framework.

10. How long we keep personal data

Where a customer subscribes to scheduled re-runs, each re-run is a new report with its own retention period. Re-runs stop when the customer cancels them, when the customer stops using DeepDive, or when an objection from that person is upheld.

We keep reports for six years because that is the limitation period for claims connected with a report. Keeping them also lets us answer questions from the customer, a regulator or the person concerned about how a report was compiled.

We keep stored copies of source pages for these audit purposes. A stored page can contain information that we excluded from the report, but we do not show stored pages to customers in full or use them in the chatbot. Excluding information from a report does not remove it from the original website. A customer who follows a source link will see the page as its owner published it.

11. Security

Our security measures include an information security policy aligned to ISO 27001, Cyber Essentials Plus certification, and encryption of personal data in transit and at rest. Access is role-based, and multi-factor authentication is available to all customer accounts. We commission regular independent penetration tests, and keep regular, tested backups. Our system treats the content of retrieved web pages as data, not instructions, and these controls have been independently penetration-tested. All staff receive data protection and security training.

If a personal data breach occurs, we will report it to the ICO within 72 hours where required. We will tell affected people where there is a high risk to them, and tell affected customers promptly.

12. Your rights

Where we correct, erase or restrict data, we will tell the customers who received the report, and on request we will tell you who they are, unless an exemption applies.

Some rights can be limited by law. In particular, where telling you that a report exists, or which organisation asked for it, would be likely to prejudice the prevention or detection of crime, the Data Protection Act 2018 may allow us to withhold that information. We decide each case on its merits and record our decision.

Making a request. Email privacy@deep-dive.com or write to us at the address in section 14. Requests are free. We may ask for proof of identity, or for details that help us find the information you want. We may pause the one-month deadline for responding while we wait for that information. We normally reply within one month. For complex requests we can extend this by up to two further months, and if we do, we will tell you why.

13. Complaints

If you are unhappy with how we have handled your personal data, please complain to us first using the Contact us form on our website. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Contact us