LEGAL

Privacy Policy

Last updated: October 6, 2026 · Version 3.0

This Privacy Policy explains how 7 Baas Limited processes personal data when you use the 7Baas website, client cabinet, Telegram bot @Sbaas_bot and related services (the "Platform"), and the rights you have under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

1. Who we are

7 Baas Limited (company number 15906014), registered office Unit 3-4, The Pixmore Letchworth Business Centre, Pixmore Avenue, Letchworth Garden City, SG6 1JG, United Kingdom, is the controller of personal data processed through the Platform. You can contact us about data protection at admin@7baas.com with "Data protection" in the subject line.

2. Whose data we process

We process personal data about users of the Platform and about individuals connected with them, including directors, shareholders, beneficial owners, employees and advisers of Buyers, Sellers and target companies, and individuals named in documents uploaded to the Platform.

3. Personal data we collect

Account data — name, e-mail address, phone number, company, role, password (stored only in hashed form) and account settings.
Sign-in data — if you sign in with Google or Telegram: your Google account identifier, name and verified e-mail address, or your Telegram user ID, username, name and profile photo link, as provided by those services.
Identity verification data — identity document details and images, a selfie or short video used for liveness and face matching, date of birth, nationality, address, and the result of the check. Face matching involves biometric data.
Business verification data — corporate documents and information about directors, shareholders and ultimate beneficial owners.
Screening data — results of sanctions, politically exposed person and adverse media checks.
Deal data — listings, enquiries, offers, deal status and history, documents you upload or access in a Deal Room, and records of access.
NDA and consent records — the name you type as your signature, confirmation of authority, the version of the document accepted, the date and time, your IP address and browser user agent.
Payment data — invoices, bank account names and details of paying and receiving accounts, payment references, and for crypto payments the sending wallet address, transaction hash and amount. We do not collect payment card details.
Communications — messages you send us by e-mail, through forms or through the Telegram bot, and your Telegram chat ID if you link the bot to your account.
Technical data — IP address, browser and device information, pages visited, and cookie data as described in the Cookie Policy.

4. Where we get it from

From you; from your organisation or adviser; from the other party to a Deal; from identity verification and screening providers; from Google or Telegram when you use them to sign in; and from public registers such as Companies House and regulators' registers.

5. Why we use it and our lawful bases

To create and run your account, publish Listings, operate Deals and the Deal Room, and provide services you order — performance of a contract with you, or our legitimate interest in operating the Platform where you act for an organisation.
To verify identity, carry out business verification and sanctions, PEP and adverse media screening, monitor transactions and keep records — compliance with legal obligations, and our legitimate interest in preventing fraud, money laundering and financial crime. Biometric data used for face matching is processed under Article 9(2)(g) UK GDPR and Schedule 1 to the Data Protection Act 2018 (preventing or detecting unlawful acts), or with your explicit consent where the identity verification provider relies on it.
To record NDA signatures and acceptance of our terms — performance of a contract and our legitimate interest in being able to prove agreements.
To invoice, receive and reconcile payments and administer escrow settlement — performance of a contract and compliance with legal obligations.
To send service messages by e-mail and through the Telegram bot — performance of a contract.
To secure the Platform, prevent abuse and improve our services — our legitimate interests.
To send marketing — your consent, or our legitimate interest in sending business contacts information about similar services, with an opt-out in every message.
To use non-essential cookies — your consent.
To establish, exercise or defend legal claims and respond to authorities — our legitimate interests and legal obligations.

6. Automated checks

Identity verification uses automated document checks, liveness detection and face matching. If an automated check fails or is inconclusive, a member of our team reviews it before any decision to refuse access is made. You can ask for a human review of any decision by contacting us.

7. Who we share it with

The other party to a Deal — for example, a Seller sees the identity of a Buyer who signed the NDA, and Buyers see Deal Room documents. We share only what is needed for the Deal.
Identity verification and screening providers — currently Didit, which verifies identity documents and performs liveness and face matching on our behalf.
Sign-in providers — Google and Telegram, when you choose to use them.
Banks, payment and crypto-asset service providers — including the bank holding our accounts and the crypto-asset exchange we use to receive USDT payments, to process and reconcile payments.
Hosting, e-mail and IT providers — which host the Platform and deliver our e-mails under our instructions.
Professional advisers — our lawyers, accountants, auditors and insurers.
Authorities — regulators, law enforcement, tax authorities and courts, where we are required or permitted by law, including suspicious activity reports to the National Crime Agency.
A buyer of our business — if we sell or restructure our business, subject to confidentiality.

We do not sell personal data.

8. International transfers

Our servers are located in the United Kingdom, the European Economic Area or in countries that the United Kingdom recognises as providing an adequate level of protection. Some of our providers and some Deal counterparties are located elsewhere. Where we transfer personal data outside the United Kingdom, we rely on UK adequacy regulations or on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for details of the safeguards used.

9. How long we keep it

Account data — for as long as your account is open, and for 6 years after closure for legal claims.
Identity, business verification, screening and transaction records — at least 5 years after the end of our relationship or the completion of the transaction, as required by anti-money laundering law, and longer where required by law or an ongoing investigation.
Raw identity document images and liveness media — held by the identity verification provider for the period agreed with it and then deleted; we keep the verification result and the record of the check.
Signed NDAs, consent records and Deal Room access logs — for the duration of the NDA plus 6 years.
Invoices and accounting records — 6 years from the end of the financial year to which they relate.
Marketing preferences — until you withdraw consent or object.

10. Your rights

Subject to conditions and exemptions under the law, you have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict processing; object to processing based on legitimate interests or for direct marketing; receive data you provided in a portable format; and withdraw consent at any time without affecting earlier processing. Some rights are limited where we must keep data to comply with anti-money laundering law.

To exercise your rights, e-mail admin@7baas.com. We respond within one month, which may be extended where the law allows. We may need to verify your identity first.

11. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, encrypted backups, private storage for Deal Room documents with access only through permission-checked downloads, access controls for staff, and logging. No system is completely secure, and we cannot guarantee absolute security.

12. Children

The Platform is for business use and is not intended for anyone under 18. We do not knowingly collect children's data.

13. Changes

We may update this Privacy Policy. The version number and "Last updated" date are shown at the top of this page, and we will tell registered users about material changes.

14. Complaints

If you have concerns, please contact us first at admin@7baas.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113).