LEGAL / PRIVACY
Privacy policy.
This notice explains how Cyber Theft Watch handles personal data when you visit our website, contact us or interact with our services.
Last updated 7 September 202601 / WHO WE ARE
About this notice.
Cyber Theft Watch (referred to as “Cyber Theft Watch”, “we”, “us” or “our”) is responsible for deciding how and why the personal data described in this notice is used, unless we are processing it solely on behalf of a client.
When we provide monitoring, protection, rights-management or enforcement services for a client, we may act as a controller, a joint controller or a processor depending on the circumstances. Where we act only on a client's instructions, that client's privacy notice and our agreement with them govern the processing.
This policy applies to our public website and business enquiries. Separate contractual terms, data-processing terms or notices may apply to client accounts, our platform, employees, contractors and suppliers.
02 / INFORMATION WE COLLECT
Information we may hold.
Information you give us
When you contact us, request a scan, report an urgent infringement or discuss our services, we may collect your name, company email address, organisation, the nature and urgency of your enquiry, your message and any files, links or evidence you choose to provide. If you become a client or supplier, we may also process business contact, account, contract, billing and correspondence records.
The fields marked as required on our forms are needed so we can understand and respond to your request. If you do not provide them, we may be unable to assist.
Technical and security information
Our website and infrastructure may record IP address, browser and device information, dates and times, pages requested, referring pages, security events and information contained in essential cookies. We use this information to operate, diagnose and protect the website and our systems.
Protection and enforcement information
To provide our services, we may receive information from clients and collect information from publicly accessible sources such as websites, search results, social platforms, marketplaces, streaming services, domains and online listings. This may include usernames, profile or seller identifiers, URLs, account details made public by their owner, published content, listings, evidence of suspected infringement and related technical information.
We do not intentionally ask website visitors to provide special-category data, financial credentials or government identification. Please do not include such information in a general enquiry unless it is necessary for us to handle your matter. Where sensitive information is relevant to an enforcement case, we limit its use to what is necessary and permitted by applicable law.
03 / HOW WE USE INFORMATION
Purposes and lawful bases.
Where we rely on legitimate interests, we consider whether the processing is necessary and balance those interests against the rights and freedoms of the people concerned. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.
Automated processing
We may use technology to identify, group and prioritise potential threats for review. We do not use personal data collected through this public website to make solely automated decisions that produce legal or similarly significant effects about visitors.
04 / SHARING INFORMATION
When information leaves our team.
We do not sell personal data. We disclose it only where reasonably necessary for the purposes described in this notice, including to:
- hosting, infrastructure, communications, email-delivery, security and professional-service providers acting for us;
- Google, when reCAPTCHA is used to distinguish people from automated submissions;
- our clients and their authorised representatives where information relates to services we provide for them;
- platforms, hosting providers, search engines, marketplaces, domain registrars, payment providers or other intermediaries where disclosure is needed to report, investigate or act on suspected abuse;
- legal, regulatory, law-enforcement or public authorities where disclosure is required or permitted by law; and
- a buyer, investor or adviser involved in a genuine corporate transaction, subject to appropriate confidentiality safeguards.
Providers that process personal data for us are expected to handle it only for authorised purposes, apply appropriate safeguards and comply with applicable data-protection obligations.
05 / COOKIES AND RECAPTCHA
Website technology.
We use essential technologies needed to operate and secure the public website. We do not currently use non-essential advertising cookies on this website.
Our contact form is protected by Google reCAPTCHA. When you open and use the form, Google may receive technical information about your browser, device and interaction and may set the necessary _GRECAPTCHA cookie for risk analysis. Google's Privacy Policy and Terms of Service apply to its processing.
Pages may also link to or embed content from other websites. Those services operate under their own privacy notices and may collect information as if you had visited them directly. We are not responsible for how independent third-party websites handle personal data.
06 / INTERNATIONAL TRANSFERS
Working across borders.
Cyber Theft Watch operates internationally, including through offices in the United Kingdom and Singapore, and some service providers or recipients may process information in other countries. Data-protection laws in those countries may differ from those in the United Kingdom.
Where applicable law requires safeguards for an international transfer, we use an available lawful mechanism appropriate to the transfer, such as an adequacy regulation, contractual protections or another recognised safeguard. You may contact us for more information about safeguards relevant to your personal data.
07 / RETENTION AND SECURITY
How long we keep information.
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide services, respond to enquiries, maintain accurate business and security records, comply with law and resolve or defend disputes.
Retention periods vary according to the nature and sensitivity of the information, the risk associated with keeping it, client instructions and contractual requirements, relevant limitation periods, and legal or regulatory obligations. When information is no longer required, we delete it, anonymise it or securely isolate it until deletion is possible.
Security
We use organisational and technical measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. Access is limited according to role and need. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security. If a personal-data breach occurs, we will assess it and notify affected people or regulators where the law requires.
08 / YOUR RIGHTS
Your choices and rights.
Depending on the law that applies and the circumstances of the processing, you may have the right to:
- be informed about how your personal data is used;
- request access to personal data we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information in certain circumstances;
- ask us to restrict processing in certain circumstances;
- receive certain information in a portable format;
- object to processing based on legitimate interests or to direct marketing;
- withdraw consent where processing is based on consent; and
- raise a complaint with a data-protection authority.
You may object at any time to direct marketing. You may also object to processing based on legitimate interests where your particular situation gives you grounds to do so. We will consider the request and stop processing where required by law.
These rights are not absolute and exemptions may apply. We may ask for information reasonably necessary to confirm your identity or authority before acting on a request. Exercising a right will not normally involve a fee, but the law may permit a reasonable fee or refusal where a request is manifestly unfounded or excessive.
09 / CONTACT AND COMPLAINTS
How to reach us.
To ask a privacy question, exercise a right or make a data-protection complaint, use our contact form and select “Other”. Please begin your message with “Privacy request”. Existing clients may also contact their account manager.
Cyber Theft Watch71–75 Shelton Street
Covent Garden
London WC2H 9JQ
United Kingdom
You have the right to complain to the UK Information Commissioner's Office (ICO).
Children
Our public website and services are intended for businesses and professional users and are not directed at children. We do not knowingly collect personal data from children through this website. If you believe a child has provided information to us, please contact us so we can review and, where appropriate, remove it.
Changes to this policy
We may update this policy when our services, providers or legal obligations change. The latest version will always appear on this page with its revision date. Where a change materially affects how we use information, we will take reasonable steps to provide additional notice where required.