Privacy Policy
1. Who we are
Lankom Petroleum Ltd is the controller of personal data used for its own website, account administration, billing, enquiries and business operations. Company No. 17178937, registered in England & Wales, registered office at 193 Daneglen Court, London Road, Stanmore, England, HA7 4PL. Data protection contact: info@lankompetroleum.com.
2. Personal data we may process
- Identity and contact information, including name, email, telephone number, job title and organisation.
- Account and authentication information for Deal Intelligence and invited client workspaces.
- Commercial and transaction information, including product requirements, deal notes, counterparties, procedures and project records.
- Documents uploaded by authorised users, which may include CIS/KYC records, company documents, identification documents and supporting evidence.
- Due diligence information drawn from supplied evidence and current public or third-party sources, including corporate, regulatory, sanctions, litigation, insolvency and adverse-media information where lawful.
- Billing and subscription information. Card details are processed by Stripe; we do not need to store full payment-card numbers.
- Technical and security data such as browser/session information, login events, audit trails, IP/security logs and essential browser storage.
3. Sources of personal data
We receive data directly from users, from organisations and counterparties that use our services, from documents uploaded by authorised users, from service providers, and from official registers, sanctions lists, public websites and other lawful public sources used for due diligence.
If you upload personal data about another person, you must have an appropriate lawful basis and authority to do so and must provide any required privacy information to that person.
4. Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Provide accounts, subscriptions, software and support | Contract; legitimate interests |
| Respond to enquiries and commercial communications | Legitimate interests; steps before contract; consent where required |
| Payments, accounting and records | Contract; legal obligation; legitimate interests |
| KYC, sanctions, due diligence and fraud/risk controls | Legitimate interests; legal obligation where applicable |
| Security, audit, abuse prevention and service improvement | Legitimate interests; legal obligation where applicable |
Where consent is the appropriate basis, you may withdraw it at any time without affecting processing already carried out lawfully.
5. Due diligence and AI-assisted processing
Deal Intelligence may use automated and AI-assisted tools to research, organise, compare and summarise information for due diligence. Outputs are decision-support material and should be reviewed by a human. They are not a guarantee that a person or company is genuine, creditworthy, sanctions-clear or suitable for a transaction.
We do not intend Deal Intelligence to make solely automated decisions that produce legal or similarly significant effects on an individual without an appropriate lawful basis and safeguards.
6. Who we may share data with
We may use specialist providers for hosting, authentication/database/storage, email delivery, payments, security and AI-assisted functionality. Current providers may include Supabase, Vercel, Stripe, Resend and OpenAI, depending on the feature used. We may also disclose data to professional advisers, regulators, law-enforcement authorities or other parties where required or lawfully necessary.
We do not sell personal data to advertisers.
7. International transfers
Some service providers may process information outside the UK. Where UK data protection law requires transfer safeguards, we will use an applicable adequacy regulation, the UK International Data Transfer Agreement/Addendum, or another lawful transfer mechanism.
8. Retention
We retain personal data only for as long as necessary for the purpose collected, taking account of the duration of an account or transaction, customer instructions, legal and regulatory record-keeping, security requirements, dispute/claims limitation periods and backup cycles. Uploaded documents may remain until deleted by an authorised customer or until the associated account/retention need ends, subject to lawful backup and record obligations.
9. Security
We use access controls, authentication, tenant/workspace permissions, encryption in transit, audit logging and service-provider security controls appropriate to the nature of the service. No internet service can be guaranteed absolutely secure.
10. Your rights
Depending on the circumstances, UK data protection law may give you rights of access, rectification, erasure, restriction, objection, portability and rights relating to automated decision-making. To exercise a right, contact info@lankompetroleum.com. We may need to verify your identity.
11. Data protection complaints
You can raise a data protection complaint using our Data Protection Complaints procedure. We will provide a clear route for complaints, acknowledge a data protection complaint within 30 days and investigate and respond without undue delay.
You can also complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
12. Changes
We may update this policy where services, law or processing changes. The effective date at the top identifies the current version.