Privacy Notice

Controller

Cerdas Labs Sdn. Bhd. (company number 202601002615 / 1664712-A), a company registered in Malaysia and trading as SettleIQ, is the controller for personal data collected through settleiq.co.uk. Contact: team@settleiq.co.uk. Cerdas Labs Sdn. Bhd. is a data controller established in Malaysia, with no establishment in the UK. On that basis, and following our own assessment against the ICO's data protection fee self-assessment tool, we are exempt from paying the ICO data protection fee and do not hold an ICO registration number. We remain fully committed to UK GDPR compliance, including via our appointed Article 27 Representative below.

• Email — datarequest@datarep.com, quoting "SettleIQ" in the subject line.
• Webform — via DataRep's data request form.
• Post — DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. Address correspondence to "DataRep", not SettleIQ, and reference SettleIQ within the letter.

You may also contact us directly on any matter relating to the processing of your personal data using the details above.

What we collect

If you only read the site. Our host records the technical information any web server needs to serve a page: your IP address, the page requested, the time, and your browser's user-agent string. This is used to deliver the site and to keep it secure against abuse, and is not used to build a profile of you. If you accept non-essential cookies, Google Analytics also collects usage information — see Analytics below.

If you submit a Folio request. Your name, email address, optional phone number, and the property address and details you supply. No payment is taken at this stage. Card or payment details are never entered on, transmitted through, or stored by settleiq.co.uk — once your folio is ready, we email a separate payment link hosted by Dodo Payments, our payment provider, and Dodo Payments handles payment entirely on their own page.

If you enquire through our partner page. Your name, firm name, email, optional phone number, partner type, professional registration number (where relevant), estimated client volume, and any notes you add — used to assess and respond to that enquiry. If a partnership proceeds and we pay you, we will additionally hold the payment details needed to do that.

Why

To produce and deliver the Folio you commissioned (performance of a contract), to meet accounting and tax obligations (legal obligation), and to improve the methodology using aggregated, non-identifying information (legitimate interests).

On that last basis: our interest is in knowing where the methodology performs poorly — which cohort sizes, property types and areas produce weak or unusable results — so that it can be fixed. We have assessed this against your interests and consider the impact minimal, because the work is done on aggregated figures rather than on you: nothing that identifies you, and no property address, is used for it. You can object to this at any time and we will stop — see Your rights below.

Property addresses

The address you submit is used to assemble the research and is retained with your order record. We do not disclose to any seller, agent or third party that a specific address has been researched. Addresses are never used to train any machine-learning model, public or private.

Who we share it with

We use a small number of processors to run SettleIQ, each acting only on our instructions:

• Cloudflare — settleiq.co.uk is hosted and served through Cloudflare Pages, so Cloudflare processes the request data described above (including your IP address) on our behalf in order to deliver the site and protect it from attack.
• Google Workspace — request-form and partner-form submissions are written to a Google Sheet, and confirmation emails are sent via Google's infrastructure, so Google processes this data as our processor.
• Dodo Payments — our Merchant of Record, handles the £480 payment on its own page once your folio is ready; we never see or store your card details. Dodo Payments is the legal seller for that transaction and processes your payment details as an independent controller for its own compliance, tax and fraud-prevention purposes — see Dodo Payments' own privacy notice for how it handles your data at the payment stage.
• Google Analytics — see below and our Cookie Policy for when this loads and what it is used for.
• Airwallex — our business banking and treasury provider. It receives our settlement payouts from Dodo Payments, and we use it to pay our suppliers and, where a partnership proceeds, our partners. It therefore processes the payment details of partners and suppliers we pay. It does not receive buyer personal data: a Folio payment reaches us from Dodo Payments as a settlement figure, not as a named transaction.

We do not sell personal data, and we do not share it with any seller, listing agent, or other party to a transaction you are researching.

International transfers

Cerdas Labs Sdn. Bhd. is incorporated in Malaysia, which does not currently hold a UK adequacy decision, so personal data collected through settleiq.co.uk from UK data subjects is transferred to Malaysia for processing, and may also be processed outside the UK by our service providers. Where this happens, we rely on the following safeguards:

• Google (Workspace, Apps Script, Analytics) — transfers are covered by Google's Cloud Data Processing Addendum, which incorporates the UK Addendum to the EU Standard Contractual Clauses. We have certified that UK data protection law applies to our use of Google's services and named the ICO as our supervisory authority.
• Dodo Payments — transfers are covered by Dodo Payments' Data Processing Agreement, which incorporates both the EU Standard Contractual Clauses and the UK Addendum by reference for UK data subjects. Dodo Payments holds a PCI DSS v4.0.1 Level 1 certification for its payment processing services.
• Cloudflare — transfers are covered by Cloudflare's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK Addendum for UK data subjects.
• Airwallex — transfers are covered by the UK International Data Transfer Agreement (IDTA), incorporated into our Master Services Agreement with Airwallex. This safeguard is relevant to partner and supplier payment data, not to buyer data, for the reason given above.

Each of these mechanisms requires the receiving party to apply UK-equivalent safeguards to your data regardless of where it is processed.

These transfer safeguards are separate from, and do not depend on, our appointment of a UK Article 27 representative described under Controller above: the SCCs and IDTA above are what make the transfers themselves lawful, while DataRep exists so that UK data subjects and the ICO have a UK point of contact for us regardless of where any given transfer takes place.

Analytics

We use Google Analytics, which is not cookieless — it sets cookies on your device to measure how visitors use the site. It only loads after you accept non-essential cookies through our consent banner; the lawful basis for this processing is your consent, which you may withdraw at any time by changing your choice — see our Cookie Policy for how.

Withdrawing consent stops any further analytics collection and deletes the Google Analytics cookies already held on your device, so you are no longer recognised as the same visitor. Usage data already collected and held by Google before you withdrew is retained for 14 months from the activity it relates to, after which Google deletes it automatically. That data is not linked to your name, email address or the property address you submitted.

Retention

We keep Folio order records, including the address researched and your contact details, for 7 years from the end of the year of assessment in which the order was placed. Cerdas Labs Sdn. Bhd. files its tax returns in Malaysia, and sections 82 and 82A of the Malaysian Income Tax Act 1967 require business records to be retained for seven years. Dodo Payments, as Merchant of Record, keeps its own transaction and tax records separately under its own obligations.

The published folio page itself stays live for 12 months from delivery, after which it is taken down. The underlying order record is kept for the seven-year period above, so we can restore your folio on request.

Partner enquiry details that do not convert to a partnership are kept for 12 months and then deleted. Where a partnership does proceed, the records become part of our supplier accounting and follow the same seven-year period.

Your rights

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Two of these are worth spelling out because of how we rely on them:

• Withdrawing consent. Where we rely on your consent — which is only for analytics cookies — you may withdraw it at any time under Article 7(3), and it must be as easy to withdraw as it was to give. The Cookie Policy has a one-click control that does it. Withdrawal does not affect the lawfulness of anything processed before you withdrew.
• Objecting to legitimate interests. Where we rely on legitimate interests — which is only for improving the methodology, described above — you may object under Article 21. We will stop unless we can show compelling grounds that override your interests, and in practice we would simply stop.

To exercise any of them, email team@settleiq.co.uk or contact our UK representative, DataRep, using the details in the Controller section above. You may also complain to the Information Commissioner's Office at ico.org.uk.

Automated decision-making

A Buyer Folio is produced by an automated analytical pipeline, but it makes no decision about you. It analyses a property address against public registers and produces a report for you to act on. There is no automated decision-making or profiling that produces legal effects concerning you, or that similarly significantly affects you, within the meaning of Article 22 UK GDPR. We do not score, rank or assess the individuals who submit requests, and we do not use your data to make decisions about whether to serve you.