Privacy Notice

Effective date: 15 June 2026

PensionHunter provides a three-tier pension research service (Country Pension Identification Report, Search and Global) across 41 countries. This Privacy Policy applies to all three tiers, to pre-launch waitlist members, and to all Clients and website visitors.

This Privacy Notice is structured into two clearly marked sections to accurately reflect waitlist/chatbot processing (Section A) and paid research service processing (Section B).

---

SECTION A, Waitlist & Chatbot

PensionHunter operates a live pension research service alongside a pre-launch waitlist. This section describes waitlist and chatbot processing; Section B describes processing for clients using the paid research service.

What we collect: first name, email address, country you worked in. We also confirm you are 18 years of age or over before accepting your signup.

Why: to contact you when slots open, to confirm waitlist status, and to provide service updates.

Legal basis: consent under UK GDPR Article 6(1)(a). You actively joined the waitlist.

Retention: maximum 24 months from signup or until you unsubscribe, whichever is sooner.

Processors: Brevo (email service provider, UK GDPR compliant), Supabase (database host, UK GDPR compliant). No other sharing.

Chatbot conversations (retired). The on-site chat assistant has been retired and is no longer in operation. No visitor conversations are processed through it. While the assistant was active, chat messages were logged to our database (Supabase) and processed via Anthropic's Claude API solely to generate replies. Historic chat records remain subject to the retention and deletion terms that applied at the time: visitors could request deletion by emailing hello@pensionhunter.ai with the subject line "Delete my chat history", and we deleted all chatbot conversation records associated with that email or session within 30 days.

Your rights: access, rectification, erasure, portability, withdrawal of consent. Email hello@pensionhunter.ai to exercise any right. Right to complain to the ICO at [ico.org.uk](https://ico.org.uk).

---

Beneficiary Registry Data

PensionHunter offers a free beneficiary registration service. When you register, we collect:

- Your name (first and last) - Your email address - Your date of birth - Countries where you have worked - Approximate employment period (start and end years) - Former employer names where you provide them - Your explicit consent to our use of this data

Purpose: We use this data exclusively to match your details against pension research findings when we operate cross-border searches across 41 jurisdictions. If we identify a pension that may belong to you, we will email you directly with our findings.

Lawful basis: Article 6(1)(a) UK GDPR, explicit consent. You provide consent at the point of registration via a checkbox confirmation.

Retention: We retain registry data for as long as you remain registered or until you request deletion. If we have not communicated with you for 24 months and you have not engaged with any communication, we will email you to confirm whether you wish to remain on the registry. If we receive no response within 30 days of that confirmation request, we will delete your registry data.

Your rights: You have the right to: - Withdraw consent at any time - Request access to your data - Request correction of your data - Request deletion of your data - Lodge a complaint with the UK Information Commissioner's Office (ICO ZC113586)

How to exercise rights: Email hello@pensionhunter.ai. We respond within 30 days as required by UK GDPR.

Data processors: Your registry data is stored in Supabase (data processor under DPA). Brevo handles email delivery (data processor under DPA). Both processors are GDPR-compliant.

Data sharing: We do not sell registry data. We do not share registry data with third parties except our named data processors. If we ever consider sharing registry data with institutional partners (for example, pension trustees searching for beneficiaries), we would require fresh explicit consent from each registrant before doing so.

---

SECTION B, CURRENT PROCESSING, Pension Research Service (Clients)

*Applies to all clients who purchase or use our report, Search or Global research service.*

1. Who We Are (Data Controller)

BatterseaPark Capital Ltd, trading as PensionHunter, is the data controller for personal information collected through the research service.

- Registered in England and Wales, Company No. 13326151 - Registered with the Information Commissioner's Office, ICO Registration No. ZC113586 - Contact: hello@pensionhunter.ai

2. What Data We Collect

We collect personal data necessary to carry out pension research for you, including:

- Identity information: full name, date of birth, previous names, current and former addresses, nationality, country of birth - Optional NI / tax reference numbers for markets where administrators quote them in scheme correspondence: UK NINO, Ireland PPS, Australia TFN, New Zealand IRD, Canada SIN. Always optional. - Employment history: former employers, employment dates, job titles - Pasted or uploaded work history (free checker): where you choose to paste your work history or drop a profile PDF into the free checker, that information is supplied voluntarily by you, about yourself. We keep only the tidy list of employers, countries and years you confirm on screen. We do not retain the raw text you pasted, and any PDF is read in your browser and never uploaded to us. Free check data is deleted after 30 days unless you start a case. - Pension data: any provider names, scheme references or correspondence you share with us - Payment data: processed by Stripe, we do not store full card numbers - Communications: emails, chat messages, uploaded signed authority documents (Information Request Authority only)

We never buy your data from anyone, and we never collect it from LinkedIn or any other platform. You hand it to us yourself or we do not have it.

We never ask for or store your passport or identity documents. If a pension provider requires identity verification, they will verify you directly.

3. Lawful Basis (Research Service)

- Contract (Article 6(1)(b)), to perform the research service you have purchased - Legal obligation (Article 6(1)(c)), for tax, anti-money-laundering and accounting records - Legitimate interests (Article 6(1)(f)), fraud prevention and service improvement - Consent (Article 6(1)(a)), for any optional uses such as case studies

4. Retention (Research Service)

We keep client case files for 7 years after the case is closed, in line with HMRC and professional record-keeping standards. After that period the records are securely deleted.

5. Processors (Current and Future)

We use the following processors. Each operates under a written data processing agreement and processes personal data only on our documented instructions.

| Processor | Purpose | Jurisdiction | Status | |---|---|---|---| | Brevo | Email service provider (waitlist confirmations, transactional and service emails) | European Union (UK adequacy) | Active | | Supabase | Database host and file storage | European Union | Active | | Anthropic | AI inference for the on-site chat assistant (now retired) | United States (UK SCCs / IDTA in place) | No longer in use | | Plausible Analytics | Privacy-first, cookieless website analytics (no personal data, no cross-site tracking) | European Union | Active | | Cloudflare / Lovable hosting | CDN, DNS and edge security | Global (UK SCCs / IDTA in place) | Active | | Stripe | Payment processing | United States / Ireland (UK SCCs / IDTA in place) | Active | | GoCardless | Direct debit processing | United Kingdom | Configured but inactive, activates at launch |

---

Cookies and analytics

No tracking cookies. We do not use Google Analytics, Facebook Pixel, Microsoft Clarity, or any advertising/marketing cookies. Website analytics are handled by Plausible Analytics, a privacy-first, cookieless product that does not track individuals across sites and stores no personal data.

The site sets only the following strictly-necessary cookies, which are exempt from consent under PECR regulation 6(4) because they are essential to deliver the service you requested:

- `__cf_bm`: set by Cloudflare for bot and abuse mitigation. Session-scoped (~30 minutes). - `__dpl`: set by our hosting provider to route you consistently to the correct deployment.

Neither cookie is used for advertising, profiling, or cross-site tracking. Because we set no non-essential cookies, no cookie banner is displayed.

---

UK GDPR, Your Rights

Under UK GDPR you have the following rights over the personal data we hold about you:

- Right of access, ask for a copy of the data we hold about you - Right to rectification, ask us to correct anything wrong or out of date - Right to erasure, ask us to delete your data ("right to be forgotten") - Right to data portability, receive your data in a structured, machine-readable format - Right to withdraw consent, change your mind at any time - Right to object, ask us to stop processing your data - Right to restrict processing, ask us to pause processing while a query is resolved

Email hello@pensionhunter.ai to exercise any right. We will respond within 30 days.

Right to complain: if you are unhappy with how we handle your data you may complain to the Information Commissioner's Office (ICO), [ico.org.uk](https://ico.org.uk), Helpline 0303 123 1113.

---

EU GDPR, Rights for EU/EEA Residents

If you are resident in the European Union or European Economic Area, your processing is governed by Regulation (EU) 2016/679 (EU GDPR) in addition to UK GDPR. You have the following rights under EU GDPR:

- Article 15, right of access - Article 16, right to rectification - Article 17, right to erasure ("right to be forgotten") - Article 18, right to restriction of processing - Article 20, right to data portability - Article 21, right to object - Article 22, right not to be subject to automated decision-making - Article 7(3), right to withdraw consent at any time

Right to lodge a complaint with an EU supervisory authority: EU/EEA residents may complain to the data protection authority of their country of residence. For example, residents of the Netherlands may contact the Autoriteit Persoonsgegevens at [autoriteitpersoonsgegevens.nl](https://autoriteitpersoonsgegevens.nl).

Other EU/EEA residents can find their national supervisory authority at [edpb.europa.eu](https://edpb.europa.eu/about-edpb/about-edpb/members_en).

---

Data Breach Notification

In the event of a personal data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33. We will notify affected data subjects directly without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by UK GDPR Article 34.

Where the breach affects EU/EEA residents, we will additionally notify the relevant EU supervisory authority within 72 hours in accordance with Article 33 of EU GDPR.

---

International Transfers

PensionHunter may transfer personal data outside the UK and EU in the course of providing our service. For transfers to countries with UK adequacy decisions (the EU/EEA, Japan, New Zealand, Canada, partial, South Korea, Switzerland), no additional safeguards are required. Brevo is based in the European Union and falls within UK adequacy.

For transfers to countries without UK adequacy decisions, including the United Arab Emirates, Malaysia, Singapore and Hong Kong, and US-based processors such as Anthropic, Google, Microsoft, Meta and Stripe, we implement the UK International Data Transfer Agreement or Standard Contractual Clauses (the EU SCCs together with the UK Addendum) as the legal mechanism, supported by a Transfer Risk Assessment. Copies of applicable transfer safeguards are available on request.

Personal data transferred internationally is limited to the minimum necessary to provide our service and remains subject to the same rights and protections described in this Privacy Notice.

---

Age Verification

PensionHunter is designed for adults seeking to locate their own pension entitlements. We do not knowingly process personal data of any person under the age of 18, and our waitlist signup form requires you to confirm you are 18 or over before submitting. If you believe we have inadvertently collected data from a minor, please contact us immediately at hello@pensionhunter.ai and we will delete the data.

---

Special Category Data

We may process special category data under UK GDPR Article 9, including data relating to health (for example where clients are affected by dementia and family members act under a Lasting Power of Attorney). Processing of such data is conducted under Article 9(2)(a) explicit consent, and Article 9(2)(h) for the provision of health or social care services where applicable. Special category data is not processed for waitlist or chatbot users.

---

Security

Your data is stored on encrypted servers with access controls, transport-layer encryption (HTTPS/TLS), and audit logging. Only a small number of authorised staff can access waitlist or client data, and only for the purposes set out above.

---

Changes to This Notice

If we change this Privacy Notice we will update the effective date at the top of the page. If the changes are significant we will email everyone on the waitlist before the changes take effect.

---

Contact

For any data protection question, request, or complaint: hello@pensionhunter.ai

BatterseaPark Capital Ltd (trading as PensionHunter) · Company No. 13326151 · ICO Registration No. ZC113586 · pensionhunter.ai