Privacy Notice

Last updated: October 2026

1. Introduction

This privacy notice explains how Branch² ("we", "us", "our") processes personal data in connection with our market intelligence service. It applies to the personal data of company officers and persons with significant control (PSC) that we source from public registers such as Companies House (CH) and display in the Atri platform; to the personal data of people who hold an account with us; and to the personal data of people who sign up for our email updates, use our service without an account, or visit our website. Section 3 sets out what we process about each group, and section 4 where it comes from.

2. Data Controller

Branch² is the data controller for personal data processing under UK-GDPR. Atri is the product operated by Branch².

3. Personal Data We Process

A. Company officers and persons with significant control (PSCs). We process the following personal data sourced from Companies House:

• Officer names, roles, and appointment dates
• The names of persons with significant control (PSCs) — the people Companies House lists as owning or controlling a company — with the company they control and the nature of their control as shown on the register
• Resigned/appointed dates and position histories

If we keep a record of a PSC, it contains only their name (and a lower-case copy of it used for search), the reference Companies House gives their entry at that company, the company they control, a link to the Companies House page it came from and, where it applies, the date their control ended. Companies House also publishes a PSC's month and year of birth, nationality and country of residence. We do not keep these. We do not keep a record for anyone Companies House lists as protected, or for anyone whose published month and year of birth shows they may be under 18 or is missing.

Companies House gives a PSC a separate identifier for each company, so we keep a separate record for each company a person controls and we do not join these records together. A PSC record in Atri therefore shows one company, not everything that person controls.

Company pages also show each company's current list of PSCs — their names, how they control the company and the relevant dates — fetched from Companies House when the page is opened. We do not keep that list in our database, and it is not restricted to signed-in users, just as it is not on the Companies House website.

We do not store correspondence or residential addresses, date of birth, nationality, country of residence, occupation, or the full text of PSC statements, in compliance with data minimisation principles.

B. People who hold an account with us. If you hold an account, we process the following personal data about you:

• Identity and sign-in details — the email address you register with; your password, which our sign-in provider keeps only in scrambled (hashed) form; if you sign in with Google, the name, email address and profile picture link that Google shares with us; when you signed up and last signed in; and the region you use the service in.
• Preferences and settings — the preferences and settings you choose, such as your alert threshold and daily alert limit, whether and when you get the daily digest, how your news feed is weighted, your display theme, and whether Atri emails are paused.
• Watchlist and interests — the companies, suppliers, people (such as company directors) and topics you add to your watchlist, with any labels, notes, expected invoice amounts or descriptions you give them and whether you have marked that you hold it; the interest weightings we work out from your watchlist and business details; and, where you describe in your own words what you want watched, that description and the summary produced from it by the outside AI service we send it to. We send your description to that service only to produce that summary.
• Business details — the business details you enter, such as your business name, sector, region and the state or area it is in, and the suppliers, vendors and costs you track: what you spend on them, contract terms, renewal and notice dates, and whether they are priced in a foreign currency.
• What we match to you — the news, events and scenarios we have matched to your watchlist or business, why they matched, our estimate of which way your costs could move and how severe the effect could be, and any analysis we have written for you.
• Alerts and emails — the alerts, daily digests and other emails we send you, when we sent them, whether you have marked them as read in the app, and what you did with each alert (done, snoozed or dismissed, with any reason you give).
• WhatsApp alerts, if you turn them on — your mobile number, your WhatsApp ID, when you turned WhatsApp alerts on or off, when you last messaged us on WhatsApp, and the delivery and read status that WhatsApp reports back for each message.
• Plan, access and payments — whether your access has been approved and, for a trial, when it ends; your plan; notes we record when we change your plan or decide on your access; and the customer, subscription and invoice references our payment provider gives us. You enter card details on our payment provider's own pages; we never receive your full card number.
• Records of your use of the service — which parts of the app you use (for example, briefs viewed, stories opened and items added to your watchlist), the searches you type, errors you run into, a record of each analysis you run that counts towards your plan's limits, and which version of the service you are shown when we compare versions.
• Technical information — the IP address and browser details of each signed-in session, the IP address and browser details used when you sign up, and the IP address used for each analysis that counts towards your plan's limits.
• Keys you add, if any — keys you create to use our API (we keep only a scrambled copy and a short hint so you can recognise them), and your own key for an AI provider (which we store encrypted), with a record of each request made with that key.
• Messages and feedback you send us — messages you send us through the app or by email, reports you make about data you think is wrong or about how a story was explained, and, for messages sent in the app, the page you were on and your browser details.
• Reports you choose to share — when you create a share link for a report, a copy of that report as it stood at the time, which anyone with the link can open for 30 days.

You must give us an email address, or sign in with Google, to open an account. Everything else is optional, but without a watchlist or business details the service has nothing to watch for you.

C. People who sign up for email updates, use the service without an account, or visit our website.

• Email updates — if you sign up for email updates, your email address, where on our site you signed up, the IP address you signed up from, when you confirmed your subscription and, if you unsubscribe, when you did so. If you sign up from our free cost exposure check, we also keep the country, sector and costs you chose, the wording of the consent you gave, when you gave it, and the website that sent you to us, so that the briefing covers the costs you asked about.
• Company analyses run without an account — if you run a company analysis without signing in, the IP address you used, which kind of analysis you ran and when, so that we can apply the free daily limit.
• Website visits — when you visit our website we record the page you viewed (without anything after a "?" in its address, and without any sign-in codes), the name of the website that sent you, your type of device, and whether the visit looks automated. To count unique visitors without identifying anyone, we combine your IP address and browser details with a secret value and the date, keep only the scrambled result, and then discard the IP address and browser details. Because the date is part of it, the result changes every day.

Cookies and similar technologies. We use a cookie and your browser's local storage to keep you signed in. We also use local storage to remember choices you make in the app (such as your region and theme), your recent searches, your progress through the in-app guide, any support conversation you start in the app, and copies of recently loaded information so the app opens faster. This information stays on your device, and you can clear it at any time in your browser's settings; the app still works, but you will need to sign in and make your choices again. We use no advertising or third-party analytics cookies, and our website visit counts use no cookies at all.

4. Source of Data

Personal data in the platform comes from the sources below.

Public registers. The officer and person-with-significant-control data described in section 3 is sourced from Companies House, a UK public register. That data is publicly available and published under the Open Government Licence v3.0. We did not collect it from the people concerned. Companies House publishes the PSC register so that anyone can see who owns and controls UK companies.

Account holders. If you hold an account with us, we also process personal data about you: the email address you register with, the preferences and settings you choose, the companies and suppliers you add to your watchlist, the business details you enter, records of your subscription, and records generated by your use of the service — such as the analyses you run and the notifications we send you.

Most of this comes from you: what you enter, and what our systems record when you use the service. If you sign in with Google, Google shares your name, email address and profile picture link with us. If you sign up for email updates, run a company analysis without an account, or visit our website, the data described in section 3C comes from you and your browser.

5. Purpose of Processing

We process public-register data about company officers and PSCs for the following purposes:

• Providing market intelligence and corporate analysis
• Entity resolution and relationship identification
• Enabling users to understand corporate governance and control structures
• Letting signed-in users follow a named company officer. Any news or alerts this brings to their attention are chosen using the companies linked to that person, never the person's name

We process the personal data of people who hold an account with us to:

• Create and secure your account and let you sign in
• Watch the companies, suppliers, people and topics you choose, match news, events and scenarios to them and to your business details, and send you the alerts and digests you have asked for
• Produce the reports you ask for and the share links you create
• Decide and manage your access and plan, take payment and keep the payment records the law requires
• Answer your messages and feedback, and handle your data protection requests and complaints
• Keep the service secure, apply the limits of your plan and prevent misuse
• Understand how the service is used, so that we can fix problems and improve it
• Send you a welcome email and, if you have not set anything up yet, a reminder
• Send you alerts on WhatsApp, if you turn them on

We process the personal data of people who sign up for email updates to send them the updates they asked for; the IP address of people who run a company analysis without an account to apply the free daily limit and prevent misuse; and data about website visits to count how many people visit our website and which pages they read.

6. Lawful Basis for Processing

UK GDPR requires us to have a lawful basis for each purpose for which we use personal data. The bases we rely on differ between the groups of people this notice covers, so they are set out group by group below.

People who hold an account with us.

• Running your account and providing the service — creating your account and letting you sign in; keeping your watchlist, settings, business details and any keys you add; matching news, events and scenarios to them; sending the alerts, digests and follow-up emails that are part of the service; producing the reports and share links you ask for; and answering your messages and feedback. Lawful basis: contract (Article 6(1)(b)) — we need this data to provide the service you signed up for under our terms.
• Deciding your access and managing your plan — approving your access, and recording your plan, any trial and any change we make to it. Lawful basis: contract (Article 6(1)(b)), including steps you ask us to take before we provide the service.
• Taking payment and keeping payment records — our payment provider takes payment, and we keep the subscription and invoice references it gives us. Lawful basis: contract (Article 6(1)(b)) for taking payment, and legal obligation (Article 6(1)(c)) for keeping the records that UK tax and accounting rules require.
• Alerts on WhatsApp — only if you turn them on. Lawful basis: consent (Article 6(1)(a)). You can withdraw it at any time by replying STOP to any message or by turning WhatsApp alerts off in Settings.
• Keeping the service secure and preventing misuse — keeping records of signed-in sessions, applying the limits of your plan, and spotting many free accounts being opened from one place. Lawful basis: legitimate interests (Article 6(1)(f)). Our interest, which we share with the people who use the service, is a service that is secure and not abused.
• Understanding and improving the service — records of which features are used, the searches people type, the errors they run into and which version of the service they were shown, so that we can fix problems and improve the product. Lawful basis: legitimate interests (Article 6(1)(f)). Our interest is a service that works and gets better. These records are not used for advertising and are not sold.
• Emails about getting started — a welcome email and, if you have not set anything up yet, a reminder. Lawful basis: legitimate interests (Article 6(1)(f)). You can stop them at any time, together with our alerts, digests and other service emails, by turning off Atri emails in Settings or by using the link at the bottom of any of those emails. Emails we need to send about your account — for example to confirm your sign-in, to tell you your access has started, or to tell you a payment has failed — still arrive.
• Handling your data protection requests and complaints — Lawful basis: legal obligation (Article 6(1)(c)).

People who sign up for email updates without an account. We send you updates only if you ask for them and confirm your email address. Lawful basis: consent (Article 6(1)(a)). You can withdraw it at any time using the unsubscribe link in any update. After you unsubscribe we keep a record of your email address so that we do not email you again. The lawful basis for that record is legitimate interests (Article 6(1)(f)): respecting your choice.

People who run a company analysis without an account. We record your IP address to apply the free daily limit and prevent misuse. Lawful basis: legitimate interests (Article 6(1)(f)): keeping a free feature available and not abused.

Visitors to our website. We count visits without cookies, as described in section 3C. Lawful basis: legitimate interests (Article 6(1)(f)): knowing whether people can find and use our website.

Company officers and persons with significant control. For the public-register data described in section 3A, we rely on our Legitimate Interests under UK GDPR Article 6(1)(f). We have conducted a Legitimate Interests Assessment (LIA) which concluded that:

• Our interest in providing market intelligence is legitimate and clearly articulated
• The processing is necessary for that interest and could not reasonably be achieved by less privacy-intrusive means
• The individuals whose data we process are officers and PSCs of registered companies — roles that carry public accountability expectations
• Processing publicly-filed Companies House data in an intelligence context is reasonably expected and proportionate

Persons with significant control. Our legitimate interest is helping businesses check who owns and controls the companies they deal with, using the register Companies House publishes for that purpose. To keep the effect on the people concerned low, the PSC records we keep hold only a name and the company concerned, and are shown only to people signed in to Atri. We do not use PSC records to screen individuals for sanctions, political exposure or wrongdoing.

Under UK GDPR Article 21, you have the right to object at any time to processing based on legitimate interests. To exercise this right, email us at support@branch2.com. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, and we will tell you our decision within one month. If you are named on a public register, the next paragraph explains what to tell us and what happens.

If you object to emails about getting started, we will stop sending them. You do not need to give a reason.

Our full Legitimate Interests Assessment isavailable on request. We will respond within 5 business days.

Where we rely on consent, you can withdraw it at any time. Withdrawing it does not affect processing we carried out before you withdrew.

Automated processing. We use automated processing to match news, events and scenarios to your watchlist and business details and to decide which alerts to send you. During our free launch, new accounts are approved automatically as a 72-hour trial, and access and email alerts stop automatically when the trial ends. If you think an automatic decision about your access is wrong, email us at support@branch2.com and a person will look at it. Apart from this, we do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

7. Data Retention

Company officers and persons with significant control. We keep an officer or PSC record for as long as it is still in use, and no longer. A record is deleted automatically once both of the following are true: no refresh from Companies House has re-observed that person for 90 days, and no user of the platform is monitoring them. When a person record is deleted, the entries linking them to companies are deleted with it. We do not re-check every record against Companies House continuously, so a record can be out of date. Each record links to the Companies House page it came from, so you can check the current register.

This is separate from, and does not delay, your right to erasure: if you ask us to remove your data we act on that request directly rather than waiting for the retention period, and we do not re-create a record we have been asked to erase. Resigned officers and former PSCs are retained on the same basis as current ones — a past directorship or past control of a company remains part of the public record.

People who hold an account with us. We keep:

• Your account, settings, watchlist, business details, keys, what we match to you, the alerts and emails we send you, and your WhatsApp details — for as long as your account is open.
• Records of your use of the service — for as long as your account is open, and no longer than 24 months after the event they record.
• Sign-in session records, including the IP address and browser details — until you sign out on that device or the session is ended. If you never sign out, we keep them until your account is closed.
• The IP address and browser details used when you sign up — 12 months.
• Records of each analysis that counts towards your plan's limits, including the IP address — 90 days.
• Messages and feedback you send us through the app — for as long as we need them to deal with your message and any follow-up, and no longer than 24 months after you send them. Emails to our support address are kept in our mailbox until we delete them.
• Reports you choose to share — the share link stops working after 30 days, or sooner if it is turned off, and we delete our copy of the report 30 days after that.
• Payment and subscription records — for as long as UK tax and accounting rules require us to keep them, which is usually six years after the end of the financial year they relate to.
• Security and audit logs we keep in our database — 60 days. Our hosting providers also keep short-term server logs under their own retention settings.

We do not currently close accounts automatically when they are not used. If you no longer want your account, email us at support@branch2.com and ask us to close it and erase your data. We will do so within the response time in section 10. After that we keep only the payment and subscription records described above, with the link to your account removed. Security and audit logs that mention your account are deleted on their normal 60-day schedule, and copies held in our database provider's backups are overwritten on its backup schedule.

People without an account. We keep:

• Email-update sign-ups — until you unsubscribe. After that we keep only your email address, the dates you signed up, confirmed and unsubscribed, and the code in your unsubscribe link, so that we do not email you again. If you never confirm your subscription, we delete the sign-up 30 days after we sent the confirmation email.
• Company analyses run without an account, including the IP address — 90 days.
• Website visit records — 13 months.

8. Data Transfers

Personal data is stored and processed on managed database infrastructure operated by Supabase in the Asia Pacific (Seoul) region of South Korea. Application servers are operated by Railway. This means personal data is transferred outside the United Kingdom.

[TODO — UK counsel to complete] International transfer mechanism: Identify and state the lawful basis relied on for transferring personal data from the UK to South Korea (adequacy regulations, the International Data Transfer Agreement, or the Addendum to the EU Standard Contractual Clauses), and confirm whether a transfer risk assessment is required. Name each processor and its processing location.

9. Your Rights

Under UK-GDPR, you have the right to:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Data Portability: Receive the data you gave us in a structured, commonly used, machine-readable format
• Right to Erasure: Request deletion of your data in certain circumstances
• Right to Object: Object to our processing of your data, particularly on legitimate interests grounds
• Right to Rectification: Request correction of inaccurate data (though CH data accuracy is verified at source)

Access and portability are self-serve. If you have an account, open Settings → Account → Download my data and you will get a JSON file of the records our application database holds against your account, immediately and without asking us. The file states whether it is complete. It does not include your email-update sign-up, if you have one, or the records our sign-in provider keeps for your account — such as when you signed in, the IP address and browser details of your signed-in sessions and, if you use Google, the name and picture link Google shared. Email us at the address below if you want those too.

For erasure, objection and rectification, and for any request about a person who does not hold an account, email us at the address below — those still need a person to review them.

10. Data Subject Access Requests (DSAR)

If you hold an account, a copy of your data is available immediately under Settings → Account → Download my data — you do not need to write to us for it. For erasure, objection or rectification, or if you do not hold an account, send a request to:

We will acknowledge your request within 5 working days and respond within 30 calendar days of receipt.

11. Complaints

If you are unhappy with how we have used your personal data, please tell us so that we can try to put it right. Email support@branch2.com with "Complaint" in the subject line or, if you hold an account, use Settings → Contact support in the app. You can also raise a complaint in any other way, and we will still treat it as a complaint. We will acknowledge your complaint within 30 days of receiving it, look into it, keep you updated, and tell you the outcome without undue delay.

You also have the right to complain to the UK data protection regulator, the Information Commission (known as the ICO, and called the Information Commissioner's Office until 30 September 2026), if you believe we have breached your rights under UK-GDPR. You can do this at any time, although the ICO usually asks people to raise their concern with the organisation first:

12. India — Digital Personal Data Protection Act, 2023 (DPDPA)

This section is for people in India. It explains how we handle your personal data under India's Digital Personal Data Protection Act, 2023 ("DPDPA") and the Digital Personal Data Protection Rules, 2025. In the words of that law, you are the Data Principal and Branch² is the Data Fiduciary: we decide why and how your personal data is used. Branch² is operated from the United Kingdom, so the rest of this notice, including your rights under UK data protection law, applies to you as well. This section adds to the rest of this notice. It does not take away any right that the rest of this notice gives you.

Most of the duties in the DPDPA and its Rules come into force in May 2027. We are giving you this information now, and we will update this section if the law or its timetable changes.

What we collect and why. If you create an account with us, we collect the following, each for the purpose stated:

• Your email address, and your password if you set one — to create your account, sign you in, send you the alerts you ask for, and send you emails about your account, such as a welcome email and billing notices. Your password is stored only in hashed form. If you sign in with Google, we also receive the name and profile picture on your Google account.
• Sign-in and security records — each time you sign in, our sign-in system records the IP address and browser details of that session, to keep you signed in and to keep your account secure. When you sign up, we may also record the IP address and browser details you signed up from, to stop one person opening many free accounts.
• Your business details — such as your business name, sector, the country and (in India) the state you operate in, and the suppliers, costs and other business inputs you add — to work out which events could affect your costs and to tailor what we show you.
• Your watchlist and settings — the companies, suppliers and topics you choose to watch, any notes or descriptions you write about them, and your alert and display preferences — to decide what to show you and when to alert you.
• What the service works out from this — such as which topics you seem most interested in, how recent events may affect the things you watch, and which version of a feature you see when we test a change — to tailor what we show you and to improve the service.
• Records of how you use the service — such as the analyses you open, the alerts and emails we send you and what you do with them, and how many requests you make — to run the service, apply usage limits and fix problems. When you use a feature that has a usage limit, the record includes the IP address your request came from.
• Subscription records — your plan and, if you pay, the customer and subscription references our payment provider Stripe gives us — to manage your plan. You enter card details on Stripe's own payment page; they are not sent to us.
• Messages you send us — through Contact support in the app or by email — so that we can reply. A message sent from the app also records the page you sent it from and your browser details, to help us deal with it.
• Your mobile number, only if you switch on WhatsApp alerts — to send you those alerts on WhatsApp.

If you use parts of the service without signing in, we record your IP address when you use a feature with a free-use limit, to apply that limit. If you sign up for our newsletter, we keep your email address and the IP address you signed up from, to send you a confirmation email and, once you confirm, the newsletter. We count visits to our web pages without cookies and without storing IP addresses.

We use your personal data only for the purposes above. We do not use it for advertising, we do not use third-party advertising or tracking tools, and we never pass it to anyone for their own marketing.

AI processing. Some of what you type — for example a description of something you want us to watch — is sent to one of the AI model providers we use so that it can be analysed. We send the text and the region you chose, not your name or email address.

Why we are allowed to use it. You give us most of this personal data yourself so that you can use Atri, and we use it only for the purposes listed above. The DPDPA allows a business to use personal data that you have chosen to give it for a stated purpose, until you tell it that you no longer agree (section 7(a)). For optional extras — WhatsApp alerts and our newsletter — we ask for your consent (section 6), which you give when you switch WhatsApp alerts on or confirm your newsletter sign-up. Some records, such as sign-in and usage records and what the service works out from your choices, are created by the service rather than given by you. Before the DPDPA's duties come into force in May 2027 we will confirm the legal ground we rely on for those records, and update this section if it changes.

Withdrawing consent or telling us to stop. You can stop any of this as easily as you started it:

• WhatsApp alerts — switch them off in Settings, or reply STOP to any WhatsApp message from us.
• Email alerts and the morning digest — switch them off in Settings, or use the unsubscribe link at the bottom of the email.
• Newsletter — use the unsubscribe link in the newsletter email, or contact us.
• Everything else — ask us to close your account and erase your personal data (see "Your rights" below).

Withdrawing consent does not affect anything we did before you withdrew it, but features that depend on it will stop working.

How long we keep it. We keep your personal data while your account is open. When you ask us to erase it, a person closes your account and deletes the personal data kept under it in our systems, including your sign-in details. We keep billing and payment records, separately from your account, because we need them for our accounts, and anything else the law requires us to keep. Our service providers keep their own records for their own set periods — for example, your customer record at Stripe and records of the emails we sent you.

Some records are not yet deleted automatically. A newsletter sign-up is kept even if you never confirm it or later unsubscribe, and the IP addresses we record for usage limits are kept, until you ask us to delete them or, for records linked to an account, until that account is erased. We plan to set time limits for these records and will update this section when we do.

Where it is processed. We store your personal data on Supabase servers in Seoul, South Korea. It is also handled by the service providers we use to run Atri, including Railway (application hosting), Resend (sending email), Namecheap (our support mailbox), Stripe (payments), Meta (WhatsApp alerts) and AI model providers. Some of them process it outside India, including in the United States and China. The Government of India has not restricted transfers of personal data to any country under section 16 of the DPDPA. If it does, we will follow that restriction. You can ask us for the full, current list of service providers at any time.

Your rights. We offer you the following now, alongside your rights under UK law. They become legal rights under the DPDPA when its duties come into force in May 2027:

• Get a summary of your personal data — what we have, what we do with it, and who we have shared it with. If you have an account, Settings → Account → Download my data gives you a copy straight away of the records kept under your account in our database. That copy does not include your sign-in records, the name and picture from a Google sign-in, or a newsletter sign-up. For those, and for the list of service providers we share your data with, contact us.
• Correct, complete or update it — you can change your business details, watchlist and settings in the app yourself. For anything else, contact us.
• Have it erased — contact us. A person reviews every request, closes your account and erases your personal data, apart from the records described under "How long we keep it", and tells you within 30 calendar days what has been erased and anything we have had to keep. Erasure is not self-serve.
• Nominate someone to use these rights for you if you die or become unable to act — email us, from the address on your account, with the name and contact details of the person you nominate.
• Have a grievance dealt with — see below.

How to reach us. To use any of these rights, or to raise a question or grievance about your personal data, email us or, if you have an account, use Contact support in the app. Please write from the email address on your account, or tell us that address, so that we can find your data and check that the request is yours, and include "DPDPA" in the subject line.

We will acknowledge your message within 5 working days and respond within 30 calendar days of receiving it. Every reply we send about your rights will include these contact details.

Complaints to the Data Protection Board of India. The DPDPA sets up the Data Protection Board of India to hear complaints. Its power to hear complaints is due to start in May 2027. From then, if you are not satisfied with how we have dealt with your grievance, you will be able to complain to the Board, which is designed to work online. The DPDPA asks you to use our grievance process first. You can already complain to the UK Information Commissioner's Office (section 11).

Significant Data Fiduciary. The Government of India has not designated Branch² a Significant Data Fiduciary, so the extra duties that apply to those organisations, such as appointing a Data Protection Officer based in India, do not apply to us. If that changes, we will update this section.

Children. Atri is made for businesses and is not meant for children. Under the DPDPA, a child is anyone under 18. Please do not create an account if you are under 18. If we learn that an account belongs to someone under 18, we will close it and erase its personal data.

Personal data breaches. If a breach of security affects your personal data, we will tell you by email without delay. Once the DPDPA's breach rules come into force in May 2027, we will also report it to the Data Protection Board of India as those rules require.

Information that is already public. The DPDPA does not apply to personal data that a person has made public themselves, or that someone was required by Indian law to publish (section 3(c)(ii)) — for example, announcements that listed companies must publish through Indian stock exchanges. If information we analyse names you and falls outside that exemption, such as a news report, you can contact us about it using the details above.

This notice is in English. If you would like it in Hindi or another language listed in the Eighth Schedule to the Constitution of India, contact us and we will send you a translation.

13. United States — state privacy laws

Branch² is operated from the United Kingdom and is not actively marketed to US residents. We provide the following disclosures on a best-effort basis for visitors located in California (CCPA / CPRA) and, by extension, residents of other US states with comparable privacy laws (VCDPA, CPA, CTDPA, UCPA and newer state acts). We will revisit and finalise this wording with counsel before any formal US launch.

• Categories of personal information collected (CCPA §1798.110). In the last 12 months we have collected the following categories of personal information about visitors and account holders: identifiers (e.g. name, email address, IP address), commercial information (subscription / billing records), internet or other electronic network activity information (e.g. pages viewed, interactions with the platform), and inferences drawn from the above to provide and improve the service. We also process information about company officers and persons with significant control sourced from public registers such as Companies House — see sections 4 and 5 above.
• Sale or sharing of personal information. We do not sell personal information for money, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the CCPA / CPRA. We have not sold or shared personal information in the preceding 12 months and have no plans to do so.
• Do Not Sell / Do Not Share opt-out. Because we do not sell or share personal information, no opt-out is required. If this changes in the future we will provide a "Do Not Sell or Share My Personal Information" link and will honour Global Privacy Control (GPC) browser signals as an opt-out request. In the meantime, you may email support@branch2.com to record a standing opt-out preference on your account.
• Sensitive personal information. We do not knowingly collect sensitive personal information as defined by CCPA §1798.140(ae) (e.g. precise geolocation, government identifiers, racial or ethnic origin, religious beliefs, health or biometric data, contents of private communications). Account credentials we hold are used solely to authenticate you and provide the service, and are not used to infer characteristics about you. You therefore do not need to exercise the right to limit use of sensitive personal information.
• Your consumer rights and how to exercise them. Subject to verification and any exemptions permitted by law, California residents (and residents of other US states with comparable laws) have the following rights:

• Right to Know — request the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete — request deletion of personal information we have collected from you, subject to statutory exemptions (e.g. completing a transaction, security, legal compliance).
• Right to Correct — request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of the sale or sharing of personal information — as noted above, we do not engage in either activity.
• Right to Non-Discrimination — we will not deny goods or services, charge different prices, or provide a different level of service because you exercised a privacy right.

To exercise any of these rights, email support@branch2.com from the address associated with your account, or include enough information for us to reasonably verify your identity (typically name, email, and any account identifier). We will acknowledge requests within 10 business days and respond substantively within 45 days, extendable by a further 45 days where reasonably necessary, as permitted by the CCPA. You may also designate an authorised agent to make a request on your behalf; we will require written authorisation and may verify directly with you.

14. Changes to This Notice

We may update this privacy notice from time to time to reflect changes in our processing or legal requirements. The "Last updated" date above shows when it last changed. If a change materially affects how we use the personal data of people who hold an account, we will also tell account holders by email or in the app.

Questions?

Attribution: Contains public sector information licensed under the Open Government Licence v3.0.