Imperium (L) Limited Privacy Policy
Last updated: 8 October 2026
1. Who we are and what this policy covers
Imperium (L) Limited (“Imperium(L)”, “we”, “us”) is the data controller for the personal data described in this policy. We are a company registered in England and Wales under company number 16825885, with our registered office at 2nd Floor Nucleus House, 2 Lower Mortlake Road, Richmond, United Kingdom, TW9 2JA. We are part of the PT Trustees group.
Our details are:
Full name of legal entities: Imperium (L) Limited
Name of DPO: Sudheer K Sharma
Email address: enquiries@imperiuml.com
Postal address: 2nd Floor, Nucleus House, 2 Lower Mortlake Road, Richmond, Surrey, TW9 2JA
Telephone number: +44 20 4558 3778
We provide Imperium(L) Prism, a reconciliation and safeguarding control platform for payments, e-money and investment firms (CASS 15, CASS 7 and CASS 8), together with our Wind-Down Planning, Governance and MI Reporting, AI Knowledge Hub and AI Document Intelligence modules. This policy replaces our earlier website privacy policy and explains how we handle personal data across our business, not just on our website at imperiuml.com. It covers:
- visitors to our website;
- people who contact us or ask for a demonstration;
- prospective customers, introducers and partners;
- contacts at our customers, including people who use our platform;
- people who raise support requests;
- our suppliers and their staff; and
- people who apply to work with us.
When we act as a processor. When our customers load or connect their own data to our platform, such as client, transaction, bank account and ledger records in Prism, or the documents and questions they put into our AI modules, the customer is the controller of that data. We process it only on the customer’s documented instructions, under our agreement with the customer and its data processing terms. If your personal data is held in a customer’s instance of our platform, please refer to that customer’s privacy notice and contact them to exercise your rights. Where a customer deploys our software on its own premises, we do not routinely access that data.
For any question about this policy, email us at enquiries@imperiuml.com or write to us at the address above.
2. Personal data we collect
We collect business contact and usage information, and we do not intentionally collect special category data. The table shows what we collect from each group of people and where it comes from.
Who
Personal data
Source
Website visitors
Personal data
IP address, browser type, device information, pages viewed, time spent on the site, referring website, cookie identifiers
Source
Collected automatically, including through Google Analytics, subject to your cookie choices
Enquirers and demo requests
Personal data
Full name, email address and/or phone number, company name, company role, type of company, the content of your message, and the demo time you book
Source
You, through our enquiry form, our Calendly demo scheduler, email or phone
Prospects, introducers and partners
Personal data
Name, job title, organisation, business contact details, notes of meetings and calls, your interest in our products
Source
You, our introducers, events, and public sources such as company websites, LinkedIn and Companies House
Customer contacts and platform users
Personal data
Name, job title, business contact details, login credentials, user role and permissions, audit logs of platform activity, questions asked of our AI modules and their history, contract and billing contacts
Source
You, your employer, and our platform
Support requests
Personal data
Name, contact details, the content of your request, screenshots or files you send us
Source
You or your employer
Suppliers and their staff
Personal data
Name, job title, business contact details, payment and contract details
Source
You or your employer
Job applicants
Personal data
CV, employment history, qualifications, interview notes, references, right-to-work checks
Source
You, recruitment agencies, referees
Special Categories of Personal Data and Criminal Convictions and Proceedings Data
Personal data
We do not generally collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Where such data is required, we will only process it where permitted or required by law, to comply with a legal or regulatory obligation, or where another applicable condition for processing under data protection legislation applies; where we are required to collect special categories of personal data owing to the requirements of a regulatory body, we will inform you accordingly. We will share data with any interested party as set out in the trust or escrow deeds.
Source
You, credit checks software/agencies
If you give us personal data about someone else, such as a colleague, please make sure they know you are doing so and point them to this policy.
3. How we use personal data and our lawful bases
We rely mainly on our legitimate interests in running and growing a business-to-business software company. We use consent only for non-essential cookies and, where the law requires it, for electronic marketing.
Purpose
Lawful basis under UK GDPR
Responding to enquiries and demo requests
Lawful basis under UK GDPR
Legitimate interests: answering business enquiries and talking to prospective customers
Managing relationships with prospects, introducers and partners
Lawful basis under UK GDPR
Legitimate interests: developing our business and partnerships
Running proofs of concept and pilots
Lawful basis under UK GDPR
Legitimate interests; contract, once a PoC agreement is signed
Providing the platform, managing user accounts and delivering support
Lawful basis under UK GDPR
Contract with our customer; legitimate interests in supporting the customer’s users
Keeping the platform secure, including access control and audit logging
Lawful basis under UK GDPR
Legitimate interests; legal obligation
Sending business updates and marketing to business contacts
Lawful basis under UK GDPR
Legitimate interests, with an opt-out in every message; consent where the law requires it
Analysing website use through Google Analytics
Lawful basis under UK GDPR
Consent, given through our cookie banner
Managing suppliers and paying invoices
Lawful basis under UK GDPR
Contract; legal obligation for accounting records
Recruitment
Lawful basis under UK GDPR
Steps taken before entering a contract; legal obligation for right-to-work checks
Meeting legal and regulatory obligations, and defending legal claims
Lawful basis under UK GDPR
Legal obligation; legitimate interests
Where we rely on legitimate interests, we have balanced our interests against your rights. You can object at any time (see section 8). Where we rely on consent, you can withdraw it at any time, for example by changing your cookie settings.
We do not sell personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share personal data with
We share personal data only with the service providers and organisations we need to run our business, and each provider acts under a written contract with data protection terms.
Recipient
Why
Website hosting, WordPress hosting and maintenance providers (e.g. Waterskier Software)
Why
Hosting our website and storing enquiry form submissions, within the UK
Google (Google Analytics)
Why
Measuring website use, where you have consented
CookieYes
Why
Managing and recording your cookie choices
Calendly
Why
Scheduling demos you book with us
Amazon Web Services
Why
Hosting the platform and its data for customers who use our cloud deployment
Amazon Bedrock
Why
Processing customer documents and questions in our AI Knowledge Hub and AI Document Intelligence modules, without using them to train their models
Creditsafe
Why
Carrying out credit checks as per Anti-Money Laundering and Countering the Financing of Terrorism legislation
Software development and support partners, including our development partner in India
Why
Building, maintaining and supporting the platform
IT support, email and collaboration providers (Microsoft 365 and Waterskier Software)
Why
Running our internal systems and communications
PT Trustees Limited and other PT Trustees group companies
Why
Shared services and administration
Professional advisers, including lawyers, accountants, auditors and insurers
Why
Taking advice, audits and insurance
Regulators, law enforcement, courts and other authorities
Why
Where the law requires it, or to establish or defend legal claims
A buyer or investor
Why
If we sell, merge or restructure all or part of our business, under confidentiality terms
5. International transfers
Some of our providers process personal data outside the UK, and we protect every such transfer with a safeguard recognised by UK GDPR.
The main transfers are:
- United Kingdom: our website and the enquiry data it collects are hosted and stored in the UK.
- United States: Google Analytics, Calendly, and some of our IT, cloud and AI model providers. We rely on the UK–US data bridge where the provider is certified, or on an International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
- India: our software development and support partner. We rely on an IDTA or the UK Addendum, together with access controls that limit what personal data they can see.
- European Economic Area: some hosting and service providers. The UK recognises the EEA as adequate.
You can ask us for more information about these safeguards using the contact details in section 9.
6. How long we keep personal data
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Details of retention periods for different aspects of your personal data are available from us on request by contacting us using the contact details provided under the “Who we are” heading above.
In some circumstances you can ask us to delete your data: see Request ‘Your rights’ section below for further information.
In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
7. How we keep personal data secure
We protect personal data with technical and organisational measures suited to a regulatory technology provider serving FCA-regulated firms. These include:
- encryption of data in transit and at rest;
- role-based access, multi-factor authentication and the principle of least privilege;
- audit logging of access to the platform;
- separation of each customer’s data;
- security testing and vulnerability management;
- confidentiality obligations and data protection training for staff and contractors; and
- due diligence on, and contracts with, every service provider that handles personal data.
If a personal data breach is likely to put your rights at risk, we will notify the ICO within 72 hours and tell you without undue delay where the law requires it. Where we act as a processor, we will tell the affected customer promptly so it can meet its own obligations.
8. Your rights
Under UK GDPR you have the following rights over your personal data, some of which apply only in certain circumstances:
- Access: to get a copy of the personal data we hold about you.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to have your data deleted.
- Restriction: to ask us to limit how we use your data.
- Data portability: to receive data you gave us in a structured, machine-readable format, or have it sent to another organisation.
- Objection: to object to processing based on our legitimate interests. You can object to direct marketing at any time, and we will stop.
- Withdraw consent: where we rely on consent, at any time, without affecting earlier processing.
To exercise a right, contact us using the details in section 9. We will respond within one month, and may ask you to confirm your identity first. We do not normally charge a fee.
If your data is held in a customer’s instance of Imperium(L) Prism, we will pass your request to that customer and help them respond.
Right to complain. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your personal data has been handled unlawfully. Further information can be found at www.ico.org.uk. We would welcome the chance to address your concern first.
9. Cookies, changes and contact
Cookies. Our website uses strictly necessary cookies to work, and analytics cookies from Google Analytics only if you accept them through our CookieYes banner. You can change your choice at any time through the cookie settings link on our website.
Children. Our services are for businesses, and we do not knowingly collect personal data from anyone under 18.
Changes to this policy. We review this policy at least once a year and when our processing changes. The date at the top shows when it was last updated, and we will tell customers directly about significant changes.
Contact us. For questions about this policy or to exercise your rights:
- Email: enquiries@imperiuml.com
- Post: Data Protection, Imperium (L) Limited, 2nd Floor Nucleus House, 2 Lower Mortlake Road, Richmond, United Kingdom, TW9 2JA