Privacy Policy

Effective date: 29 September 2026

Who we are

Curve and Curve Contracts are trading names of Baseline Labs Ltd, a company registered in England and Wales with company number 16968511, whose registered office is at 71-75 Shelton Street, London WC2H 9JQ, United Kingdom. In this policy, "we", "us" and "our" mean Baseline Labs Ltd.

We are registered with the Information Commissioner's Office under reference ZC155407.

For anything about this policy or about personal data we hold, write to privacy@curvecontracts.com.

The two things this policy does and does not cover

We handle personal data in two different roles, and only one of them is covered here.

We are the controller for personal data about people who contact us, people who work for our clients and suppliers, and people who visit curvecontracts.com. We decide why and how that data is used. This policy covers that data.

We are a processor for personal data inside the documents our clients send us, which we read, draft and advise on. Our client decides why and how that data is used; we act on their instructions. This policy does not cover that data. It is governed by the data processing agreement between us and that client, and anyone whose data appears in those documents should approach the client, not us. If you contact us about it we will pass your request to the client and tell you we have done so.

What we collect, and why

We collect only what we need. We do not collect special category data, and we ask clients not to send it to us without agreeing terms for it first.

If you contact us or ask about our services, we collect your name, your email address, the organisation you work for, and what you tell us about your matter, including the other parties involved. We use it to answer you, to give you a quotation and any initial view on your matter, to check that we can act for you, and later to check that we are not acting against you for someone else. Our legal basis is our legitimate interest in responding to people who approach us, in running the business, and in keeping a record of what we told you.

If you or your organisation become a client, we collect the name, role and business contact details of the people we deal with, our correspondence with them, and the records of the work we do and what we charge for it. We use this to perform the engagement, to invoice, and to keep the records we are required to keep. Our legal bases are performance of a contract, our legitimate interest in managing the relationship, and compliance with a legal obligation.

To be paid, we collect the bank details and billing information needed to raise an invoice and receive payment. You can pay by bank transfer or, where your invoice offers it, by card. Card payments are taken on a checkout page run by Revolut: you enter your card details there, not with us, and we never see or hold them. To set up the payment we send Revolut the invoice number and title, the amount and your billing email address, and Revolut tells us whether the payment went through. Our legal bases are performance of a contract and compliance with our tax and accounting obligations.

If you work for a supplier or a professional adviser to us, we collect your business contact details and our correspondence with you, on the basis of our legitimate interest in dealing with the organisations we work with.

When you visit curvecontracts.com, three things happen:

• Our hosting provider records what every web server records: the IP address the request came from, the pages requested, the time, and the browser and device type. We use it to keep the site running and secure.
• We measure traffic in aggregate. The measurement is cookie-free: a visit is identified by a hash generated from the request itself, nothing is stored on your device, and the session is discarded after 24 hours. It tells us how many people read which pages. It does not tell us who you are and does not follow you to any other site.
• On the intake and start pages, a bot check runs to stop automated abuse of our forms. It is operated by Cloudflare, runs inside a frame served from challenges.cloudflare.com, and uses your IP address and signals about your browser to decide whether you are a person. Cloudflare may set a cookie on its own domain for this; it sets none on curvecontracts.com.

Our legal basis for all three is our legitimate interest in the security, availability and improvement of the site.

Cookies and what the site stores on your device

We do not track you. There is no advertising, no profiling, no cross-site tracking, and no third-party marketing tool anywhere on this site. Our fonts are built into the site, so visiting it sends no request to Google.

The site sets no cookies on the public pages. The one first-party cookie we use signs the operator into the site's own admin area; it is strictly necessary for that, and you will never receive it as a visitor.

Two other things touch your device, and neither needs your consent:

• Your appearance preference. If you choose light or dark mode, the site remembers your choice in your browser's local storage. It is used for nothing else, it never leaves your browser, and it identifies nobody. If you would rather we did not store it, clear the site's data in your browser settings, or use your browser's private mode, and the site will work normally without remembering the setting. You can also tell us at privacy@curvecontracts.com.
• The bot check on the intake and start pages, described above. It is strictly necessary to protect those forms from abuse, and we use it for nothing else.

We do not send marketing emails and we do not operate a marketing mailing list. If that changes, we will update this policy and, where the law requires it, ask for your consent first.

Who we share it with

We do not sell personal data, and we do not share it with anyone for their own marketing.

People and companies who act on our instructions:

• Our consultants. We perform client work through qualified lawyers engaged as independent consultants, currently in France and in Hong Kong. Each is bound in writing to confidentiality and data protection obligations at least as strict as ours.
• Google (Google Cloud EMEA Limited, Ireland), which provides our email, documents and cloud storage.
• Vercel (Vercel Inc., United States), which hosts curvecontracts.com and provides the traffic measurement described above.
• Cloudflare (Cloudflare, Inc., United States), which provides the bot check on our intake and start pages.
• Revolut (Revolut Bank UK Ltd, United Kingdom), which runs the checkout page for card payments on our invoices.
• Artificial intelligence tools, which we use in performing our work. We do not submit personal data to any tool that uses submitted content to train models made available to third parties.

Organisations that decide for themselves what to do with data, and whose own privacy notices apply:

• Revolut (Revolut Bank UK Ltd, United Kingdom), our bank. When it takes a card payment for us, it also uses the payment data for its own purposes: fraud prevention, anti-money-laundering checks, Revolut Pay and anonymous statistics.
• FreeAgent (FreeAgent Central Limited, Edinburgh), the accounting software we use.
• Our accountant, insurers and other professional advisers.

And in two other situations: where a regulator, court or other authority with jurisdiction requires disclosure; and, if we ever sell the business or its assets, to the buyer, only so far as the transaction requires.

Sending data outside the United Kingdom

Some of our consultants and providers are outside the United Kingdom, so personal data reaches them there.

France, Ireland and the rest of the European Economic Area. The United Kingdom has decided that these countries protect personal data adequately, so no further safeguard is needed. Our email and documents are held under a contract with Google's Irish company.

The United States, where Vercel and Cloudflare are established. Both are certified under the UK Extension to the EU-US Data Privacy Framework, which the United Kingdom recognises as providing adequate protection, and the data processing terms we have with each of them also incorporate the Information Commissioner's Addendum to the standard contractual clauses.

Hong Kong, where one of our consultants works. There is no adequacy decision for Hong Kong. We use the Information Commissioner's International Data Transfer Agreement, together with additional protections we agreed on top of it, and we assessed the risks of the transfer before making it. You can ask us for a copy of that assessment.

How long we keep it

• Enquiries, quotations and engagements, including correspondence and the work itself: 6 years from the end of the engagement or, if you do not become a client, from your last contact with us. That is the period during which a claim about what we told you could be brought, and during which we need to be able to check that we are not acting against you. For clients, it is also the period our tax records must cover.
• Accounting and tax records: 6 years from the end of the accounting period.
• Website server logs: as long as our hosting provider keeps them, which is 30 days.
• Traffic measurement: the visit itself is discarded after 24 hours; what remains is a count that identifies nobody.

After that we delete it, or anonymise it so that nobody can be identified from it.

Keeping it safe

Client documents and correspondence are held in a managed cloud environment, encrypted in transit and at rest. Access is on named accounts with multi-factor authentication, limited to the people who need it for the work in hand. Every device used to reach the data has full-disk encryption and automatic screen locking. Everyone with access is bound by written confidentiality obligations.

If a breach happens that is likely to risk your rights, we will tell the Information Commissioner within 72 hours of becoming aware of it, and we will tell you if the risk to you is high.

Your rights

Under the UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it, if it is wrong or incomplete;
• delete it, where we have no good reason to keep it;
• stop or restrict what we do with it;
• send it to you, or to someone else, in a machine-readable form; or
• stop relying on legitimate interests, by objecting to what we are doing.

Where we rely on your consent, you can withdraw it at any time.

Write to privacy@curvecontracts.com. We will answer within one month. If your request is complicated we may take up to two months more, and we will tell you within the first month if that happens. We do not charge, unless a request is clearly unfounded or excessive.

We may ask you to confirm who you are before we act, so that we do not disclose your data to someone else.

Complaining

Tell us first, at privacy@curvecontracts.com, and we will try to put it right.

You can also complain to the Information Commissioner's Office, which regulates data protection in the United Kingdom: ico.org.uk, or 0303 123 1113. We would rather hear from you first.

Changes to this policy

We update this policy when what we do changes. The version on this page is the current one, and the effective date at the top tells you when it took effect.