Privacy Policy.

Crownix® Sentinel is a trading name of Crownix Holdings Ltd, a company registered in England and Wales under company number 16985396. We are the data controller for personal data collected through this website and during our engagement with you.

Contact the data controller: contact@crownixholdings.com

We only collect what we need to do the work or to operate the website.

• Identity & contact data — name, work email, company name, role, phone (if you give it). Provided by you via the contact form, email, or during onboarding.
• Engagement data — documents you upload, deadlines we track for you, communications between us, meeting notes from your monthly position review.
• Technical data — IP address, browser type, device type, referring URL. Collected automatically by our hosting provider for security and abuse prevention only.
• Marketing data — only if you opt in. We don't send unsolicited marketing.

We do not collect special category data (health, biometric, political, etc.) and we do not knowingly collect data from anyone under 18.

Each piece of data has a defined lawful basis under UK GDPR Article 6.

• Contract performance — to deliver the compliance operations service you've engaged us for.
• Legitimate interest — to operate, secure, and improve the website; to respond to enquiries; to keep records of our engagement.
• Legal obligation — to retain financial records under HMRC requirements and to comply with anti–money-laundering regulations where applicable.
• Consent — for any optional marketing communications. You can withdraw at any time.

We don't sell data. Ever. We share it only with carefully selected processors who help us deliver the service:

• Hosting and infrastructure providers (UK / EEA, with appropriate safeguards).
• Email and calendar providers used for client communication.
• Document storage and intelligence systems used inside our compliance operations.
• Your nominated accountant, solicitor, or other advisors — only on your instruction or where necessary to complete a coordinated filing.
• Regulators or courts where we are legally obliged to disclose.

All processors are bound by written contracts that require UK GDPR-equivalent protection.

• Active engagement data — for the duration of the engagement and 7 years after, in line with HMRC retention rules.
• Enquiries that don't convert — 24 months, then deleted.
• Website technical logs — 90 days.
• Marketing data — until you unsubscribe.

Data is stored on infrastructure located in the United Kingdom and European Economic Area. If a processor transfers data outside the UK / EEA, we ensure an adequate transfer mechanism is in place (UK adequacy regulations, the UK Addendum, or Standard Contractual Clauses).

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion (subject to legal retention requirements).
• Restrict or object to certain processing.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent for any processing based on consent.
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

To exercise any right, email contact@crownixholdings.com. We respond within one UK business day and complete requests within 30 days.

We apply the same operational discipline we sell. Encryption in transit and at rest, role-based access, multi-factor authentication on every operator account, audit logging, and a documented incident response procedure. If a breach affects your data and meets the notification threshold, we'll tell you within 72 hours and report to the ICO as required.

This website uses only strictly necessary cookies for routing and security. We do not run third-party advertising trackers, behavioural analytics, or social media pixels. See our Cookie Policy for the full list.

When we update this policy we change the effective date at the top and, where the change is material, we notify active clients by email. The current version is always at this URL.