Privacy Policy

Status: DRAFT — for review only. This document is not in force.
Version: 1.0 (draft, 14 July 2026)

Who we are / what this covers: This policy is issued by Briter Bridges Ltd, trading as "Briter", and covers our public website at briter.co (including www.briter.co) (the "Website"); our Briter Intelligence platform at intelligence.briter.co (including its subdomains); and our AgBase platform at intelligence.agbase.briter.co (including its subdomains) (Briter Intelligence and AgBase together, the "Platforms"); together with all briter.co subdomains (collectively, the "Services").

This policy should be read together with our Cookie Policy and our Terms & Conditions.

Key points

• We are Briter Bridges Ltd (trading as Briter), a UK company. One privacy contact for everything: privacy@briter.co.
• If you have an account, we use your details to run your account, provide the Services and take payment. Card details go straight to Stripe — we never see or store full card numbers.
• Cookie-based analytics run only with your consent, given through the cookie banner. If you decline analytics — and, on the Platforms, before you make a choice — we count only page views, cookielessly and anonymously, attributed to a short-lived, server-generated hash: no cookie, nothing stored on your device, no identifier, no profile, and the IP address is discarded at ingestion; we keep the counts only as aggregate statistics. Accepting analytics gives us full analytics. Separately, if you hold an account, we record certain product events (such as logins and report downloads) on our servers to run the service and enforce plan limits — Section 4 explains the basis. You can change your cookie choice at any time.
• We build a research database about Africa and emerging-market innovation ecosystems. It can include limited professional information about founders, executives and investors, gathered from public and partner sources. Section 5 explains what we hold, why we are allowed to, who receives it, and how to see, correct or remove your profile.
• Your data stays in the UK/EU wherever possible. Where a provider is in the US, we rely on the EU–US Data Privacy Framework (including its UK Extension) and/or Standard Contractual Clauses with the UK Addendum.
• We do not sell your personal data to third parties for their own marketing or other independent use, and we never share it with third parties for their marketing without your express opt-in. Our subscription products do provide access to the professional-capacity research information described in Section 5 — that disclosure is explained there.
• You have rights — access, correction, deletion, objection and more. Email privacy@briter.co; we respond within one month (up to three months in total for complex requests — we will tell you if so). You can also complain to the ICO or your local EU data protection authority.

1. Who we are and how to contact us

Controller. Briter Bridges Ltd, trading as "Briter" ("Briter", "we", "us", "our"), is the controller of the personal data described in this policy. We are registered in England and Wales under company number 11653314, with our registered office at Castle House, Castle Street, Guildford, Surrey, England, GU1 3UW, United Kingdom. We are registered as a data controller with the UK Information Commissioner's Office (ICO) under registration number ZA892203.

Privacy contact. For all privacy questions, rights requests and complaints:

• Email: privacy@briter.co
• Post: Data Privacy Manager, Briter Bridges Ltd, Castle House, Castle Street, Guildford, Surrey, England, GU1 3UW, United Kingdom

We have not appointed a statutory Data Protection Officer, and we are not required to appoint one under Article 37 GDPR / UK GDPR. Our Data Privacy Manager handles all privacy matters and can be reached through the contact details above.

EU representative: We are appointing a representative in the EU under Article 27 EU GDPR; their name and contact details will be published here on appointment.

Data protection laws. In this policy, "data protection law" means the UK GDPR and Data Protection Act 2018 (each as amended, including by the Data (Use and Access) Act 2025), the EU GDPR, and the ePrivacy rules (the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations 2003, "PECR").

2. Scope — what and who this policy covers

This policy covers personal data we process as controller about:

1. Visitors to the Website and Platforms;
2. Platform users — people who register an account on Briter Intelligence or AgBase (including free accounts);
3. Customers and billing contacts — people who buy subscriptions or act as the commercial contact for a subscribing organisation;
4. Newsletter subscribers;
5. Enquirers — people who contact us, request a demo, or interact with us at events;
6. Job applicants — people who apply for roles advertised on our careers pages;
7. Research Database Subjects — founders, executives, investors and other professionals whose information appears in our research and intelligence database (see Section 5).

Where we act as processor. Where a business customer stores or inputs data on the Platforms (for example, data uploaded into a customer workspace), that customer is the controller of that data and we process it only on their instructions as processor, under the data-processing terms set out in our Terms & Conditions.

One policy, three products. The Website and both Platforms share one legal entity, one backend user store, and largely the same suppliers. Where a product genuinely differs (for example, payments or the AI Assistant exist only on the Platforms), we say so.

3. The personal data we collect and where it comes from

3.1 Categories of personal data

We also create Aggregated Data (statistics that do not identify anyone). Aggregated Data is not personal data unless recombined with data that identifies you.

We do not collect special category data (e.g. health, religion, ethnicity) or data about criminal convictions or offences, and we ask that you do not enter such data into free-text fields, including the AI Assistant.

3.2 Where your data comes from

• Directly from you — when you register, subscribe, fill in a form, book a demo, apply for a role, email us, or use the Services;
• Automatically — through cookies, similar technologies and server logs, as described in our Cookie Policy;
• Third-party sign-in — if you choose "Sign in with Google" or "Sign in with LinkedIn" on the Platforms, Google and LinkedIn (each acting as an independent controller of the authentication event) send us your name, email address and avatar. Their own processing is governed by Google's privacy policy and LinkedIn's privacy policy;
• Payment and technical providers — e.g. Stripe confirms payment outcomes to us;
• Public and partner sources — for the research database only, as described in Section 5.

If you fail to provide personal data that we need to perform a contract with you (for example, billing details for a paid subscription), we may not be able to provide the Services. Some data we must collect by law — for example, billing details we need for tax and accounting records; if you do not provide it, we cannot lawfully provide the paid Services.

4. How and why we use your personal data

We only use your personal data where we have a legal basis under Article 6 GDPR / UK GDPR. The master table below sets out every purpose, by category of person. Where the basis is consent, you can withdraw it at any time (Section 9) without affecting processing before withdrawal.

Change of purpose. We use your data only for the purposes we collected it for, or compatible purposes. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis, unless the law requires or permits otherwise.

No sale of data; no third-party marketing. We do not sell, rent or trade your personal data to third parties for their own marketing or other independent use, and we do not share your personal data with any third party for their marketing without your express opt-in consent — which, currently, we never seek because we do not share data for third-party marketing at all. Note that our subscription products do provide access to the professional-capacity information described in Section 5; that disclosure, and the licence terms that constrain it, are explained in Sections 5 and 6.

5. The Briter research database — information about founders, executives and investors

Briter's core business is a research and intelligence database covering companies, investors, deals and ecosystems in Africa and other emerging markets, made available through Briter Intelligence, AgBase, and our published reports. This section is our notice under Article 14 GDPR / UK GDPR to individuals whose information appears in that database ("Research Database Subjects") — typically founders, executives, board members and investment professionals — because we usually obtain this information from sources other than the individual.

5.1 What we collect about individuals

The database is primarily about organisations and transactions, not people. Where it includes personal data, it is limited to professional-capacity information:

• Name, current and past professional roles and titles;
• Organisation affiliation (e.g. founder of, partner at, board member of);
• Involvement in publicly reported deals, funding rounds, investments and exits;
• Professional history and public professional statements (e.g. from press releases, interviews or conference materials).

We do not deliberately collect special category data, criminal-offence data, private contact details, or information about individuals' private lives, and we screen out such data if we encounter it. Our openly published datasets (including the AgBase open-access core dataset) are organisation-level (company name, country, sector classification, funding events) and are not designed to contain personal data. We review openly published datasets to exclude personal data before release.

5.2 Where the information comes from (Art 14(2)(f))

• Public registries and government or regulatory filings (e.g. Companies House and equivalent registries in the markets we cover);
• Company websites, press releases and other corporate disclosures;
• Reputable media outlets and industry publications;
• Research institutions and open-data repositories;
• Verified third-party datasets and our data partners;
• Direct submissions — information provided to us by companies, founders or their authorised representatives, and survey responses.

Because profiles are compiled from many sources over time, we cannot always attribute a specific data point to a specific source. On request, we will tell you the source(s) of the data we hold about you, where we have recorded them.

5.3 Our legal basis: legitimate interests, with a balancing summary

We process Professional Profile Data under Article 6(1)(f) (legitimate interests). Our interest — shared with our subscribers, researchers, policymakers and the wider innovation ecosystem — is in producing accurate, transparent market intelligence about investment and innovation activity in under-covered markets. Our balancing assessment, in summary:

• the data is limited to professional-capacity information, most of which the individuals or their companies have already made public;
• individuals active in fundraising, investing and company leadership can reasonably expect their professional activity to be recorded and analysed by market-intelligence providers;
• the privacy impact is low: no sensitive data, no private-life data, no direct marketing to database subjects, and no automated decisions about them;
• safeguards apply: source vetting, accuracy review, a published objection/correction route (Section 5.6), and honouring objections and erasure requests.

A copy of our legitimate interests assessment is available on request from privacy@briter.co.

5.4 How and when we tell people (Art 14(5)(b))

Because the database covers a large number of individuals identified from public sources, providing an individual notice to every person would involve disproportionate effort within the meaning of Article 14(5)(b). We instead take these measures to protect your rights:

• we publish this policy prominently, and this section specifically, as our public notice;
• if we contact a Research Database Subject directly for any reason, we provide this notice at that first communication;
• founders and authorised company representatives who engage with us to update their company's profile are pointed to this policy at that time.

Our assessment of why individual notice would involve disproportionate effort, and the safeguards we apply, is documented and available on request from privacy@briter.co.

5.5 Who receives Professional Profile Data, and where it goes (Art 14(1)(e)–(f))

Professional Profile Data is received by:

• Subscribers to and users of Briter Intelligence and AgBase — who may be located anywhere in the world — under licence terms that restrict their use of the data, including a prohibition on using personal data from the database for direct marketing to the individuals concerned;
• Readers of our published reports and openly published datasets (see Section 5.1 on the organisation-level design of open datasets); and
• Our data partners, where we collaborate on research datasets.

Where making the database available to subscribers or partners located outside the UK/EEA involves a transfer of personal data, the safeguards in Section 7 apply to our processors. Disclosures to subscribers, report readers and data partners acting in their own right are made under contract terms that restrict their use of the data, supported by a transfer risk assessment.

5.6 Your professional profile: how to see, correct or remove it

If you believe you appear in our database, you can at any time:

• Request access to the personal data we hold about you;
• Request correction of inaccurate or outdated information (founders and authorised representatives can also submit updates to their company profiles through the Platforms; corrections are subject to verification);
• Object to our processing of your data, or request erasure.

Contact privacy@briter.co with the subject line "Professional profile request". We will respond within one month. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms — and where we agree to remove personal data, we may retain the underlying organisation-level and transaction-level records in anonymised form — such that you can no longer be identified, directly or indirectly — as part of the historical market record.

5.7 Retention of Professional Profile Data

We retain Professional Profile Data while the individual holds a role at an organisation covered by our research, and afterwards only as part of the historical record of the deals and markets we cover. Specifically:

• we review profiles for accuracy and relevance at least every 24 months;
• where we learn that an individual has left a covered role, we archive or update their profile within 3 months;
• personal data in historical deal records older than 10 years is retained only where the individual remains professionally active in the markets we cover, and is otherwise anonymised.

6. Recipients — who we share personal data with

We share personal data with the service providers ("processors") and other recipients below. Every processor is bound by a data processing agreement meeting Article 28 GDPR / UK GDPR. We do not allow processors to use your data for their own purposes.

Other recipients (not processors):

• Subscribers to and users of Briter Intelligence and AgBase, and readers of our published reports, who receive the Professional Profile Data described in Section 5 under licence terms that restrict its use, including a prohibition on using it for direct marketing to the individuals concerned — see Section 5.5;
• Google and LinkedIn — independent controllers when you use their sign-in buttons (Section 3.2);
• Professional advisers (lawyers, auditors, insurers, bankers), under confidentiality;
• HMRC, regulators, courts and law-enforcement authorities, as independent controllers, where disclosure is required by law. We may be required to disclose personal data without your knowledge or consent where the law requires or permits it (for example for the prevention or detection of crime, or tax collection);
• Prospective buyers or investors in a corporate transaction, under confidentiality.

7. International transfers

We run an EU/UK-first stack: the Platforms, databases and API are hosted on AWS in the EU, and our analytics (PostHog, Mixpanel), consent management (Cookiebot), email (Mailjet) and error monitoring are all configured for EU data residency. Transfers from the EU/EEA to the UK are covered by the European Commission's UK adequacy decision, and transfers from the UK to the EU/EEA by the UK's adequacy regulations for the EEA.

Where a provider processes personal data in the United States (see the table in Section 6), we rely on:

1. the provider's certification under the EU–US Data Privacy Framework ("DPF") and, for UK data, the UK Extension to the EU–US Data Privacy Framework (the UK–US "data bridge"), where the provider holds the certification; and
2. in every case, the EU Standard Contractual Clauses (Commission Decision 2021/914) together with the UK International Data Transfer Addendum as an alternative or fallback mechanism — so that transfers remain lawful even if the Data Privacy Framework is invalidated or a provider's certification lapses.

One exception to note: for OpenAI, we rely on the SCCs with the UK Addendum rather than the DPF.

We monitor the status of the Data Privacy Framework and our providers' certifications, and will rely on the Standard Contractual Clauses with the UK Addendum (or the ICO's International Data Transfer Agreement) if the Framework or a provider's certification ceases to be valid.

Beyond our US-based providers, we may also transfer personal data to recipients in other countries without a UK or EU adequacy finding — for example, data partners contributing to or receiving research data (Section 5), Briter personnel or contractors accessing our systems remotely from outside the UK/EEA, or parties to a corporate transaction. Where we do, we use the ICO's International Data Transfer Agreement or the EU SCCs with the UK Addendum, together with a transfer risk assessment. In particular, where members of our team or contractors access personal data from outside the UK/EEA, that access is protected by appropriate safeguards (standard contractual clauses / the UK IDTA).

You can obtain a copy of the relevant safeguards by contacting privacy@briter.co.

8. How long we keep your data

We keep personal data only as long as reasonably necessary for the purposes we collected it for, including legal, accounting and reporting requirements. We may keep data longer where there is a complaint or a prospect of litigation. Specific periods:

9. Your rights

Under the UK GDPR and EU GDPR you have the right to:

• Access your personal data (a "subject access request");
• Rectify inaccurate or incomplete data;
• Erase your data, subject to legal exceptions (e.g. records we must keep for tax);
• Object to processing based on legitimate interests — and an absolute right to object to direct marketing, including profiling for direct marketing;
• Restrict processing while a dispute about the data is resolved;
• Data portability — receive data you provided to us, processed by automated means on the basis of consent or contract, in a structured, commonly used, machine-readable format;
• Withdraw consent at any time where processing is based on consent. For analytics and advertising cookies, use the consent controls on each product's cookie policy page — the "Change your consent" / "Withdraw your consent" links on the Website and the "Manage cookie settings" button on the Platforms (see the Cookie Policy, Section 4). For marketing, use any unsubscribe link or email us. Withdrawal does not affect processing that happened before it.

How to exercise your rights. Email privacy@briter.co (or write to the postal address in Section 1). There is no fee, unless a request is manifestly unfounded, repetitive or excessive, in which case we may charge a reasonable fee or refuse. We may need to verify your identity, and may ask you to clarify your request. For requests governed by the UK GDPR, where the Data (Use and Access) Act 2025's provisions on reasonable and proportionate searches are in force and permit it, the response clock pauses until you reply to a clarification request; for requests governed by the EU GDPR, we will respond within the statutory period without pausing. We respond within one month, extendable by up to two further months for complex or numerous requests — we will tell you if so.

Complaints. We maintain a data-protection complaints procedure as contemplated by the Data (Use and Access) Act 2025 — please raise concerns with us first at privacy@briter.co and we will acknowledge and respond without undue delay. You also have the right, at any time, to complain to:

• the UK Information Commissioner's Office (ICO) — Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; www.ico.org.uk; or
• if you are in the EU/EEA, the supervisory authority of your place of residence, work, or where the alleged infringement occurred (list at edpb.europa.eu).

Complaining to a regulator is without prejudice to any other administrative or judicial remedy available to you.

10. Automated decision-making and profiling

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you (Article 22 GDPR / UK GDPR). We use limited profiling for two purposes: (1) making our own marketing more relevant, and (2) applying subscription-tier limits (for example, result caps on free accounts). Neither has legal or similarly significant effects, and you can object to marketing profiling at any time.

AI Assistant. The AI Assistant on the Platforms generates informational answers about our dataset using large-language models operated by OpenAI (see Section 6). Your prompts and conversation history are stored on our infrastructure and forwarded to OpenAI to generate the response. Under our API terms with OpenAI, prompts are not used to train OpenAI's models, and the transfer safeguards described in Sections 6 and 7 apply. Assistant outputs are informational only — no automated decisions about you are made from them.

Never enter special category data (e.g. health, religion, ethnicity) or criminal-offence data into the Assistant, and avoid entering personal data in prompts, save incidental professional contact details for which you have a lawful basis.

11. Security

We apply appropriate technical and organisational measures to protect your personal data, including: hosting on AWS in the EU with access restricted to personnel who need it; encrypted connections (HTTPS/TLS) across the Services; passwords stored only using industry-standard salted password hashing; passwordless login options (one-time codes and magic links); payment card data handled exclusively by Stripe (PCI-DSS) and never stored on our systems; and a PII-scrubbing layer that strips emails, tokens and one-time codes from analytics data before it leaves the browser.

We have procedures for suspected personal data breaches and will notify you and the relevant regulator where we are legally required to do so. Platform users must keep their credentials confidential and tell us promptly about any suspected compromise.

12. Children

The Services are business tools and are not directed at children. The Services are offered only to users aged 18 or over, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us personal data, contact privacy@briter.co and we will delete it unless we are legally required to retain it.

13. Cookies and similar technologies

We use cookies and similar technologies (including local storage) on the Website and Platforms, managed through the Cookiebot consent banner. Non-essential cookies are set only with your consent, and you can change or withdraw your choices at any time using the controls described in Section 9. Emails we send are sent without open- or click-tracking enabled (see the Cookie Policy, Section 5.5). Full details — including every cookie's name, provider, purpose and duration, and how the consent banner works on each product — are in our Cookie Policy.

14. Third-party links

The Services link to third-party websites and services (for example, sources cited in our research, or HubSpot-hosted booking pages). We are not responsible for their privacy practices; please review their own privacy notices.

15. Other jurisdictions

This policy is written to satisfy the UK GDPR and EU GDPR, which set the standard we apply globally. If the law of another jurisdiction gives you additional rights over your personal data, you can exercise them by contacting privacy@briter.co.

16. Changes to this policy

We review this policy at least annually. When we make material changes, we will update the effective date and version above and give notice — by email to account holders and/or a prominent notice on the Website and Platforms — before the changes take effect. Superseded versions, with the periods during which they applied, are archived at briter.co/legal and available on request from privacy@briter.co. This version (1.0, draft of 14 July 2026) is a draft and is not yet in force; once it takes effect it will replace all previous privacy notices published for briter.co, Briter Intelligence and AgBase.