Privacy Policy

1) Who we are (Data Controller)

The data controller is Generation Beta Digital Limited (trading as BetaOffice).

• Registered office: 3rd Floor, 86–90 Paul Street, London EC2A 4NE, UK
• Company No: 16274319 • ICO Registration: ZB883806
• Email: privacy@betaoffice.uk
• EU/EEA representative (if applicable): add details if required

2) Data we collect

We may collect the following categories of data, depending on how you use the Services:

• Identity & Contact: name, email, phone, date of birth, address, identity/KYC documents.
• Company: company name, registration number, address, directors/beneficial owners.
• Service Data: virtual office preferences, forwarding options, scanned mail metadata (see below), referral codes and custom slugs, wallet transactions.
• Scanned Mail: envelope images, PDFs, and AI-extracted metadata (e.g., sender, document title, categories) to help search/organise mail.
• Payments: processed via Stripe; we do not store full card details.
• Technical: IP address, device/browser info, timestamps, event logs, site/app interactions.
• Marketing & Comms: communication preferences; referral & campaign attribution.
• Physical mail (unforwarded): securely stored for up to 30 days after receipt, then confidentially shredded for privacy and data-protection reasons. Once destroyed, it cannot be recovered or forwarded.

We collect data directly from you, via integrations (e.g., Hoxton for mail/ACTIVE status), and from public sources (e.g., Companies House) where relevant.

3) How we use data & lawful bases

We process personal data for the following purposes under these legal bases:

4) Sharing & subprocessors

We share data with trusted providers strictly to deliver and secure the Services. We impose contractual safeguards and only share the minimum necessary:

• The Hoxton Mix Ltd — virtual office services & mail handling (incl. ACTIVE status sync).
• Stripe — secure payment processing and anti-fraud.
• Companies House — business verification and public registry checks.
• Document understanding/AI metadata providers — to generate searchable mail metadata.
• Cloud hosting, security & monitoring — infrastructure, backups, logging, DDoS/anti-bot.
• Professional advisers — legal, accounting, compliance where necessary.
• Authorities — where required by law or to protect rights/safety.

We do not sell personal data.

5) International transfers

Where data is transferred outside the UK/EEA, we rely on safeguards such as the UK IDTA, EU SCCs and/or adequacy regulations, plus technical and organisational measures.

6) Data retention

• Account & KYC records: for the life of the account and as required by KYC/AML laws.
• Scanned mail: securely stored for 12 months from receipt, then deleted unless law requires longer or you request earlier deletion where permissible.
• Wallet & referral ledger: typically 6 years (tax/accounting/legal obligations).
• Support/communications: up to 3 years after ticket closure unless law requires longer.
• Marketing data: until you withdraw consent or object.

7) Security

We use encryption in transit, network isolation, role-based access controls, audit logs, and backups. Access to personal data is restricted to authorised personnel with a need to know. We regularly review our security posture and third-party assurances.

8) Your rights

Subject to conditions and exemptions under UK/EU data protection law, you have the right to:

• Access, rectify or erase your data
• Restrict or object to processing
• Data portability
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority (e.g., the ICO in the UK)

To exercise your rights, email privacy@betaoffice.uk. We aim to respond within one month.

UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint/

9) Cookies

We use cookies for functionality, security (e.g., anti-bot) and analytics. See our Cookie Policy for details and controls.

10) Special categories

We do not intentionally collect special category data (e.g., health, biometrics) unless necessary for verification or where you provide it voluntarily and lawfully. Where processed, we rely on an appropriate legal basis and additional safeguards.

11) Automated decision-making

We do not make decisions producing legal or similarly significant effects solely by automated means. Some anti-fraud/abuse checks may be automated; human review is available.

12) Children’s data

Our Services are not intended for children. We do not knowingly collect personal data from users under the age required by applicable law. If you believe such data was provided, please contact us to remove it.

13) Changes to this Policy

We may update this Policy to reflect legal, technical or business changes. We will post the latest version here and update the “Last updated” date. Material changes may be notified via email or in-app.

14) Contact us