Privacy notice
This notice explains how ZARN LTD handles personal data submitted through the public ZARN pilot site at zarn.ai, including the suitability scorecard and enquiry journey.
Last updated: 2 June 2026
Who we are
ZARN LTD (“ZARN”, “we”, “us”) is the data controller for personal data collected through this pilot site. ZARN LTD is registered in England and Wales, Company No. 16431762, with registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
What we collect
Through the pilot site and the suitability scorecard form, we may collect:
- Identification and contact data (name, work email, role, organisation).
- Organisation context (sector, size, protective security responsibilities).
- Scorecard responses you choose to provide.
- Technical data automatically generated by your browser (IP address, user agent, timestamps) for security, abuse prevention and basic analytics.
- Correspondence you send to us by email.
You should not submit classified, highly sensitive, legally privileged, special category, unnecessary personal data, or information you are not authorised to share through the pilot site or scorecard.
Why we use it
- To assess suitability for the ZARN Pilot Programme.
- To contact you about your enquiry or pilot application.
- To operate, secure and improve the pilot site.
- To meet legal, regulatory and accountability obligations.
Lawful bases
We rely on our legitimate interests in evaluating pilot suitability and operating a secure platform, on taking steps at your request prior to entering a potential engagement, and on compliance with legal obligations where applicable.
Who we share it with
We share personal data only where necessary, with:
- Vetted infrastructure providers that host the pilot site, database and transactional email delivery on our behalf.
- Professional advisers (legal, accounting, security) under duties of confidentiality.
- Authorities where we are legally required to do so.
We do not sell personal data and do not use it for advertising profiling.
International transfers
Where data is processed outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum.
How long we keep it
Scorecard submissions and related correspondence are retained for as long as needed to evaluate suitability and operate the pilot, and then for a limited period afterwards to meet legal and accountability requirements. Technical security logs are retained for a short rolling window. Unsuccessful or inactive enquiries are deleted or anonymised when no longer needed.
How we protect it
We apply access controls, encryption in transit, strong authentication safeguards and least-privilege practices. Access to scorecard submissions is restricted to authorised ZARN personnel.
Your rights
Under UK data protection law you have rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw consent where processing relies on it. You can exercise these rights by emailing privacy@zarn.ai. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
Cookies
ZARN may use essential cookies or similar technologies required to operate, secure and maintain the site. Where we use non-essential cookies or analytics technologies, we will provide appropriate notice and controls where required.
Contact
- ZARN LTD
- Company No. 16431762
- Registered in England and Wales
- Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
- Privacy enquiries: privacy@zarn.ai