Privacy policy

Who are we and what do we do?

RegSensus (“RegSensus”, “we”, “our” or “us”) has developed and owns a cloud hosted SaaS platform that enables businesses to monitor and report on their compliance with regulatory requirements (Services).

This privacy policy gives you information about how we collect, store, use, disclose and process and use your personal data through:

1. your use and visitation of www.regsensus.com, www.fundapps.co, www.steel-eye.com and other RegSensus websites (Websites); and

2. your use of our Services as a client or an employee of a client

The Websites and Services are not intended for children and we do not knowingly collect data relating to children.

Please note that this privacy policy does not cover our practices regarding prospective candidates or job applicants. Please visit https://www.regsensus.com/candidate-privacy-policy which describes our practices relating to such personal data processing.

Contact details

If you have any questions about this privacy policy or our privacy practices, please contact our legal counsel who is responsible for overseeing questions in relation to this privacy policy by email on privacy@regsensus.co.

You have the right to make a complaint at any time to the relevant regulator for data protection issues (such as the ICO in the UK). We would, however, appreciate the chance to deal with your concerns before you approach a regulator so please contact us in the first instance.

Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review. This version was last updated in November 2026. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

The Websites may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Websites, we encourage you to read the privacy policy of every website you visit.

1. The types of personal data we collect about you and where we get it from

The personal information we process about you broadly falls into four main categories: (i) Contact Information; (ii) Service and Billing Information; (iii) Browsing and Device Usage Information; and (iv) Marketing Preferences.

We collect your personal information from various sources. The table below sets out the different types of personal information that we collect and the sources we collect it from.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals' Browsing and Device Usage Information to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our Websites and using our Services to help improve the website and our service offering.

We do not intentionally collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with the Services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

2. How we use your personal data

We have set out below, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so.

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

Direct marketing 

You will receive marketing communications from us if you have requested information from us via our Websites or purchased our Services and you have not opted out of receiving the marketing.

We may also analyse your Contact and Marketing Information to form a view as to which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

Third-party marketing 

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing 

You can ask us to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you or by contacting us at marketing@regsensus.com.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or client service purposes.

Cookies and other tracking technologies 

When you visit any website, it may store or retrieve information on your device. This information might be about you, your preferences or your device.

We use cookies, tracking pixels and tags to make our Websites work, to remember your preferences, to collect information about how our Websites are used, and how people interact with our emails.

The information may include information about your device, browser, preferences, use of our Websites and interaction with our emails. Although this information does not usually directly identify you, it may constitute personal data, for example where it includes an IP address. Where we process personal data collected through these technologies, the other relevant provisions of this Privacy Policy apply. Because we respect your right to privacy, you can choose not to allow some types of cookies using the “Accept” or “Decline” our use of cookies that are not strictly necessary. However, blocking some types of cookies may impact your experience of the Websites and the Services we are able to offer.

Types of cookies we use

• Strictly necessary cookies. These cookies are required to provide you with a service you request, such as processing information you enter into a form, keeping you logged in, or remembering your cookie choices. They are essential for the operation of our Websites and cannot be disabled in our cookie settings. You can set your browser to block or alert you about these cookies, but some parts of the Websites will not then work.
• Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our Websites when they are using it. This helps us to improve the way our Websites work, for example, by ensuring that users are finding what they are looking for easily. All information these cookies collect is aggregated. If you do not allow these cookies we will not know when you have visited our Websites and will not be able to monitor their performance.
• Functionality cookies. These are used to recognise you when you return to our Websites. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Targeting cookies. These cookies record your visit to our Websites, the pages you have visited and the links you have followed. We or our advertising partners may then use this information to make our Websites and the advertising displayed on it more relevant to your interests. They are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Tracking Pixels

We may use tracking pixels in two types of emails: (1) marketing emails and (2) certain operational emails. These pixels help us manage deliverability and improve our communications.

Marketing emails. RegSensus and its sub-processors use tracking pixels to see whether and when you open our marketing emails, compile distribution statistics, and manage our mailing lists (including adjusting frequency or stopping mailings). We also use this information to personalize how we communicate with you and choose the frequency or channel used. You can ask us to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you or by contacting us at marketing@regsensus.com.

Operational emails. RegSensus may also use tracking pixels in certain operational emails, such as billing notices, account administration messages, security alerts, authentication emails, and service updates. We use operational tracking pixels only where necessary to deliver and secure our services, troubleshoot issues, or meet legal, contractual, or regulatory obligations. We do not use the information gathered through operational tracking pixels for marketing purposes. Examples of the types of data collected include IP address, device/email-client information, message identifiers, and timestamps.

Your choices

We use strictly necessary cookies without asking for your consent. For other types of cookies, we ask for your consent before storing them on, or accessing information from your device.

You can make cookie choices through our cookie banners. You can change your choices at any time by clicking the Cookie Settings button in the banner at the bottom of any of our Websites.

If you are in a jurisdiction that requires your consent before the use of tracking pixels in emails, we ask for your consent before using them. You can withdraw this consent at any time using the link included in an email from us or contacting us at marketing@regsensus.com.

You can also manage and control the use of cookies through your browser, including removing cookies by deleting them from your browser history when you leave our Websites. You can also opt out of being tracked by Google Analytics across all websites.

3. Disclosures of your personal data

We may share your personal data with third parties for the purposes set out under ‘How we use your personal data’ above. We’ve broken down the list of third parties into relevant sections to give you a greater understanding over how these services may have access to your information.

Rio Group Bidco Limited is the parent company for the RegSensus group (the “RegSensus Group”).

The RegSensus Group is formed of 5 separate entities located in the UK, Singapore, USA, India and Portugal, and each will contribute to the provision of the Services and are therefore considered internal third parties:

Outside of the Regsensus Group we also use the following external third parties:

The following third parties are engaged on an ad-hoc basis as and when the relevant circumstance arises: 

• We partner with investment management and compliance professionals/consultants such as Blackrock, Simcorp A/S, Optima Partners Holdings LLC, Enfusion Ltd LLC, CoData, WTax, Eze, Kerv, Cloudbox, who may refer to us, with consent, any of their clients who are interested in our Services.
• We also work with, on request from our clients, data providers such as: FIA Tech, Refinitiv,Bloomberg, BigTXN, LSEG, S&P, therefore Contact Information may be shared between us and the providers on request from you.
• Aosphere Limited is an information provider that our clients must have a subscription with before using our Shareholding Disclosure Services and therefore we would need to share Contact Information with them in order for that to be actioned.
• We also work with, on request from our clients, service providers and connectors such as: LeapXpert, Fano, Deepgram, Unavista, and Colt – therefore Contact Information may be shared between us and the providers on request from you.
• Professional advisers acting as processors including lawyers, bankers, auditors and insurers based in the UK, USA, Singapore, India and Portugal who provide consultancy, banking, legal, insurance and accounting services may have incidental access to personal information. This will also include auditors that audit us yearly on our security and other internationally recognised standards/accreditations.
• Regulators and other governmental authorities acting as joint controllers based in the UK, USA, Singapore, India and Portugal who require reporting of processing activities in certain circumstances may also have incidental access to personal information.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this privacy policy.
• If you attend an event or webinar organized by us, we may share your personal data with our event partners or sponsors of the event or the resource. In these circumstances, the processing of your personal data will also be governed by the relevant partners’ or sponsors’ privacy policy, which we recommend you read carefully. If required by applicable law, we may seek your consent to such sharing via the registration form. If you do not wish for your personal data to be shared, you may choose to not opt-in via the event/webinar registration form, or you can opt-out in accordance with Section 2 herein.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

4. International transfers

We will transfer the personal information we collect about you inside of and transfer between the USA, UK, Singapore, India and Portugal where our Internal Third Parties are located in order to perform our contract with you. Such transfers are governed by an intragroup arrangement that contains specific standard contractual terms approved for use in the UK, USA, Singapore, India and Portugal which give the transferred personal data the same protection as it has in its originating jurisdiction.

We may transfer your personal data to External Third Parties that carry out certain functions on our behalf. This may involve transferring personal data outside of your home jurisdiction to countries which have laws that do not provide the same level of data protection as the laws of your home jurisdiction. Whenever we undertake such transfers, we ensure a similar degree of protection is afforded to you by ensuring that the following safeguards are implemented:

• We conduct enhanced due diligence on all External Third Parties which includes a full security and legal review prior to onboarding them.
• We only transfer your personal data to countries that have been deemed by the EU (pursuant to article 45 of Regulation (EU) 2016/679) to provide an adequate level of protection for personal data, namely, the UK under GDPR and the United States (for organisations participating in the EU-US and UK extension of the Data Privacy Framework).
• We use specific standard contractual terms approved for use in the UK and EU which give the transferred personal data the same protection as it has in the UK and EU, namely the EU Standard Contractual Clauses, the International Data Transfer Agreement or the International Data Transfer Addendum to the EU SCCs for international data transfers.
• We will conduct transfer risk assessments and data protection impact assessments where applicable to identify and minimise any risks associated with such third-party processing and transferring any personal data.
• We shall remain responsible for the acts and omission of any External Third Parties as if they were our acts and omissions.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of your home jurisdiction.

5. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We are ISO27001 certified and comply with SOC 2 – further details on our security processes can be found here.

6. Data retention

How long will you use my personal data for?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law we have to keep basic information about our clients (including Contact Information and Service and Billing Information) for six years after they cease being clients for tax purposes. Otherwise, we will retain all other personal data for the length of our contractual agreement with you or until such time as we receive a deletion request.

In some circumstances you can ask us to delete your data: see section 7 for further information.

7. Your legal rights

Under data protection laws in relation to your personal data, you have the right to:

• Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object. You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes (see OPTING OUT OF MARKETING for details of how to do so).
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide our Services to you. We will advise you if this is the case at the time you withdraw your consent.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
  
  • If you want us to establish the data's accuracy;
  • Where are use of the data is unlawful but you do not want us to erase it; 
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it  

If you wish to exercise any of the rights set out above, please contact privacy@regsensus.com.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

8. Supplemental Notice for the United States

This section provides additional details about the personal information we collect about individuals and the rights afforded to them under various applicable U.S. state data-protection and privacy laws, including the California Consumer Privacy Act, as amended (CCPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), and the Virginia Consumer Data Protection Act (VCDPA).

Your Rights

Subject to applicable law, you have the following rights with respect to your personal information.

• Right to access. You have the right to request that we disclose to you in a portable format the personal information we collect, use, disclose, share, and sell about you.
• Right to correct. You have the right to correct errors in your personal information.
• Right to delete. You have the right to request that we delete your personal information that we’ve collected.
• Right to update. You have the right to request that inaccurate personal information we hold about you be corrected.
• Right to opt out. You have the right to opt out of behavioural or targeted advertising, automated profiling, and sales of personal information.
• Right to restrict the use and disclosure of your sensitive information. You have the right to request that we limit our use and disclosure of your sensitive personal information.
• Right to non-discrimination. You have the right not to receive discriminatory treatment because you’ve exercised any of your rights under the CCPA.

If you or your authorised agent wishes to exercise any of these rights, please contact privacy@regsensus.com. Please note that we may ask you or your agent to provide us with additional information to confirm your identity.

If you submit a request to exercise one of the above rights and you disagree with our decision regarding your request, you may have the right to appeal our decision under applicable law. To do so, please reply to our response.

Categories of Personal Information Collected

The personal information that we’ve collected in the past 12 months fall into the following categories specifically established under the CCPA:

• Identifiers such as a real name, postal work address, work email address and IP address.

• Information under Cal. Civ. Code §1798.80(e), such as your name, work address or telephone number.

• Commercial information, such as information related to the Services you’ve purchased or are interested in.

• Professional or employment related information such as title and organisation name.

• Internet or other electronic network activity information, such information regarding your interaction with our Websites or Services.

• Audio, electronic, visual, or similar information, such as audio recordings of calls with you.

• Inferences drawn on the information above, such as aggregated metrics and preferences.

• Account log-in in combination with your credentials allowing access to your account.

For more information about the categories of personal information we collect, please see the “The types of personal data we collect about you” section above.

Categories of Personal Information Disclosed for a Business Purpose

The personal information that we’ve disclosed for a business purpose (including to the Internal and External Third Parties) in the past 12 months fall into the following categories specifically established under the CCPA:

• Identifiers such as a real name, postal work address, work email address and IP address.

• Information under Cal. Civ. Code §1798.80(e), such as your name, work address or telephone number.

• Commercial information, such as information related to the Services you’ve purchased or are interested in.

• Professional or employment related information such as title and organisation name.

• Internet or other electronic network activity information, such information regarding your interaction with our Websites or Services.

• Audio, electronic, visual, or similar information, such as audio recordings of calls with you.

• Inferences drawn on the information above, such as aggregated metrics and preferences.

• Account log-in in combination with your credentials allowing access to your account.

For more information about the categories of personal information we disclose to Internal and External Third Parties, including to our services providers, please see the “The types of personal data we collect about you” section above.

No Sale or Sharing of Personal Information

We do not sell or share (for the purpose of cross-context behavioural advertising) your personal information, as those terms are defined under the CCPA.

9. Supplemental information for other regions

• Australia: Personal data that is collected, stored, used, and/or processed by us, as described in this policy, is done so in accordance with the Australian Privacy Act 1988 (Commonwealth) and the Australia Privacy Principles. If you are dissatisfied with our handling of a complaint or do not agree with the resolution proposed by us, you may make a complaint to the Office of the Australian Information Commissioner (OAIC) by contacting the OAIC using the methods listed on their website. Alternatively, you may request that we pass on the details of your complaint to the OAIC directly.
• Canada: Personal data, as defined in the Personal Information Protection and Electronic Documents Act (PIPEDA) will be collected, stored, used, and/or processed by us in accordance with our obligations under PIPEDA.
• European Union: Personal data that is collected, stored, used, and/or processed by us, as described in this policy, is done so in accordance with our obligations under the General Data Protection Regulation (EU) 2016/679 (GDPR).
• India: Personal data that is collected, stored, used and/or processed by us, as described in this policy, is handled in accordance with applicable Indian data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025, as their relevant provisions come into force. Individuals may contact us using the contact details provided above to exercise their rights or raise any concerns regarding the processing of their personal data, in accordance with applicable law.
• Japan: Personal data that is collected, stored, used, and/or processed by us, as described in this policy, is done so in accordance with Japan’s Act on the Protection of Personal Information (APPI).
• Nevada: We do not presently sell personal data as defined under Nevada law. If you are a Nevada resident, you may nevertheless email us using the information above to exercise your right to opt-out of sale under Nevada Revised Statutes §603A et seq.
• Singapore: Personal data that is collected, stored, used and/or processed by us, as described in this policy, is done so in accordance with our obligations under the Personal Data Protection Act 2012 (PDPA).
• Switzerland: Personal data that is collected, stored, used, and/or processed by us, as described in this policy, is done so in accordance with our obligations under the Swiss Federal Act on Data Protection (FADP) and its implementing ordinances.
• United Kingdom: Personal data that is collected, stored, used, and/or processed by us, as described in this policy, is done so in accordance with our obligations under the UK Data Protection Act 2018, as amended by the Data Protection, Privacy and Electronic Communications (Amendments, etc.) (EU Exit) Regulations 2019, as amended, superseded or replaced (UK GDPR).