1. Data controller
Basely Virtual Ltd (“we”, “us”, “our”) is the data controller for the personal data we process in connection with our services. We are registered in England and Wales and are registered with HMRC as a Trust or Company Service Provider (TCSP).
For data protection enquiries, please contact us at hello@baselymail.co.uk.
2. What data we collect
We collect the following categories of personal data:
- Identity data: Full name, date of birth, government-issued ID documents collected for AML verification
- Contact data: Email address, postal address, telephone number
- Financial data: Payment card details processed by Stripe (we do not store card numbers directly)
- Mail data: Content of mail items scanned on your behalf, mail logs
- Usage data: IP addresses, device type, browser, pages visited, and dashboard activity logs
3. Why we collect it and our legal basis
Providing our services (contract performance)
We use your contact, identity, and account data to set up and manage your virtual address services.
Legal obligation (AML compliance)
We are legally required under the Money Laundering Regulations 2017 to verify your identity before providing services.
Legitimate interests
We process usage data to improve our platform, detect fraud, and ensure the security of our systems.
Consent
Where we send marketing communications, we do so only with your consent and you may withdraw this at any time.
4. Data retention
We retain your personal data for as long as is necessary to provide our services and comply with legal obligations:
- AML identity verification records: 5 years from the end of the business relationship (as required by MLRs 2017)
- Scanned mail: retained for the period specified in your plan (30–365 days), then securely deleted
- Account and billing records: 7 years for tax and accounting purposes
5. Your rights
Under UK GDPR, you have the following rights:
- Right of access: Request a copy of the data we hold about you
- Right to erasure: Request deletion of your data, subject to our legal obligations
- Right to portability: Receive your data in a machine-readable format
- Right to rectification: Correct inaccurate or incomplete data
- Right to object: Object to processing based on legitimate interests
To exercise any of these rights, contact us at hello@baselymail.co.uk. We will respond within 30 days.
6. Third-party processors
We share data with the following trusted third-party processors:
- Stripe: Payment processing. Data processed in accordance with Stripe's privacy policy.
- Supabase: Database hosting. Data stored in EU-region servers.
- Google: Authentication via Google OAuth, if you choose to sign in with Google.
- Resend: Transactional email delivery.
- Onfido / identity verification provider: AML identity verification processing.
7. Complaints
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.