Privacy Policy

Last Updated: February 2026

1. Introduction
   Bastion ("we," "us," or "our") is committed to protecting the privacy of our institutional clients and their users. This policy outlines how we collect, process, and safeguard personal data in compliance with the UK GDPR and the Data (Use and Access) Act 2025.

2. Data We Collect
   As a B2B SaaS provider, we primarily collect:
   User Account Data: Professional contact information (names, corporate emails).
   System Usage Data: IP addresses and interaction logs for security and "statistical purposes" under DUAA exceptions.
   Verification Data: Professional credentials and identity verification required for onboarding and access.

3. AI and Automated Decision-Making (ADM)
   Our Event-to-Outcome engine utilizes AI and specialized LLMs to simulate market events.
   Transparency: We provide meaningful information about our AI logic and its role in identifying market beneficiaries.
   Human Intervention: Users have the right to contest automated outputs and request a human review of significant findings.
   Bias Monitoring: We conduct regular audits to detect and mitigate bias in our financial modeling datasets.

4. Lawful Basis for Processing
   We rely on the following legal bases:
   Contractual Necessity: To provide the Bastion platform services.
   Recognised Legitimate Interests: Including fraud prevention and safeguarding, as defined under the DUAA 2025.
   Legal Obligation: Compliance with UK financial regulations.

5. Data Sharing and Retention
   Institutional Silos: Client data is siloed and not shared across different institutional users.
   Retention: We typically retain data for 6 to 7 years following the termination of an agreement to comply with HMRC and regulatory requirements.

6. Your Rights
   Under UK law, you have the right to:
   Access and Portability: Request a copy of your data in a structured, machine-readable format.
   Complaints: Since June 2026, you have a statutory right to complain. We will acknowledge any data complaint within 30 days.
   Stop-the-Clock: We may pause statutory response timelines if we require further information to fulfill a complex request.

7. Contact Us
   For any data-related queries, please contact us:
   
   

   Email: gareth@bastion-ai.com