GDPR / Data Protection

Last updated: 29 September 2026

NeverExpiry is designed to help individuals, families, households, professionals, businesses and organisations securely organise documents, manage important dates and maintain records. Because documents stored through NeverExpiry may contain personal, confidential or sensitive information, data protection is an important part of how the service is designed and operated. This page explains NeverExpiry's approach to GDPR and data protection. It should be read together with our Privacy Policy, Terms & Conditions, Cookie Policy, Cookie Preferences and Security information.

1. Who We Are NeverExpiry is operated by: Auradenta Ltd, trading as NeverExpiry Company number: 16656621 Registered office: 71–75 Shelton Street Covent Garden London United Kingdom WC2H 9JQ Our data-protection framework takes account of applicable UK data-protection law, including the UK GDPR, Data Protection Act 2018 as amended, the Data (Use and Access) Act 2025 and applicable privacy and electronic communications rules.

2. Purpose of This Page This page provides a high-level explanation of NeverExpiry's data-protection framework and operational approach. It does not replace the NeverExpiry Privacy Policy. The Privacy Policy explains in more detail what personal information is processed, why it is processed, lawful bases, service providers, international transfers, retention and individual rights. Where NeverExpiry acts as processor for a business or organisation, additional Data Processing Agreement terms may also apply.

3. Controller and Processor Roles Auradenta Ltd may act as controller where NeverExpiry determines why and how information is processed, including for: • account administration • subscriptions • billing • platform security • fraud prevention • service administration • customer support • legal compliance A business or organisation using NeverExpiry may act as controller where it determines why personal information concerning employees, customers, clients, patients, tenants, contractors or other individuals is processed. In such circumstances NeverExpiry may act as processor on behalf of that customer. NeverExpiry may separately remain controller for processing it performs for its own purposes.

4. Data-Protection Principles Where applicable, NeverExpiry aims to process personal information consistently with principles including: • lawfulness, fairness and transparency • purpose limitation • data minimisation • accuracy • storage limitation • integrity and confidentiality • accountability

5. Lawful Bases Depending on the processing activity, NeverExpiry may rely on: Contract: Where processing is necessary to provide an account, document-storage function, reminder, subscription or other service requested by a user. Legitimate interests: Where reasonably necessary to secure NeverExpiry, prevent fraud, investigate misuse, diagnose faults, maintain platform reliability or establish, exercise or defend legal claims, provided applicable legal requirements are met. Legal obligation: Where processing is necessary to comply with legal, regulatory, tax, accounting, court or other binding legal requirements. Consent: Where consent is the appropriate basis for optional processing, communications or technologies. Where consent is relied upon, it may be withdrawn in accordance with applicable law. Withdrawal does not make earlier lawful processing unlawful.

6. Information Required to Provide a Service Where particular personal information is required to create an account or provide a requested feature, NeverExpiry will make this clear where appropriate. If required information is not provided, NeverExpiry may be unable to provide the relevant account, feature or service.

7. Data Minimisation NeverExpiry aims to process only information reasonably necessary for the relevant purpose. Users and organisations should avoid uploading unnecessary personal information, particularly information relating to: • children • health • criminal-offence records • identity documents • financial information • other sensitive matters

8. Private Document Storage Documents uploaded into a NeverExpiry vault are treated as private account content. Private documents are not intentionally published into the shared NeverExpiry catalogue. NeverExpiry does not sell private customer documents or private vault contents. Private document contents are not intended to be used for behavioural advertising.

9. Access to Private Information Access to personal information should be limited to legitimate operational requirements. NeverExpiry aims to apply access controls appropriate to the information and relevant processing activity. Personnel and service providers should only receive access reasonably necessary for their authorised role or function.

10. Privacy by Design and Default NeverExpiry aims to consider data protection when designing and developing functionality. This includes considering: • what personal information is required • whether information can be minimised • who needs access • storage arrangements • retention • deletion • security risks • third-party processing • user controls • international transfers • whether a DPIA may be required

11. Data Protection Impact Assessments Where proposed processing may create a high risk to individuals' rights and freedoms, NeverExpiry will consider whether a Data Protection Impact Assessment is required. A DPIA may be appropriate for significant new processing involving sensitive information, new technologies, large-scale processing or other high-risk activities.

12. Special Category Personal Information Documents may contain special-category information including: • health information • racial or ethnic origin • political opinions • religious or philosophical beliefs • trade-union membership • genetic information • biometric information used for identification • sex life • sexual orientation Where NeverExpiry itself determines the purpose of such processing, an appropriate lawful basis and additional legal condition will be identified where required. Where a business customer acts as controller, that customer remains responsible for identifying the lawful basis and additional condition applicable to its own processing.

13. Criminal-Offence and Background-Check Information NeverExpiry may store records such as: • DBS checks • police checks • criminal-record checks • employment screening • professional background checks Where a business customer controls such information, that customer remains responsible for ensuring that its processing is lawful and that any additional legal conditions are satisfied.

14. Children and Dependants An authorised parent, guardian or other lawful representative may use NeverExpiry to manage appropriate documents relating to a child or dependant. Children's personal information requires particular care. Where an organisation stores information relating to children or students, that organisation remains responsible for its own transparency, authority, consent, safeguarding and supervision obligations where applicable.

15. Business Customers — All Industries NeverExpiry's data-protection framework applies across all industries and sectors. It is not limited to dental, medical or healthcare organisations. NeverExpiry may be used by: • employers • landlords • healthcare providers • professional practices • educational organisations • retailers • hospitality businesses • property businesses • contractors • charities • membership organisations • other commercial or non-commercial organisations Where an organisation determines why and how third-party personal information is processed, it remains responsible for its obligations as controller.

16. Data Processing Agreements Where NeverExpiry processes personal information on behalf of a business customer as processor, an appropriate Data Processing Agreement or equivalent processing terms may apply. Such terms may address: • subject matter and duration of processing • nature and purpose of processing • types of personal information • categories of individuals • documented instructions • confidentiality • security • sub-processors • individual-rights assistance • data breaches • DPIAs • deletion or return of information • compliance and audit information

17. Processing on Documented Instructions Where NeverExpiry acts as processor, it should process relevant personal information according to the controller's documented instructions except where applicable law requires otherwise. If NeverExpiry determines its own purposes and means for a particular processing activity, it may act as controller for that activity.

18. Sub-Processors NeverExpiry may use specialist providers for services including: • infrastructure • hosting • authentication • private storage • database services • transactional communications • payments • OCR • security • monitoring • AI-assisted processing where relevant Where NeverExpiry acts as processor and appoints another processor, applicable authorisation and contractual requirements will be followed.

19. Minimising Information Shared with Providers NeverExpiry aims to provide each service provider only with information reasonably necessary to perform the relevant function. Appropriate contractual, confidentiality, security and data-protection arrangements should apply where required.

20. Confidentiality People authorised to process personal information on behalf of NeverExpiry should be subject to appropriate confidentiality obligations. Access should be limited according to legitimate operational need.

21. Technical Logs NeverExpiry may process technical, security, diagnostic and performance information required to operate and protect the service. NeverExpiry aims to avoid recording private document contents in routine: • technical logs • performance logs • diagnostic logs • security logs except where reasonably necessary for a specific requested function, troubleshooting, security incident, investigation or other lawful purpose. Routine logs are not intended to operate as a substitute for private document storage.

22. Security of Processing NeverExpiry aims to maintain technical and organisational measures appropriate to the risks associated with the service. These may include: • secure connections • authentication • access restrictions • private-storage protections • database controls • session controls • monitoring • infrastructure security • incident-response processes No internet-connected service can guarantee absolute security.

23. Personal Data Breaches NeverExpiry maintains processes intended to identify, assess, investigate, document and respond to personal-data breaches. Where applicable law requires notification to the relevant supervisory authority, NeverExpiry will provide the required notification within the applicable legal timeframe. Where notification of affected individuals is legally required, NeverExpiry will provide the required information without undue delay. Appropriate records of breaches will be maintained.

24. Service Providers and Professional Advisers NeverExpiry may use specialist providers to support operation of the service. Personal information may also be disclosed where reasonably necessary to: • professional advisers • insurers • auditors • accountants • legal advisers • regulators • courts or authorities where legally required Information may also be processed where reasonably necessary in connection with a genuine merger, acquisition, restructuring, sale or transfer of NeverExpiry or Auradenta Ltd, subject to applicable data-protection requirements.

25. International Transfers Some service providers may process personal information outside the United Kingdom. Where a restricted international transfer occurs, NeverExpiry will use an appropriate lawful transfer mechanism where required. This may include: • UK adequacy regulations • recognised contractual safeguards • the International Data Transfer Agreement • an appropriate UK Addendum • another permitted transfer mechanism

26. Data Retention NeverExpiry does not intend to retain personal information indefinitely without a legitimate purpose. Retention may depend on: • the nature of the information • the purpose for processing • account status • legal obligations • billing or accounting requirements • security • fraud prevention • disputes • legal claims • technical backup cycles Private vault documents are generally retained while the user chooses to keep them in their account. Further retention information is provided in the Privacy Policy.

27. Deletion and Backups Where information is deleted from active storage, technical backup copies may remain temporarily until normal backup rotation removes or overwrites them. Backups are not intended to operate as active customer storage after deletion. Where NeverExpiry acts as processor, applicable processing arrangements may also require deletion or return of personal information at the end of processing, subject to applicable law and practical backup safeguards.

28. Individual Data-Protection Rights Depending on applicable law and circumstances, individuals may have rights including: • access • rectification • erasure • restriction • objection • portability • withdrawal of consent where applicable • rights relating to certain automated decisions • complaint to a supervisory authority These rights may be subject to legal conditions, limitations and exemptions.

29. Subject Access Requests An individual may have the right to request access to personal information concerning them. NeverExpiry will respond within the period required by applicable law. We may request information reasonably necessary to verify identity or authority before providing personal information.

30. Requests Where a Business Customer Is Controller Where NeverExpiry acts only as processor for another organisation, a request concerning personal information controlled by that organisation may need to be handled primarily by that organisation. NeverExpiry will provide appropriate assistance where required by applicable data-processing obligations.

31. Right to Object Where applicable, individuals may object to processing based on legitimate interests. If NeverExpiry processes personal information for direct marketing, applicable objection rights will be respected.

32. Automated Processing and AI NeverExpiry may use automated systems for functions such as: • OCR • date extraction • document classification • reminder scheduling • catalogue organisation • translation • selected AI-assisted features NeverExpiry is not currently intended to make solely automated decisions about individuals that produce legal or similarly significant effects. If such functionality is introduced, NeverExpiry will implement the transparency and safeguards required by applicable law.

33. AI and Private Customer Documents NeverExpiry does not use private customer documents to train NeverExpiry proprietary AI models. Where an external AI provider is used for a requested feature, only information reasonably necessary for that feature should be processed. Appropriate contractual, security and data-protection safeguards should apply. NeverExpiry will not make broader promises regarding an external provider's technical retention, training or processing practices unless those commitments actually apply to the relevant service.

34. Accountability and Records NeverExpiry aims to maintain appropriate records to demonstrate compliance with applicable data-protection obligations. Depending on our role and processing activities, these may include: • records of processing • provider agreements • Data Processing Agreements • security documentation • breach records • DPIAs where required • retention information • international-transfer arrangements • relevant privacy and compliance decisions

35. Accuracy NeverExpiry aims to provide appropriate mechanisms for users to correct account information and relevant document metadata. Where a business customer acts as controller, that customer remains responsible for decisions concerning the accuracy of personal information it controls.

36. Cookies and Similar Technologies Cookies and similar technologies are governed separately through the NeverExpiry Cookie Policy and Cookie Preferences. Those materials explain matters including: • strictly necessary technologies • preferences • analytics • consent • objections • retention • third-party technologies

37. Direct Marketing Where NeverExpiry sends optional direct marketing, applicable privacy and electronic communications requirements will be followed. Users will be provided with appropriate controls to stop optional promotional communications. Essential account, billing, security and requested reminder communications are separate from promotional marketing.

38. Data-Protection Complaints NeverExpiry provides an accessible route for individuals to raise data-protection complaints. Until a dedicated NeverExpiry privacy email address exists, complaints should be submitted using the existing NeverExpiry website contact form or by writing to the registered office. NeverExpiry will: • acknowledge applicable data-protection complaints within the legally required period • investigate complaints without undue delay • keep complainants appropriately informed where required • provide an outcome Individuals may also complain to the Information Commissioner's Office or another competent supervisory authority where applicable.

39. Cooperation with Regulators NeverExpiry will cooperate with competent data-protection authorities where required by applicable law. Information may be supplied in response to lawful regulatory, judicial or other binding legal requests where required.

40. Legal Requests, Fraud, Safeguarding and Public Safety Where lawful, necessary and proportionate, NeverExpiry may preserve, process or disclose relevant information in connection with: • binding legal requirements • fraud • cybersecurity incidents • safeguarding concerns • serious unlawful activity • protection of individuals • serious public-safety risks • establishment, exercise or defence of legal claims Any exceptional disclosure should be limited to information reasonably necessary for the relevant purpose.

41. No Sale of Personal Information NeverExpiry does not sell private customer documents or private vault personal information. Private customer document contents are not supplied to advertising businesses for behavioural advertising.

42. Changes to Our Data-Protection Practices NeverExpiry will continue to develop. Where a new feature materially changes how personal information is processed, NeverExpiry will review relevant matters including: • privacy information • lawful basis • security • retention • service providers • international transfers • DPIA requirements • user controls • processor arrangements

43. Multilingual GDPR / Data Protection Information English is the master GDPR / Data Protection text. The complete page is available in every language currently supported by NeverExpiry. When a user selects another supported language using the existing language selector, the entire GDPR / Data Protection page is shown in that selected language. This includes: • page title • all headings • all paragraphs • all bullet points • controller and processor explanations • rights information • data-processing agreement information • security explanations • AI explanations • complaint information • related GDPR page labels Body text is not left in English when another language is selected, except proper names, company details and recognised legal or technical terminology that should remain unchanged. Arabic uses right-to-left presentation. The selected language remains active when navigating away and returning. Translations preserve the meaning and protections of the English master. Nothing in a translation limits mandatory rights available under applicable law.

44. Contact For GDPR, privacy or data-protection questions, rights requests or complaints, use the existing NeverExpiry website contact form. You may also write to: Auradenta Ltd 71–75 Shelton Street Covent Garden London United Kingdom WC2H 9JQ Do not invent or add a NeverExpiry email address.