This site uses cookies for analytics and to improve your experience. By clicking Accept, you consent to our use of cookies. Learn more in our privacy policy.

Privacy Policy – Sibylline

Privacy Policy

Last updated: August 2026

Sibylline Ltd (“Sibylline”, “we”, “us” or “our”) understands that privacy matters to the people we work with. This Privacy Policy (“Policy”) explains how we collect, use, share and protect personal data when you use our website (sibylline.com), our products and services (our “Services”), or otherwise interact with us.

In this Policy, “Sibylline” refers to Sibylline Ltd and, where relevant, its group companies, each of which is a separate legal entity.

This Policy applies to users of our Services worldwide. If you are located in the United Kingdom or European Economic Area (EEA), you have specific rights under UK and EU data protection law, set out in “Your Rights” below.

If you have any questions about this Policy or how we handle personal data, please contact us at gdpr@sibylline.com.

1. Who We Are

Sibylline Ltd (company number 07302591), registered office at China Works, Unit 329, 100 Black Prince Road, London, SE1 7SJ, United Kingdom, is the data controller for personal data collected through our website and Services.

Sibylline has appointed a Data Protection Officer, responsible for oversight of our data protection compliance. You can contact our Data Protection Officer at gdpr@sibylline.com, marked for the attention of the Data Protection Officer.

2. Information We Collect

2.1 Information You Provide to Us

You are not required to provide us with any personal data to browse our website. Where you choose to provide personal data, for example when:

  • applying for a role with Sibylline;
  • subscribing to our mailing list or newsletter;
  • contacting us with an enquiry; or
  • engaging us for our Services,

we collect what you provide, which may include your name, email address, postal address, telephone number, employer and job title, and any other information you choose to share with us.

2.2 Information We Collect from Social Media and Other Open Source Material

Provision of intelligence and risk advisory services is central to what Sibylline does. To deliver these Services, we collect and process publicly available information from social media platforms and other open source material. This may include:

  • profile information such as username, follower/following counts, profile URL, stated location, language and profile image;
  • publicly posted content, including posts, status updates, comments, hashtags, and the approximate time and location associated with that content.

We collect this information because it is necessary for our legitimate interests, and those of our customers, in providing intelligence, risk and security services (see “Our Legal Basis for Processing” below). We do not seek out special category data (such as data revealing political opinions, religious beliefs, or health data) about individuals. Such information may occasionally be incidentally present within publicly available material we process; where this occurs, we apply additional safeguards and only retain and use it where necessary and proportionate for the specific purpose for which it was collected.

2.3 Information from Other Sources

We may also obtain information about you from third parties, such as mailing list providers, publicly available databases and business contact sources, and combine this with information we already hold.

3. How We Use Your Information

We use personal data to:

  • provide, maintain, and improve our Services;
  • create and manage customer accounts;
  • communicate with customers and respond to enquiries;
  • diagnose and resolve issues with our Services;
  • personalise our Services;
  • produce intelligence reporting, alerts and aggregated analysis for our customers, using publicly available social media and open source information;
  • enforce our policies and protect our rights, property, and the rights of others; and
  • comply with our legal obligations.

3.1 Automated Processing and AI Features

Some of our Services use AI-assisted features to help process and analyse content, as described in the applicable Order Form and Subscription Agreement. Where AI features are used, outputs are intended to support, and not replace, human judgement. We do not use AI to make decisions that produce legal or similarly significant effects about individuals without human involvement.

4. Our Legal Basis for Processing

Where UK GDPR or EU GDPR applies, we rely on the following legal bases:

  • Contract: to perform a contract with you, or to take steps at your request before entering into one (for example, providing Services you have subscribed to).
  • Legitimate interests: for example, to provide intelligence and risk advisory Services using publicly available information, to keep our Services secure, and to communicate with business contacts. Where we rely on legitimate interests, we consider and balance any potential impact on individuals’ privacy rights.
  • Consent: where you have given consent, for example to receive marketing communications, which you may withdraw at any time.
  • Legal obligation: where we must process data to comply with the law, including responding to lawful requests from public authorities.

5. Sharing of Data

We do not sell personal data. We may share personal data in the following circumstances:

  • with service providers who support our operations (such as cloud hosting, email, customer support and invoicing providers), acting on our instructions;
  • with government or public authorities, where required by law or to meet national security or law enforcement obligations;
  • where necessary to prevent fraud, or to protect the rights, property or safety of Sibylline, our customers, or others;
  • in connection with a merger, acquisition, financing, or sale of business assets;
  • with your consent.

Where we share publicly available social media and open source information as part of our intelligence Services, this is disclosed to our customers as part of the Services they have subscribed to.

6. Third-Party Services and Links

Our website and Services may link to third-party websites, apps and tools that we do not control (for example, LinkedIn, YouTube and Instagram). Those third parties’ own privacy policies apply to your use of their services, and we are not responsible for their practices.

7. International Data Transfers

Sibylline is headquartered in the United Kingdom. Our servers and hosting infrastructure are located in the United Kingdom and the European Union, and personal data is stored there.

Sibylline has employees based around the world, and personal data may therefore be accessed by our staff from outside the UK and EEA in the course of their work. Where this occurs, we put in place appropriate safeguards, such as the UK’s International Data Transfer Agreement or Addendum, the European Commission’s Standard Contractual Clauses, or reliance on adequacy decisions, to ensure your personal data continues to receive an appropriate level of protection.

8. Data Retention

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to provide our Services, meet legal, accounting or reporting obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of data and the purpose for which it is used.

9. Cookies

Our website uses cookies, including Google Analytics cookies, to understand in aggregate how visitors use our website. We do not use this information to identify individual visitors. Further detail on the cookies we use and how to manage your preferences is set out in our Cookie Policy.

You can block or delete cookies at any time through your browser settings, see aboutcookies.org for guidance on how to do this for your particular browser. Please note that disabling cookies may affect the functionality of our website.

10. Your Rights

Subject to applicable law, you may have the right to:

  • access personal data we hold about you;
  • correct inaccurate or incomplete personal data;
  • request erasure of your personal data;
  • restrict or object to our processing of your personal data;
  • request portability of personal data you have provided to us; and
  • withdraw consent, where processing is based on consent.

To exercise any of these rights, contact us at gdpr@sibylline.com. We will respond within one month, as required by law, save in exceptional circumstances.

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ico.org.uk). If you are in the EEA, you may complain to your local data protection authority.

11. Children’s Privacy

Our Services are intended for business use and are not directed at children. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

12. Data Security

We maintain administrative, technical and physical safeguards designed to protect personal data against accidental, unlawful or unauthorised destruction, loss, alteration, access, disclosure or use.

13. Changes to This Policy

We may update this Policy from time to time. Where changes are significant, we will provide notice through our website or by other appropriate means. The “last updated” date above shows when this Policy was last revised.

14. Contact Us

If you have questions about this Policy or how we handle personal data, please contact:

Sibylline Ltd
China Works, Unit 329, 100 Black Prince Road
London, SE1 7SJ
United Kingdom

Email: gdpr@sibylline.com