Privacy Policy

1. Introduction

Sulu is an independent advisory and research service that helps clients find and evaluate options for personal and lifestyle requests. We are committed to protecting your privacy and handling your personal data responsibly.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our services or interact with our website. It applies to all information we collect through our website, messaging channels (WhatsApp, Telegram), email, and any other communication with us.

2. Information We Collect

We may collect the following types of information:

• - Contact information: Your name, email address, phone number, and messaging platform usernames (WhatsApp, Telegram)
• - Request details: Information you provide about your requests, preferences, travel plans, and requirements
• - Communications: Messages exchanged with us via WhatsApp, Telegram, email, or other channels
• - Payment information: Payment details processed securely through Stripe. We do not store your full payment card details on our systems
• - Technical data: Basic information about how you interact with our website, such as your IP address and browser type

3. How We Use Your Information

We use your personal information for the following purposes:

• - To fulfil your requests and provide our advisory and research services
• - To communicate with you about your requests, provide updates, and deliver options
• - To process payments for our services
• - To improve our services and develop new features
• - To comply with legal obligations

4. AI Processing

We may use AI tools (including large language models) to assist with researching options, comparing providers, and preparing recommendations for your requests. Your request details may be processed by these AI systems.

We do not share your personal identity with AI providers — only the details necessary to research your request. We take care to minimise the personal data included in any AI processing and use these tools solely to improve the quality and speed of our research on your behalf.

5. Legal Basis for Processing

We process your personal data on the following legal bases:

• - Contract performance: Processing necessary to fulfil our services to you
• - Legitimate interests: Processing necessary for our legitimate business interests, such as improving our services and communicating with you, where these interests are not overridden by your rights
• - Consent: Where you have given us specific consent for a particular purpose
• - Legal obligation: Where processing is necessary to comply with applicable law

6. Third Parties

We may share your information with the following categories of third parties:

• - Service providers we connect you with: When fulfilling your request, we may share relevant details with yacht operators, aviation providers, visa services, or other providers — only with your knowledge and as necessary to deliver the service
• - Payment processors: Stripe processes payments on our behalf. Their use of your data is governed by their own privacy policy
• - AI tool providers: As described in Section 4, request details (not personal identity) may be processed by AI tools to assist with research

We never sell your personal data to third parties.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Request data and associated communications are typically retained for up to 2 years after the completion of a request, unless a longer retention period is required by law. You may request earlier deletion at any time (see Section 8).

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• - Right of access: Request a copy of the personal data we hold about you
• - Right to rectification: Request correction of inaccurate or incomplete data
• - Right to erasure: Request deletion of your personal data, subject to legal obligations
• - Right to data portability: Request your data in a structured, machine-readable format
• - Right to object: Object to processing based on legitimate interests
• - Right to restrict processing: Request limitation of processing in certain circumstances

To exercise any of these rights, please contact us at concierge@sulu.agency. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. International Transfers

Sulu operates as a US-registered entity. Your data may be processed outside the United Kingdom, including in the United States, by us and by our AI tool providers. Where personal data is transferred outside the UK, we take reasonable steps to ensure it is protected in accordance with applicable data protection law, including the use of appropriate safeguards.

10. Security

We implement reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

12. Contact

For any questions about this Privacy Policy or how we handle your personal data, please contact us at concierge@sulu.agency.