Privacy Policy

1. Who We Are

Nicomachea Limited is a business intelligence platform and methodology developer, based in Middlesbrough. Our flagship product, NIBEX (the Nicomachea Business Index), is a structured business health assessment delivered to client businesses, either directly or via a licensed partner. This policy covers personal data we collect through our website, through direct client engagements, and through the NIBEX platform itself.

This policy applies to visitors to nicomachea.co.uk, prospective and current clients, and individuals whose data is processed through the NIBEX platform in connection with a client engagement.

2. Information We Collect

We do not collect any special categories of personal data (such as health data, biometric data, racial or ethnic origin, religious beliefs, or political opinions) in the ordinary course of our business. If we ever need to handle such data in connection with a specific engagement, we will notify you separately and obtain your explicit consent.

We do not knowingly collect data relating to children.

Contact form. When you use the contact form on our website, we collect your name, business name, email address, the nature of your enquiry (selected from a list — for example, NIBEX assessment interest, MVP participant interest, licensing enquiry, pre-acquisition due diligence, implementation or managed services, partnership or institutional enquiry, or other), and your message. This is submitted via a secure backend process and is not used for marketing without your separate consent.

Cookies and analytics. Our website does not use analytics or tracking cookies. This has been independently verified.

3. Information Collected Through the NIBEX Platform

Where you or your organisation engage Nicomachea for a NIBEX business assessment, we collect and process the following in connection with that engagement:

• The name of the client business
• Names of individuals within the client business who are included as part of the assessment (for example, in a staff registry used to structure the assessment)
• Assessment content, notes, and responses gathered as part of the NIBEX assessment process

This data is provided to us by our direct client (the business engaging Nicomachea). Our agreement with each client requires that business to ensure it has its own lawful basis for sharing information about its staff with us, and that it has informed its own staff accordingly. If you are a staff member of a Nicomachea client and have questions about how your data came to be included, please contact the business that engaged Nicomachea in the first instance, or contact us directly and we will assist.

Assessment data is used solely to prepare the business assessment and associated report(s) for the client that commissioned the work. It is not used for any other purpose, and is not shared with any other client or third party outside the processing described in Section 4 below.

4. Use of AI-Assisted Processing

As part of preparing NIBEX assessments, elements of assessment content may be sent to a third-party artificial intelligence processor, Anthropic, to assist with generating scoring suggestions as part of our assessment methodology. This is an automated processing step that supports, but does not replace, human review — all scoring and final assessment content is reviewed and finalised by Nicomachea.

We have a data processing agreement in place with our AI processor, which includes contractual safeguards for international data transfers (including UK-specific transfer safeguards, since this processor is based in the United States). Our processor is contractually restricted from using submitted data to train its underlying models and operates under defined data retention and deletion terms.

5. How and Why We Use Your Personal Data

We will only use your personal data where we have a lawful basis for doing so.

Where we rely on legitimate interests as our lawful basis, we have considered whether our interests are overridden by your rights and concluded that they are not. You have the right to object to processing based on legitimate interests — see Section 8 below.

6. Who We Share Your Data With

We do not sell, rent or trade your personal data to any third party.

We may share your personal data with the following categories of recipients where necessary:

• Our AI processor (Anthropic) — assessment content, pseudonymised as described in Section 4, to assist with generating scoring suggestions.
• Professional advisers — accountants, solicitors or insurers who require access to fulfil their services to us, subject to appropriate confidentiality obligations.
• Technology providers — such as our email and database providers, where those tools process data on our behalf under appropriate contractual terms.
• HMRC and other regulatory bodies — where we are required to disclose information by law.

Where personal data is transferred outside the United Kingdom (for example, to our AI processor in the United States), this is done only where appropriate safeguards are in place in accordance with the UK GDPR, as described in Section 4.

7. How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purposes for which it was collected, or as required by law.

When data is no longer required, we will delete or anonymise it securely. Where a client business exercises its right of erasure over its staff registry entries, Nicomachea will delete the identifying record; the linked assessment data is thereby rendered anonymous rather than deleted outright, and may be retained on that basis.

8. Your Rights

Under UK data protection law, you have the following rights in relation to your personal data:

To exercise any of your rights, please contact us at david@nicomachea.co.uk. We will respond within one calendar month of receiving your request. We will not charge a fee for handling your request unless the request is manifestly unfounded or excessive.

We may need to verify your identity before processing your request.

9. How We Protect Your Data

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These measures include:

• Password protection and multi-factor authentication on systems used to process personal data
• Pseudonymisation of identifying information before any AI-assisted processing, as described in Section 4
• Access controls ensuring only authorised individuals can access personal data
• Regular software updates and security patching
• Secure deletion of data when no longer required

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you without undue delay.

10. How to Make a Complaint

If you have a concern about how we have handled your personal data, please contact us in the first instance at david@nicomachea.co.uk and we will do our best to resolve the matter.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), which is the supervisory authority for data protection in the United Kingdom:

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or legal requirements. We will notify you of any material changes where we have your contact details and are able to do so. The current version of this policy is always available on request.

This policy was last updated in July 2026.