Contents

1 About this Notice

2 Who We are and how to contact Us

3 Who and what this Notice covers

4 Personal information We collect

5 Where the information comes from

6 Why We use information and Our lawful bases

7 Mobile traffic location and communications data

8 Cookies analytics and marketing

9 Who We share information with

10 International transfers

11 How long We keep information

12 Security and personal data breaches

13 Your data protection rights

14 Making a rights request

15 Automated checks and fraud prevention

16 Children and other authorised users

17 Data protection complaints and the ICO

18 Changes to this Notice

Legal framework: This Notice reflects the UK GDPR, Data Protection Act 2018, Data (Use and Access) Act 2025 and Privacy and Electronic Communications Regulations 2003 (PECR), as amended. More specific PECR rules apply to public electronic communications services, traffic data, location data, direct marketing and storage or access technologies such as cookies.

1. About this Notice

Briant Broadband Ltd trading as Briant Mobile (Briant Mobile, We, Us or Our) is committed to using personal information lawfully, fairly and transparently. This Notice is intended to give privacy information to individuals, not to create additional contractual rights or reduce rights under data-protection or communications law.

This Notice should be read with the Briant Mobile Terms and Conditions, Contract Summary, Fair Use Policy, Cookie Policy and any short-form privacy information shown when We collect information for a particular feature. If a short notice conflicts with this Notice for that collection, the more specific notice applies.

You do not accept this Notice merely by visiting Our website. Where We need consent, We ask for a specific, informed opt-in and you may withdraw it at any time. Withdrawal does not affect processing already carried out lawfully.

2. Who We are and how to contact Us

Briant Broadband Ltd (company number 12804566), trading as Briant Mobile, is normally the controller of personal information described in this Notice. This means We decide why and how that information is used.

DATA2GO Limited operates the white-label mobile platform used to provide the Service and processes End Customer Personal Data through that platform on Our documented instructions. Under Our partner agreement, DATA2GO Limited may act as an independent controller for network and billing data that it needs for its own regulatory and operational purposes.

Our privacy contact details are:

Email: info@briantbroadband.com

Telephone: 01903 221999

Post: 2A Caravelle House, 17–19 Goring Road, Worthing, West Sussex, BN12 4AP

An underlying mobile network, payment provider, identity-verification provider or other partner may be an independent controller for information it uses for its own legal, security or service purposes. Where that applies, its own privacy notice also governs its use. We will identify relevant independent controllers where the law requires this.

3. Who and what this Notice covers

This Notice covers personal information about:

people who enquire about or order a Briant Mobile SIM or eSIM service;
customers, account holders and people authorised to manage an account;
users of a Briant Mobile SIM, eSIM, mobile number, account, website or support channel;
people who contact Us, participate in research or receive marketing; and
individuals whose information is supplied to Us for switching, billing, fraud prevention, complaints, accessibility, emergency or legal purposes.

The customer must make authorised users aware of this Notice. Certain rights and PECR rules apply to the actual user of a mobile service, not only the person who pays the bill.

4. Personal information We collect

We collect only information that is reasonably necessary for the purposes described below. The information used in a particular case depends on the product, channel, device and features you use.

Category	Examples
Identity and eligibility	Name, title, date of birth or confirmation you are 18 or over, customer and order identifiers, and proportionate identity, address, fraud or eligibility evidence. This may include an identity-document reference or copy where genuinely required.
Contact and account	Billing, delivery and service address; email; telephone number; preferred contact method; login and authentication information; account permissions and security questions.
Mobile service and identifiers	Assigned or ported mobile number; SIM/eSIM identifiers and status; activation data; IMSI/ICCID and similar network identifiers; device type, operating system, IMEI or other device identifier; IP address; network and roaming identifiers; tariff, allowances and service settings.
Traffic, usage and location	Dates, times, duration, routing, destination or service type for calls, texts and data sessions; volumes used; cell, network or approximate location information; roaming usage; and records needed for transmission, billing, enquiries, security and fraud prevention. Section 7 explains the special PECR rules.
Billing and transactions	Charges, invoices, payment status, Direct Debit details, payment tokens or limited payment-card details, refunds, arrears, debt-recovery records and information about financial transactions. Payment providers normally process full card details directly.
Support and communications	Orders, emails, SMS, webchat, letters, support tickets, complaint records, survey responses, notes of calls and telephone call recordings. We provide an appropriate notice at or before recording.
Technical, website and security	IP address, browser and device information, cookies and similar technologies, website activity, login events, diagnostic logs, coverage or fault information, fraud indicators and security alerts.
Preferences and marketing	Marketing choices, consent records, channel preferences, suppression records, interests inferred from permitted interactions, campaign engagement and competition entries.
Accessibility and sensitive information	Information you choose to provide about disability, health, accessibility, vulnerability or personal circumstances so We can offer appropriate support. Fraud or misuse investigations may also involve information about suspected offences.

We do not routinely inspect the content of calls or messages. The underlying network technically processes communications to transmit them. We or a partner may access limited content only where you provide it to support Us, where necessary to protect the service or users, or where access is permitted or required by law.

5. Where the information comes from

We obtain information:

directly from you, an account holder or an authorised representative;
automatically from your SIM, eSIM, device, use of the Network, website, cookies or support systems;
from Our underlying mobile, wholesale, roaming, switching and number-porting partners;
from payment, identity-verification, fraud-prevention and debt-recovery providers where used and permitted;
from a previous or new communications provider during a regulated switch or number transfer;
from public registers, sanctions lists and publicly available sources where proportionate; and
from Ofcom, the ICO, emergency services, courts, law-enforcement agencies and other authorities where lawful.

If you provide information about another person, you must have authority to do so and should give them this Notice. We may still provide privacy information to them directly where required.

6. Why We use information and Our lawful bases

We use personal information only for specified purposes and under an appropriate lawful basis. More than one basis may apply. PECR can impose additional requirements even where a UK GDPR basis exists.

Activity	Purpose	Information	Lawful basis
Order and account setup	Verify details; assess availability or eligibility; accept and administer an order; create and secure an account; activate a SIM/eSIM; allocate or port a number.	Identity, contact, account, service, verification and payment data.	Steps before and performance of a contract; legal obligation; legitimate interests in preventing fraud and confirming eligibility.
Provide the mobile service	Transmit calls, texts and data; authenticate users and devices; manage allowances, roaming, number switching, coverage, capacity, quality, faults and support.	Mobile identifiers, traffic, usage, location, device, account and support data.	Contract; legitimate interests in operating and improving a secure service; legal obligation; applicable PECR permissions.
Billing and payment	Calculate charges; issue bills; take payment; apply spend controls; process refunds; resolve disputes; recover valid debts; keep accounting and tax records.	Identity, contact, transaction, payment, traffic and usage data.	Contract; legal obligation; legitimate interests in accurate billing and debt recovery.
Security, fraud and acceptable use	Authenticate access; detect or prevent fraud, SIM swapping, artificial traffic, cyber incidents, spam, theft and misuse; investigate and enforce terms.	Account, device, network, traffic, usage, location, verification and security data.	Legitimate interests in protecting Our services and customers; legal obligation; establishment or defence of legal claims.
Customer care and complaints	Answer enquiries; provide technical help; make accessibility adjustments; investigate complaints; evidence decisions; handle rights requests and data-protection complaints.	Identity, contact, account, support, complaint, usage and, where provided, sensitive information.	Contract; legal obligation; legitimate interests in service quality; explicit consent or another DPA 2018 condition for special-category information where required.
Law, regulation and emergencies	Meet telecoms, consumer, tax, accounting, data-protection and lawful disclosure duties; cooperate with regulators; support 999/112, emergency alerts and lawful investigations.	Any information reasonably necessary for the request or duty.	Legal obligation; vital interests; substantial public interest or legal claims where applicable.
Service improvement and analytics	Measure performance; diagnose faults; forecast demand; improve plans, processes, security and customer experience; create aggregated or de-identified statistics.	Technical, service, support, usage and website data, minimised where possible.	Legitimate interests; consent where PECR or data-protection law requires it.
Marketing and preferences	Send permitted offers; manage consent and opt-outs; measure campaigns; avoid sending unwanted messages.	Contact, marketing, preference and permitted interaction data.	Consent or legitimate interests, subject to PECR. Traffic or location data for marketing is used only with valid consent.
Business administration	Audit, insurance, governance, corporate transactions, supplier management, professional advice and establishing, exercising or defending legal claims.	Relevant identity, account, transaction, support and legal records.	Legal obligation; legitimate interests in managing the business and legal risk; legal claims.

Where We rely on legitimate interests, We assess the purpose, necessity and impact on individuals and use safeguards. You may ask for more information about that assessment. Where We rely on consent, you can withdraw it as explained in sections 7 and 8.

7. Mobile traffic, location and communications data

PECR contains specific rules for providers of public electronic communications services. Traffic data includes information processed for conveying a communication or billing for it. Network location data may indicate where a phone or other terminal was connected.

We use traffic data only as permitted, including where necessary to:

transmit communications and operate the Network;
manage traffic, calculate bills and resolve billing or customer enquiries;
prevent or detect fraud, misuse and security incidents;
meet a lawful regulatory, dispute-resolution, emergency or disclosure requirement; or
market electronic communications services or provide a value-added service, but only where PECR requires and We have valid, specific consent.

We process network location data beyond what is traffic data only where it is anonymous, where the actual user has given valid consent for a specific value-added service, or where an exemption applies, such as 999/112 calls or authorised emergency alerts. Before a consent-based feature starts, We will explain the location data, purpose, retention and any third-party recipient. Consent can be withdrawn free of charge.

Mobile numbers and calling-line identification may be shown to recipients to enable calls and messages. Available number-withholding and anonymous-call controls depend on the Device and Network. Itemised billing is handled in accordance with PECR, including applicable privacy options.

8. Cookies, analytics and marketing

Our website and online account may use cookies and similar storage or access technologies. Strictly necessary technologies support security, authentication, orders, preferences and core functionality. Optional analytics, advertising or personalisation technologies are used only where consent is required and obtained. Our Cookie Policy and consent tool give current details, purposes, providers and durations.

You can change optional cookie choices through the consent tool. Browser controls may also block or delete cookies, but blocking necessary technologies can prevent parts of the website or account from working.

We may send service messages needed to administer your account or contract even if you opt out of marketing. Marketing by email, SMS, telephone or other electronic channel is sent only where permitted by UK GDPR and PECR, using consent or a lawful existing-customer route where available.

You can opt out at any time by using an unsubscribe link, replying with the stated opt-out keyword, changing available account preferences, or contacting Us. We keep a minimal suppression record so We can respect the opt-out. We do not sell personal information or share it with another organisation for its own marketing without a valid lawful basis and any consent required.

9. Who We share information with

Where necessary and proportionate, We share information with:

Recipient category	Why information may be shared
DATA2GO Limited and mobile connectivity partners	White-label platform operation, account management, billing support, SIM and eSIM provisioning, and underlying mobile network, wholesale, roaming, interconnect, number-allocation, switching, porting and technical-support services.
Payments and finance	Banks, Direct Debit and payment processors, billing providers, identity-verification, fraud-prevention and debt-recovery services where actually used.
Technology and operations	Hosting, cloud, CRM, customer-support, email, SMS, analytics, security, delivery, fulfilment and professional-service providers acting under appropriate terms.
Authorities and emergency services	Ofcom, the ICO, emergency services, courts, law enforcement, tax authorities and other bodies where disclosure is required or permitted by law.
Professional advisers and transactions	Auditors, insurers, lawyers, accountants, investors, buyers, sellers or restructuring partners, subject to confidentiality and lawful due diligence.
At your direction	A new or previous provider, authorised representative, account user or other recipient where you ask Us to disclose information and We can verify the authority.

Service providers acting as processors may use information only on Our documented instructions, subject to confidentiality, security and data-protection terms. Independent controllers decide their own purposes and must provide their own privacy information. We require each disclosure to be supported by a lawful basis and minimise the information shared.

10. International transfers

Some suppliers or roaming partners may process information outside the United Kingdom. The country involved can depend on the service, supplier and where you roam. A transfer outside the UK does not remove Our responsibility to apply the UK transfer rules where they apply.

We use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU standard contractual clauses, binding corporate rules or a permitted exception. Where appropriate, We carry out a transfer risk assessment and use supplementary contractual, organisational or technical safeguards.

You may contact Us for more information about the relevant safeguard and, where available, a copy. Commercially sensitive or third-party information may be redacted. Ordinary roaming necessarily involves processing by networks in the country you visit.

11. How long We keep information

We keep information only for as long as needed for the purpose collected, including service delivery, billing, security, complaints, legal claims and mandatory records. We then delete it, anonymise it or securely isolate it where deletion is not immediately possible. The normal schedule is:

Information	Normal retention approach
Enquiries and declined or abandoned orders	Normally 2 years after the last meaningful contact, unless a shorter period is appropriate or a dispute, fraud concern or legal duty requires longer.
Account, contract, identity and core service records	For the customer relationship and normally 6 years after it ends, reflecting limitation, accounting and regulatory needs. Identity-document copies are removed sooner when no longer necessary.
Bills, payments, transactions and tax records	Normally 6 years after the relevant financial year or transaction, or longer where law, audit, debt recovery or a live dispute requires it.
Traffic, itemised usage and network-location records	Only for the period needed for transmission, billing, enquiries, fraud prevention and permitted legal purposes; normally no more than 12 months for routine billing records unless a dispute, legal hold or binding requirement applies.
Support, complaints and call recordings	Support and complaint records normally 6 years after closure. Any call recording is kept for a shorter documented period unless needed for a complaint, training investigation, fraud matter or legal claim.
Security, access and fraud records	According to risk and necessity, normally between 12 months and 6 years; confirmed fraud, legal claims or regulatory matters may be retained longer.
Marketing and preferences	Until you opt out or We stop the relevant activity. A minimal suppression record may be retained as long as needed to prevent further unwanted marketing.
Cookies and online identifiers	For the period stated in the current Cookie Policy or consent tool; session technologies expire when the session ends unless stated otherwise.
Accessibility or vulnerability information	Reviewed regularly and kept only while needed to provide support or meet a legal duty, then deleted or minimised unless a complaint or legal claim requires retention.

A legal hold, court order, regulatory investigation, unresolved complaint or technical backup cycle may extend a period. We review retained information and do not use it for unrelated purposes merely because it remains in a backup.

12. Security and personal data breaches

We use proportionate technical and organisational measures designed to protect confidentiality, integrity and availability. These include access controls, authentication, encryption where appropriate, secure configuration, monitoring, backups, supplier due diligence, staff confidentiality and incident-response procedures.

No system is completely secure. Keep account credentials, SIMs, eSIM activation details, PINs and devices safe, use strong authentication and tell Us promptly about a lost device, suspected SIM swap, account takeover or unauthorised use.

If a personal data breach affects a public electronic communications service, We maintain the required breach record, notify the ICO within the applicable PECR timeframe and notify affected subscribers or users without unnecessary delay where the legal threshold is met. Other breaches are handled under the applicable UK GDPR and Data Protection Act requirements.

13. Your data-protection rights

Depending on the circumstances and applicable exemptions, you may have the right to:

Be informed: receive clear information about collection and use.
Access: obtain confirmation and a copy of your personal information.
Rectification: correct inaccurate information and complete incomplete information.
Erasure: ask for deletion where there is no continuing lawful reason to keep the information.
Restriction: ask Us to limit use while an issue is considered.
Object: object to processing based on legitimate interests and object at any time to direct marketing.
Data portability: receive certain information you provided in a structured, commonly used, machine-readable format and ask for transfer where technically feasible.
Withdraw consent: withdraw consent at any time where consent is the basis, without affecting earlier lawful processing.
Complain: raise a data-protection complaint with Us and complain to the ICO.

These rights are not absolute. For example, We may keep information needed to provide a requested service, comply with law, protect another person's rights or establish, exercise or defend legal claims. We will explain any refusal or limitation.

14. Making a rights request

Send a request to info@briantbroadband.com, telephone 01903 221999 or write to the address in section 2. Describe the right you want to exercise and the information or account concerned. You may use an authorised representative, but We may ask for evidence of authority.

We may request proportionate information to confirm identity and protect account security. We will not ask for more evidence than reasonably necessary. The normal response period is one month after We receive the request and any information reasonably needed to verify identity. Where the law allows an extension for a complex request or multiple requests, We will explain this within the initial period.

There is normally no charge. A reasonable fee may apply, or We may refuse to act, where a request is manifestly unfounded or excessive, particularly if repetitive, as permitted by law. We carry out searches that are reasonable and proportionate.

15. Automated decisions, credit and fraud checks

We may use automated tools, rules and risk indicators to support identity verification, fraud prevention, account security and service eligibility checks. These tools assist Our team, but We do not make decisions based solely on automated processing that produce legal or similarly significant effects for customers.

Fraud-prevention or identity-verification providers may keep their own records and act as independent controllers. Where such a provider is used, We will provide or signpost the relevant privacy information.

16. Children and other authorised users

The Briant Mobile customer must be at least 18. A customer may allow another person, including a family member, to use a SIM or device. The customer remains responsible for account administration, but privacy rights may belong to the actual user where information relates to that user.

We do not knowingly market Briant Mobile directly to children or ask a child to enter the contract. If an online service is likely to be accessed by children, We will take their needs into account and apply age-appropriate, privacy-protective design. A parent or guardian may contact Us with a concern, but We will consider the child's rights, age and capacity before disclosing information.

17. Data-protection complaints and the ICO

Please contact Us first if you believe We have used personal information unfairly, made an error, failed to respect a right or not explained Our use clearly. You can complain by email, telephone or post using the details in section 2. Please describe what happened, the outcome you want and any relevant account or correspondence reference.

We will provide a clear route for data-protection complaints, acknowledge receipt within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay. We may ask for proportionate identity or authority evidence before disclosing account information.

You may complain to the Information Commissioner's Office at any time: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; website https://ico.org.uk. Complaining to the ICO does not affect other legal rights or remedies.

18. Changes to this Notice

We review this Notice when Our services, suppliers or legal duties change. The current version and effective date will be published on Our website. We will give a more prominent or direct notice before a material change where required, particularly if it would materially affect how We use existing information.

Earlier versions may be requested using the contact details in section 2. A website update does not create consent for a new use that legally requires consent.

Privacy Notice

Privacy Notice