Privacy notice
How Karma Labs handles personal data
Last updated: 27 September 2026
Who we are
Karma Labs Limited is a private limited company registered in England and Wales, company number 17483632. Our registered office is 128 City Road, London, EC1V 2NX, United Kingdom. We are the controller of the personal data described in this notice. You can contact us about it at investigator@karmalabs.io, on +44 7879 279076, or by post at our registered office.
This notice applies to all personal data we handle: in our emails and other correspondence, in our work for clients, in our investigations, and on this website.
What we collect and where it comes from
- Correspondence and contact details: names, job titles, organisations, email addresses, telephone numbers and the content of messages we send and receive. We obtain these from you, from your organisation, or from public sources such as your organisation's website and professional directories.
- Client information: details of our clients, their representatives and staff, and the information they provide to us for a matter, including payment and invoicing details.
- Investigation information: information about individuals connected with a matter we are instructed on, such as counterparties, company officers, witnesses and the holders of accounts or digital-asset wallets. We obtain this from our clients, public registers, court records, published sources, public blockchain records and other lawful sources.
- Website data: this website sets no cookies and runs no analytics or tracking scripts. Our hosting provider (Cloudflare) processes technical data such as IP addresses to deliver and secure the site, and the site loads fonts from Google Fonts, which receives your IP address when the page loads.
Why we use it and our lawful bases
- To correspond with you, to respond to enquiries and to tell professional contacts about our services: our legitimate interests in running and developing our business (UK GDPR Article 6(1)(f)).
- To take on and carry out work for clients, manage the relationship and invoice: performance of a contract (Article 6(1)(b)) and our legitimate interests.
- To carry out investigations for clients: our and our clients' legitimate interests in establishing, exercising or defending legal rights and in preventing and detecting fraud (Article 6(1)(f)). Where information about criminal allegations or offences is involved, we process it only where the Data Protection Act 2018 permits, including for legal claims.
- To keep records and meet our obligations under the law, including sanctions law: legal obligation (Article 6(1)(c)).
Who we share it with
We share personal data only where needed for our work or where the law requires it: with our clients and their lawyers, law-enforcement authorities, regulators, courts, banks, exchanges and custodians, and with service providers who support our work, such as translators and our email, hosting and IT providers. We do not sell personal data.
Transfers outside the United Kingdom
Our work is international, so personal data may be transferred outside the United Kingdom. We make such transfers only in accordance with Chapter V of the UK GDPR, for example to countries covered by UK adequacy regulations, under appropriate safeguards such as the UK International Data Transfer Agreement, or where a transfer is necessary for legal claims.
How long we keep it
We keep personal data only as long as we need it. Client and matter records are kept for six years after the end of the engagement, or longer where a legal claim or legal obligation requires it. Correspondence that does not lead to an engagement is kept for no longer than 24 months after our last contact. If you ask us not to contact you again, we keep a short record of that request so that we can respect it.
Your rights
Subject to the conditions and exemptions in the law, you have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict its use, and to data portability. To exercise any of these rights, write to investigator@karmalabs.io.
Your right to object. You may object at any time to our using your personal data on the basis of our legitimate interests, and in particular to our contacting you about our services. To stop further emails about our services, reply "no thanks" to any email from us, or write to investigator@karmalabs.io.
We do not always tell the people our investigations concern that we hold information about them, where the law allows us not to, for example where telling them would be likely to prejudice the prevention or detection of crime or legal proceedings (Schedule 2 to the Data Protection Act 2018).
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would welcome the chance to deal with your concern first.
Changes to this notice
We will update this notice when our practices change and show the date of the latest version at the top.