Privacy and Cookie Policy

YOUFIBRE PRIVACY POLICY

This privacy policy (“Privacy Policy”) is made by Substantial Group Limited for itself and on behalf of its subsidiaries namely:

Netomnia Limited

YouFibre Limited

Brsk Limited, and

Brsk ISP Limited.

The relevant company described above which provides services to you will act as the controller of your personal data. References to "Company", "we", "our" or "us" mean the relevant group company providing services to you.

1 About Us

We provide electronic communications services in the UK and are regulated by the Office of Communications (Ofcom).

We respect your privacy and we are committed to protecting your personal data by ensuring that our legal obligations are met. This Privacy Policy outlines our policies and procedures for the collection, use, and protection of your personal data, whether you are a customer, website visitor, or employee handling personal data. It also informs our staff of their obligations in processing your data.

When we refer to “personal data” in this Privacy Policy, we mean information which can identify you as an individual. It is important that you read this Privacy Policy so that you are fully aware of how and why we are using your personal data.

2 Information we collect about you

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, last name, username, account number or similar identifier, title, date of birth and gender.
• Contact Data includes billing address, delivery address, email address, social media username (if given) and telephone numbers.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details of payments made by you, any equipment we have supplied, and services you have subscribed to.
• Usage Data includes information about how you use our services, our network and our Website.
• Technical Data includes certain traffic and communications data, your internet protocol (IP) address, your login data, browser type and version, time zone setting, location data, weblogs, details of the websites and other products and services you access through it, browser plug-in types and versions, and the operating system and platform and other technology on the devices you use to access this website and our network.
• Profile Data includes your username and password (if made available to us), orders made by you, your interests, preferences, feedback and survey responses.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

In addition to the personal data categories listed, we may also collect:

• Device Data: Including IP addresses, device manufacturer details, browser information, and other information required from your devices for communication with our network.
• Authentication Data: Where you choose to enable biometric login (for example, Face ID or fingerprint) or are asked to re-verify your identity during an in-app chat session, a cryptographic public key will be generated on your device and held against your account, together with any one-time passcodes we send to your mobile number or email address for re-verification.
• Household Data: Information related to members of your household in connection with the use of our services.
• Referral Data: Information received from third parties who have referred you for the use of our services.
• Data from Reporting Agencies: This includes data from credit agencies for assessing creditworthiness.

We also collect, use, and share “Aggregated Data” (this means statistical or demographic data derived from your personal data). Aggregated Data is not considered personal data in law as this data does not directly or indirectly reveal your identity and cannot be reconstructed to do so.

3 How is your personal data collected?

We use different methods to collect data from and about you, including through:

• Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
  • register your interest in becoming our customer in the future
  • post any material on our website
  • place an order(s) via our website, customer service agents (“Customer Support”) or any other means available
  • give us your details and consent for us to contact you in relation to our services and publications
  • request for marketing materials to be sent to you
  • enter a competition of promotion or survey
  • have been requested to and have been given authority to manage a customer’s account (including billing arrangements) on their behalf
  • give us feedback or contact us.

We will also collect personal data when you partially complete online forms or only get part way through placing an order and exit before completing it.

• Technical Data. We automatically collect Technical Data about your visits to our Website. We collect this personal data by using cookies, server logs and other similar technologies. Please see the Cookie Policy section below for more information about how we use cookies and how to change your browser settings to refuse some or all cookies.

• Usage Data. When using our services, we automatically collect your Usage Data. When you (or someone using your broadband or telephone service) use our network to make a telephone call or connect to the internet, we keep a record of that call (including the number called) so we can charge for it. We also receive information from other operators about calls made over our network, where we need that information for connecting and billing purposes.

• We will also collect information about your use of our services (such as the amount of time you spend online), which we will use to manage our network and for billing. We will collect information on which devices have accessed our network your broadband router (e.g. type of device, brand, model, operating system and browser) in order to monitor and better understand how our services are used.

• Authentication Data. Where you choose to enable biometric login, your device generates Authentication Data. The private key never leaves your device and we cannot access it; only the corresponding public key is shared with us and stored against your account. When you log in or re-verify your identity, your device signs a one-time challenge using the private key, which we verify using the stored public key. No biometric data is transmitted to or stored by us.

• Third-party Data. We will also receive personal data about you from various third parties including public sources as set out below:

  • Financial, contract and transaction data:
    • Credit reference agencies
    • Fraud prevention scheme
    • Payment services providers
  • Usage and Technical Data:
    • Analytics providers
    • Advertising providers
  • Identity and Contact Data:
    • Disclosure Barring Service agencies
    • Companies House

If you do not agree to the data practices set out in this Privacy Policy, we may not be able to provide you with our services.

4 How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances and our legal basis for processing your personal data include:

• Contract Performance: Processing necessary for entering or performing a contract.
• Legal Compliance: Meeting legal obligations, including responding to requests from regulators.
• Legitimate Interests: For business operations, such as improving service quality and ensuring network security, provided that your fundamental rights are not overridden.
• Consent: Where you have consented to us processing your personal data. Where permitted under the Privacy and Electronic Communications Regulations (PECR), we may send marketing communications to existing customers about similar products and services unless you opt out. In all other cases, we will obtain your consent before sending electronic marketing communications.

Purposes for which we will use your personal data

We have set out below a description of the ways we use your personal data. Note that we may use your personal data for more than one lawful ground, depending on the specific purpose for which we are using your data.

5 Artificial intelligence and automated decision-making

We use artificial intelligence (“AI”) and other automated technologies to help us provide, manage and improve our services. For example, we may use these technologies to assist with customer service, manage customer accounts, analyse information, identify issues or risks, make recommendations and support or carry out decisions and actions relating to our customers and services.

This may involve processing the personal data described in this Privacy Policy and, in some cases, using that information to create predictions, recommendations, classifications or other assessments about you (sometimes referred to as “profiling”).

Some of our automated technologies may make or support decisions about you. Where we use automated decision-making which produces a legal or similarly significant effect on you, we will provide you with appropriate information about the decision, including meaningful information about how it is made and its potential consequences for you. Where required by applicable data protection law, you will also have the right to obtain human intervention, express your point of view and challenge the decision.

You can find more information about the ways in which we use AI and automated decision-making, the types of personal data involved and the safeguards we apply in our AI and Automated Decision-Making Notice.

We may update that Notice from time to time as the ways in which we use AI and automated technologies develop.

6 Marketing Communications

If you are a customer, we may also use your Identity, Contact, Technical, Usage, Profile, and Marketing and Communications Data to form a view on what services and offers may be relevant for you and to send you recommendations about services that we think may be of interest or to invite you to participate in prize draws or competitions (“marketing communications”).

If you have given us your details to record your registered interest in becoming our customer in the future or for us to contact you in relation to our services or business development (including to receive our newsletter), we may use your Identity Data to keep you up to date about our services and coverage.

You will only receive marketing communications from us if you have registered an interest in receiving our services (whether current services or in the future when your building or location is connected to our network), requested information from us in relation to our services or purchased services from us and, in each case, you have not opted out of receiving that marketing.

You can ask us to stop sending you marketing communications at any time via the live chat function on our Website, by following the opt-out links on any marketing message sent to you or by contacting us at any time.

If you are a customer and opt out of receiving marketing communications, we will still send you service-related communications as necessary.

7 Disclosures of your personal data

We share your personal data with the types of third party listed below:

• Build and Installation Partners: For providing service installations and network maintenance.
• Credit Reference and Debt Recovery Agencies: For credit assessments and debt collection. We have set out below further information regarding our use of credit reference agencies.
• Payment Processors: Handling billing and payment services.
• Customer Service Agencies: Conducting surveys to improve service quality.
• Third party suppliers including technology and other suppliers and service providers we engage to provide equipment and services to us.
• Affiliate companies within our corporate group, including our parent company, subsidiaries, and other companies that are under common ownership or control with us.
• Potential Business Partners: In the event of a sale, merger, or restructuring.

All third parties are contractually obligated to use your data in compliance with data protection laws.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

If, as our customer, you have requested and/or consented to a third party managing your billing arrangements for our services, you agree that this may involve that third party (i) having online access to your account details on our Company’s database insofar as they relate to your bills and/or (ii) being given details of your billing arrangements when calling Customer Support or writing to us in connection with managing these arrangements and/or (iii) arranging for any of your bills to be paid. You have informed us which of these options you have chosen and given your consent accordingly. We accept no responsibility in relation to you choosing that third party to manage your billing arrangements or in relation to their use or misuse of such of your personal information to which they have access under these arrangements.

We may also disclose your personal data to a third party if we are under a duty to do so in order to comply with a legal obligation or in order to enforce or apply our terms of use. This includes exchanging information with other companies and organisations for the purposes of law enforcement, fraud protection, and credit risk reduction.

Credit Reference Agencies: In order to process your application, we will perform credit and identity checks on you with one or more credit reference agencies (“CRAs”).

To do this, we will supply your personal information to CRAs and they will give us information about you. This will include information from your credit application and about your financial situation and financial history. CRAs will supply to us both public (including the electoral register) and shared credit, financial situation and financial history information and fraud prevention information.

We will use this information to:

· Assess your creditworthiness and whether you can afford to take the product;
· Verify the accuracy of the data you have provided to us;
· Prevent criminal activity, fraud and money laundering;
· Manage your account(s);
· Trace and recover debts; and
· Ensure any offers provided to you are appropriate to your circumstances.

We will continue to exchange information about you with CRAs while you have a relationship with us. We will also inform the CRAs about your settled accounts. If you borrow and do not repay in full and on time, CRAs will record the outstanding debt. This information may be supplied to other organisations by CRAs.

When CRAs receive a search from us they will place a search footprint on your credit file that may be seen by other lenders.

If you are making a joint application, or tell us that you have a spouse or financial associate, we will link your records together, so you should make sure you discuss this with them, and share with them this information, before lodging the application. CRAs will also link your records together and these links will remain on your and their files until such time as you or your partner successfully files for a disassociation with the CRAs to break that link.

The identities of the CRAs, their role also as fraud prevention agencies, the data they hold, the ways in which they use and share personal information, data retention periods and your data protection rights with the CRAs are explained in more detail at www.experian.co.uk/crain. This information is also accessible from each of TransUnion (www.transunion.co.uk/crain) and Equifax (www.equifax.co.uk/crain). Clicking on any of these three links will take you to the same document.

8 International Transfers

We may transfer personal data outside the UK to group companies or third-party service providers.

When we transfer your personal data within our group of companies, we use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers.

Where data is transferred out of the UK to countries which have laws that do not provide the same level of data protection as the UK law, we ensure that:

• Adequate Safeguards are implemented, such as The International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers or other legal mechanisms to protect your data.
• Data Protection Levels: Meet the same standards required under UK law.

9 Data Security

We have in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

Our data security measures include (but are not limited to):

• Encryption: Secure transmission of data using encryption technologies.
• Access Controls: Restricting access to personal data on a need-to-know basis.
• Network Security Monitoring: Continuous monitoring of our network for potential threats.
• Incident Response Procedures: Immediate actions to contain and resolve data breaches.

We hold ISO 27001 certification, the internationally recognised standard for information security management. This certification demonstrates our commitment to implementing and maintaining a robust framework of policies, processes, and controls to protect the confidentiality, integrity, and availability of the information we hold.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We also have in place procedures to deal with any actual or suspected personal data breach and will notify you and the ICO (the UK supervisory authority) of a breach where we are legally required to do so.

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using SSL technology. Where we have given you (or you have chosen) a customer ID, password(s) or log-ins to allow you to access certain parts of our Website, you are responsible for keeping these confidential. You are responsible for how our services are used from your account and for keeping your account information secret. Please keep this information safe, and do not share it with others.

Unfortunately, sending information using the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of the data you send to our Website; you take the risk for this. Once we have received your information, we will try our best to keep it secure. This includes using strict procedures and security features to try to prevent unauthorised access.

Our Website may, from time to time, contain links to and from the websites of our partner networks, advertisers and others associated with us. If you follow a link to any of these websites, please note that these websites have their own privacy and cookie policies. We accept no responsibility or liability for these policies. Please check these policies before you send any personal data to these websites.

10 Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

We will retain your personal data according to the following timelines:

• Customer Account Information: 7 years after account closure for tax purposes.
• Biometric Login Data (cryptographic public key): retained for as long as you keep biometric login enabled, and deleted when you disable biometric login or close your account.
• One-Time Passcodes (SMS or email re-verification): short-lived; these expire after a short defined period and are not retained once verification is completed.
• Service Usage Data: Retained for as long as necessary for analysis and service improvement (typically up to 5 years), and in any event no longer than required to meet our legal, regulatory and billing obligations.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for at least 7 years after they cease being customers for tax purposes.

We may anonymise your personal data (so that it can no longer be associated with you and so you are no longer identified or identifiable by such data) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

11 Your Legal Rights

You have various rights in relation to your personal data – these are set out in detail below. If you wish to exercise any of these rights, please email us: dataprotection@youfibre.com

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete your personal data when we no longer need it. You may also ask us to delete your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with a legal obligation. However, we may not be able to comply with your request of erasure, for example, if we are required to retain your personal data for legal reasons. We will let you know if this is the case.

Object to processing of your personal data where we are processing your personal data for direct marketing purposes. You have the right to object where we are relying on a legitimate interest to process your personal data but you feel the processing impacts on your fundamental rights and freedoms.

Request restriction of processing of your personal data. You may ask us to suspend the processing of your personal data in the following scenarios: (a) if you do not think the data we hold is accurate, whilst we verify its accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where we no longer need to process it but you require us to store it in relation to a legal claim; or (d) if you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will if feasible practically provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to information which we process by automated means and use to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data (for example, for marketing purposes). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

Lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We wish to have the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance before you exercise this right.

You have certain rights where we make decisions about you using solely automated means which produce legal or similarly significant effects. Further information about when we use automated decision-making, the safeguards we apply and your rights is available in our AI and Automated Decision-Making Notice. You will not have to pay a fee to access your personal data or to exercise any of your other rights. However, if we feel that your request is unfounded, repetitive or excessive, we may charge a reasonable fee or we may let you know that we are refusing to comply with your request. If we refuse your request, we will explain why and you will be entitled to raise the issue with the ICO.

We will respond to all legitimate requests within 30 days of receipt and, if possible, achieve a satisfactory resolution within that time period. Occasionally it may take us longer than 30 days if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

12 Changes to this Privacy Notice

Any changes we may make to this Privacy Policy in the future will be posted on this page. You should check this page from time to time for any changes we make. We may also email you about these changes, if you are a customer of the Company.

13 Contact

If you have any questions, comments and requests regarding this Privacy Policy, including any requests to exercise any of your legal rights under it, please contact our Data Protection Officer using the details set out below.

Email: hello@youfibre.com

Post: Substantial Group Limited, 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom

When you contact us, whether to exercise your rights, in relation to a complaint or otherwise, we may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

14 Complaints Process

We are committed to handling any concerns about our use of your personal data fairly, transparently, and promptly. The following sets out our formal complaints process.

Step 1 — Contact our Data Protection Officer (DPO)

If you have a complaint about how we collect, use, store, or share your personal data, please contact our Data Protection Officer using out contact details set out in the Contacts section above.

Please provide your name, contact details, and a clear description of your complaint. We will acknowledge receipt of your complaint within 30 calendar days of receipt.

Step 2 — Investigation and Response

We will investigate your complaint fully and aim to provide a written response within 30 calendar days of receipt. Where the matter is complex, we may extend this period by a further 30 days, in which case we will notify you of the extension and the reasons for it within the initial 30-day period.

Our response will set out our findings and, where your complaint is upheld, the steps we will take to remedy the matter.

Step 3 — Escalation

If you are not satisfied with our response, or if we have not responded within the applicable timeframe, you have the right to escalate your complaint to the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection matters:

Website: www.ico.org.uk

Helpline: 0303 123 1113

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You also have the right to seek a judicial remedy through the courts if you believe your rights under applicable data protection law have been infringed.

Last updated on 27 October 2026

COOKIE POLICY

This cookie notice (“Cookie Policy”) explains how Substantial Group Limited and its subsidiaries namely:

Netomnia Limited,

YouFibre Limited,

Brsk Limited, and

Brsk ISP Limited,

(“Company”, “we”, “our” or “us”) use cookies and similar technologies to recognise you when you visit our Websites.

What are cookies and why do we use them?

Cookies are small files of letters and numbers which we store on your browser or the device you use to access our Website. Cookies are very useful and do lots of different jobs. For example, they enable you to move between our web pages efficiently, remember your preferences when you visit us again and generally improve your experience when browsing with us. They can also help to ensure that adverts you see online are more relevant to you and your interests, which in turn help us to tailor our communications. Some of the cookies we use are essential (our Website won’t work without them) while others simply make our Website work more efficiently and help us to recognise you when you return to our Website

Types of Cookies we use

We use the following types of cookies:

• Necessary cookies: These are cookies that are required for the essential operation of our Website. These are automatically enabled and cannot be turned off because they are essential to enable you to browse our website. They include, for example, cookies that enable you to log into secure areas of our Website.

• Preferences cookies: These are cookies we use to recognise you when you return to our Website. They enable us to personalise our content for you and save your preferences in a cookie on your device (for example, your choice of language or region or, if you select the ‘Remember me on this computer’ box, your username and password). This means that the next time you log on to our Website using that device you won’t need to re-enter those details. We suggest you don’t select the ‘Remember me’ box if you use a shared device or publicly available computer. The cookie file itself won’t store your personal information.

• Analytical (Statistics) cookies: Analytical cookies collect information about how you use our website. For example, these allow us to recognise and count the number of visitors and to see how visitors move around our Website when they are using it. This helps us to improve the way our Website works, for example, by ensuring that users are finding what they are looking for easily. All information collected for these purposes and shared with our analytics providers is anonymous or collected in such a way that users cannot be identified from this data. This information allows us to improve our Website and our services, for example, to measure the effectiveness or success of our advertising campaigns and products. For more information about Google Analytics, please see their privacy policy at: google.com/policies/privacy.

• Marketing cookies: We use marketing cookies to place adverts about our products on other websites and manage referrals from those websites to our Website. If you follow a link from another website then purchase our services, we may use these cookies to tell the other website that you have made a purchase. Or if you click on a link to an advert, video or social media channel on our Website, we may use marketing cookies to gather statistics about this.

Some of the cookies used on our Website are provided by our trusted third-party service providers. These third parties may include, for example, search engines, social media networks, advertising networks and providers of external services such as web traffic analysis services. Certain cookies are provided by third-party analytics, advertising and social media providers, and information collected through those cookies may be shared with those providers in accordance with their privacy policies and applicable data protection law.

Cookies we use

Details of the cookies we currently use including their purpose and type, are set out here.

We may update the Cookie List from time to time as the cookies and similar technologies used on our Website change.

Your choices

You can control your cookie preferences through your device settings and browser settings on our Website.

You can block cookies by activating the setting on your browser which allows you to refuse the setting of all or some cookies. If you want to stop cookies being stored on your computer, you can check your browser manufacturer’s instructions by clicking “Help” in your browser menu. However, if you block all cookies (including essential cookies) you may not be able to access all or certain parts of our Website. Unless you’ve set your browser to refuse cookies, our system will issue cookies as soon you visit our Website.

If you want to delete any cookies that are already on your computer, you should check the instructions for your file management software to locate the file or directory that stores cookies.

You can learn about and opt out of a number of commercial third-party cookies (including some used by us) at www.networkadvertising.org.  Some of the opt-outs used by our commercial service providers require a cookie to be placed on your computer. This “opt-out” cookie is only used to tell the relevant cookie servers not to send you any more cookies. If you keep deleting cookies (including “opt-out” cookies) from your temporary internet files, you might need to repeat the opt-out process, the next time you visit our Website.

For more information about deleting and controlling cookies visit www.youronlinechoices.com or www.aboutcookies.org.

You have the right to access, modify, or delete any personal data collected through cookies in accordance with our Privacy Policy. To exercise these rights, please contact us at dataprotection@youfibre.com.

Last updated on 27 October 2026