Current version, effective 19 October 2026

Privacy policy

1 Introduction

This Privacy Policy is provided by BALANCETRACE LTD (company number 17252905), whose registered office is at Flat 40 Eaton House, Vicarage Crescent, London, England, SW11 3LE (‘we’, ‘our’ or ‘us’), in connection with the BalanceTrace cloud-based business-to-business software-as-a-service platform, associated website, applications, integrations, APIs and related services (collectively, the “Services” or the “Platform”). BalanceTrace supports accounting firms conducting external audits with engagement management, document upload, storage and organisation, workflows, AI-assisted processing, draft outputs and methodology tools. In this Privacy Policy, “Authorised Users” means individuals (such as employees, contractors or agents of a customer) who have been authorised by that customer to access and use the Services on the customer’s behalf under the customer’s account.

We take your privacy seriously. Please read this Privacy Policy carefully because it explains how and why we collect, store, use and share personal data through our Services. It covers website visitors, prospective and current customer contacts, customer administrators, Authorised Users, invited end-client users, support and billing contacts, supplier contacts and other individuals whose personal data we process for our own purposes. For that processing, we act as controller under the UK GDPR. The Services are intended for use by business professionals aged 18 or over and are not directed at children.

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data are regulated by law, including under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, other data protection laws.

We act as a controller for personal data processed for our own purposes, including account administration, authentication, billing, security, service communications, support, compliance and appropriately configured analytics and marketing. Audit firms using BalanceTrace generally control the personal data in audit engagement files, including data uploaded by their Authorised Users or invited end-client users, and we normally process that data on the relevant firm’s behalf. The specific roles and responsibilities are governed by our customer contract and Data Processing Agreement. This Privacy Policy primarily applies to our controller processing. For personal data in an engagement file, the relevant audit firm’s privacy notice will generally apply, and we may refer a rights request to that firm.

2 What this policy applies to

This Privacy Policy applies when you visit our website, communicate with us or use or are invited to use the Services. It does not replace a customer audit firm’s privacy notice for personal data that the firm controls in its audit engagements.

The Services may link to or rely on other apps, websites, APIs, software tools or services owned and operated by us or by certain trusted third parties to enable us to provide you with the Services, including hosting, analytics, payment processing, communications and third-party integrations. These other apps, websites, APIs or services may also gather information about you in accordance with their own separate privacy policies. We are not responsible for the privacy practices of these third parties. For privacy information relating to these other apps, websites or services, please consult their privacy policies as appropriate. For more information see the section ‘Who we share your personal data with’ below.

3 Personal data we collect about you

We collect and process the following categories of personal data when you use our Services:

Category of data	In more detail
Identity, contact and account data Registration is required for administrators and Authorised Users to use the Services; invited end-client users may be required to complete a limited onboarding process.	Your name, business contact details, organisation, role, account identifiers, login credentials and authentication or multi-factor authentication information. For invited end-client users, this may include an email address, invitation and onboarding status and engagement association. Subscription and billing information, including plan, seat, invoice and transaction details. Payment card details are processed by Stripe rather than stored directly by us, except for limited payment references and records made available to us.
Audit engagement data and Customer Data	Audit evidence, financial, transaction and payroll data, communications, prompts, documents, customer methodology and other files, records or content uploaded, submitted, connected or generated by a customer, its Authorised Users or invited end-client users (“Customer Data”). Customer Data may include personal data about directors, employees, customers, suppliers and other individuals connected with an audit. We normally process this data as processor on the relevant customer’s documented instructions to provide, secure and support the Services. We do not use Customer Data, prompts or outputs to train BalanceTrace or third-party foundation models unless separately, expressly and lawfully agreed.
Service outputs and interaction data	Draft content, results, summaries, analyses, recommendations and other outputs generated through use of the Services, together with prompts, queries, commands, actions, feature usage, feedback, configuration choices and usage patterns. AI-assisted outputs may be inaccurate or fabricated and require independent professional review and verification against source evidence. BalanceTrace does not accept responsibility for any decision or action taken in reliance on AI-assisted outputs. We process this data to provide, maintain, secure and, where lawful and consistent with our contracts, improve the Services.
Technical and usage data collected automatically	Your usage patterns, including log-in activity, features accessed, pages viewed, actions performed, session duration, audit events and time stamps. Technical information including device type, operating system version, browser type, application version, IP address, log files, cookies and appropriately configured analytics data used for system functionality, security, fraud prevention and service optimisation. See our separate Cookie Policy for further information about cookies and similar technologies.
Communications and Support Data	Communications you send to us, including emails, chat messages, support tickets, feedback and other correspondence, and records of service, privacy, legal or security communications we send to you. We use this data to provide support, respond to enquiries, administer the Services and improve them where lawful.
Third-party provider and integration data	Data received from or disclosed to third-party providers and integration partners as necessary to deliver the Services, including hosting and database providers, analytics, payment, communications, security, error-monitoring and AI model or infrastructure providers, and integrations enabled by you or your organisation. This may include account and usage data and, where required for selected functionality, Customer Data, prompts, inputs and outputs. Providers process data under contractual obligations and, where applicable, data processing agreements. For more information, see “Who we share your personal data with” below.

If you do not provide personal data we request, particularly account information and any data needed to configure or use the Services, we may be unable to provide the Services to you. Certain data categories are essential for core functionality, while others are optional and used only to enhance your experience.

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.

4 Sensitive Data

Sensitive personal data (also known as special category data) means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, data concerning health, sex life or sexual orientation.

Our Services are not intended to require the routine processing of special category data, but such data may be included in Customer Data depending on the audit engagement records that customers, Authorised Users or invited end-client users choose to upload, as detailed below:

(a)Special category data in Customer Data: Customers, Authorised Users and invited end-client users may upload or input information that includes special category data, depending on the relevant audit engagement and their use of the Services.
(b)Data revealing personal characteristics: Content submitted through the Services may reveal information about an individual’s racial or ethnic origin, political opinions, religious beliefs, health or other protected characteristics.
(c)Legal basis for processing special category data: Where we process special category data as controller, we will do so only where we have a lawful basis and a valid condition under Article 9 UK GDPR. Where special category data is included in Customer Data processed for a customer, that customer is responsible for identifying and documenting the appropriate lawful basis and Article 9 condition and providing any required notices.
(d)Enhanced safeguards: We apply technical and organisational measures proportionate to the sensitivity and risks of the personal data, including appropriate access controls and data minimisation measures.
(e)Third-party processing: Our service providers and subprocessors, including relevant AI and cloud infrastructure providers, may process special category data where it is included in Customer Data and the relevant functionality is used, subject to applicable instructions, contractual terms and safeguards.

If you choose to make content or outputs available to other users, external recipients or the public through sharing, publishing or integration features, you should carefully review that content first to ensure you are comfortable with the disclosure of any personal or sensitive information it may contain. You retain sole responsibility for deciding what data is uploaded, shared or published through the Services and for ensuring that any such disclosure complies with applicable law and your own internal policies. BalanceTrace is not liable for any disclosure resulting from your decision to share content through the Services.

5 How your personal data is collected

We collect personal data directly from you when you create an account or are invited to one, use the Services, contact us, request a demonstration, subscribe to updates, connect integrations or otherwise interact with us. We may also collect data from customer administrators and Authorised Users, invited end-client users, the organisations you represent, suppliers and service providers, authorised integrations and public business sources.

We collect personal data through the following methods:

(a)Information you provide directly: This includes information provided when you register for or accept an invitation to an account, request a demonstration, purchase a subscription, upload or input Customer Data, configure workflows or settings, connect an integration, submit prompts or queries, or communicate with our support, sales or other teams.
(b)Information collected automatically: Technical data including device information, IP addresses, browser type, usage patterns, session data and analytics information collected through cookies and similar technologies.
(c)Information from third-party integrations: When you or your organisation authorise connections with third-party services, we may receive data from those services in accordance with your instructions, the relevant integration settings and the third party’s privacy terms.
(d)Information generated by our Services: Draft outputs, logs, appropriately configured analytics, security and audit logs, recommendations and other information generated through use of the Services.

6 How and why we use your personal data

Under the UK GDPR, where we act as a data controller, we process your personal data based on the following legal bases:

(i)where you have given consent
(ii)to comply with our legal and regulatory obligations
(iii)for the performance of a contract with you or to take steps at your request before entering into a contract, or
(iv)for our legitimate interests or those of a third party

A legitimate interest exists when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below).

The table below explains what we use your personal data for and why.

What we use your personal data for	Our reasons
Create, authenticate and manage accounts, administer multi-factor authentication, roles and permissions, and onboard invited end-client users	To perform our contract with you or to take steps at your request before entering into a contract
Provide and operate the Services, including customer-configured workflows, document processing and AI-assisted functionality	Depending on the circumstances: • to perform our contract with you or to take steps at your request before entering into a contract (including the Platform Terms and Conditions and applicable order or account details) • where special category data is processed by us as controller, we do so only where an appropriate Article 9 condition applies; where personal data is processed in Customer Data for a customer, we act on that customer’s documented instructions and the customer is responsible for the applicable lawful basis, conditions and notices
To enforce legal rights or defend or undertake legal proceedings	Depending on the circumstances: • to comply with our legal and regulatory obligations • in other cases, for our legitimate interests or those of a third party, i.e. to protect our business, interests and rights or those of others
Send non-marketing account, authentication, security, support, privacy, legal and service-status communications. We use invited end-client contact details only for these necessary purposes and do not use or sell them for marketing or resale.	Depending on the circumstances: • to comply with our legal and regulatory obligations, including under the UK GDPR, Data Protection Act 2018 and applicable electronic communications law • in other cases, for our legitimate interests or those of a third party, including improving and developing the Services based on aggregated and de-identified usage insights; analysing usage patterns and feature performance to maintain service quality; ensuring platform security and preventing fraud, misuse or unauthorised access; and administering our business operations. We conduct legitimate interests assessments where appropriate to ensure our interests do not override your fundamental rights and freedoms.
Protect the security of systems and data, including Platform integrity, Customer Data and account security, and prevent, detect and investigate fraud, misuse and unauthorised access	To comply with our legal and regulatory obligations. Where security measures exceed those obligations, for our legitimate interests or those of third parties in protecting the Platform, Customer Data and accounts; preventing fraud, misuse or criminal activity; and investigating and responding to security incidents.
Operational reasons, including service administration, billing support, troubleshooting, quality assurance, staff training and technical support. Product improvement is carried out in accordance with our contracts, this Privacy Policy and applicable law, using aggregated, anonymised or otherwise de-identified data where reasonably possible and without training BalanceTrace or third-party foundation models on Customer Data, prompts or outputs unless separately, expressly and lawfully agreed.	For our legitimate interests or those of a third party, i.e., to be as efficient as we can so we can deliver the best service to you
Use appropriately configured analytics to measure service performance, understand customer needs and improve the Services, and send permitted business-to-business marketing to prospective and current customer contacts (excluding invited end-client users).	For our legitimate interests in operating, measuring and improving the Services and developing customer relationships, where those interests are not overridden by individual rights. For electronic marketing, we also rely on consent where required by applicable electronic communications law, and provide an opt-out.
Maintain accurate account, organisation, workspace, integration and preference records, and administer subscriptions, seats, invoices, payments, refunds and related tax records	Depending on the circumstances: • to perform our contract with you or to take steps at your request before entering into a contract (including the Platform Terms and Conditions and applicable order or account details) • to comply with our legal and regulatory obligations • where neither of the above applies, for our legitimate interests or those of third parties in maintaining accurate records, administering our business and customer relationships, and providing relevant service information
Compliance with legal and regulatory obligations, including responding to lawful requests from regulators, law enforcement and courts, maintaining records as required by applicable law, and fulfilling our obligations under data protection, tax, accounting and other applicable laws	To comply with our legal and regulatory obligations, including data protection, tax, accounting, corporate, sanctions and law-enforcement requirements Where the legal obligation basis does not apply, for our legitimate interests or those of a third party in establishing, exercising or defending legal claims, cooperating with authorities and administering our business lawfully
To share your personal data with members of our group and third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, financing, reorganisation or in the event of our insolvency. In such cases, information will be anonymised or minimised where reasonably practicable and only shared where necessary for the relevant transaction	Depending on the circumstances: • to comply with our legal and regulatory obligations • in other cases, for our legitimate interests or those of third parties, including: protecting, realising or growing the value in our business, technology, and intellectual property; ensuring business continuity; and facilitating corporate development while maintaining data protection standards

See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.

7 Marketing

We may send marketing communications about BalanceTrace to prospective and customer business contacts where you have consented or where permitted by law and our legitimate interests are not overridden. We do not use contact details supplied for invited end-client access for marketing or resale. Necessary account, authentication, security, privacy, legal and service-status communications are not marketing.

We will obtain consent before sending marketing communications where required by applicable law. If you have previously opted in to receiving marketing communications, we may continue to send you relevant communications until you withdraw consent or unsubscribe.

You will have the right to opt out of receiving marketing communications at any time by:

contacting us at privacy@balancetrace.com
using the ‘unsubscribe’ link included in all marketing emails you may receive from us

We will always treat your personal data with the utmost respect and will not sell or share it with other organisations for their own marketing purposes.

For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.

8 Who we share your personal data with

We share personal data with service providers, subprocessors and integration partners where necessary to operate, secure and support the Services and, for controller data, improve them lawfully. Access is limited to the data reasonably required for the relevant function and is subject to applicable contractual, confidentiality and data protection terms. Material providers include:

(a)Anthropic, OpenAI and Google – AI model and related infrastructure used for customer-selected or Platform-configured AI-assisted processing, including analysis, classification, extraction, summarisation and draft generation. Customer Data, prompts and outputs are not used to train BalanceTrace or third-party foundation models unless separately, expressly and lawfully agreed. Depending on the service and configuration, limited authorised human review may occur for support, abuse prevention or safety where contractually permitted, subject to strict confidentiality and access-control requirements. Processing locations and provider retention periods vary by the service, account configuration and data flow; we apply contractual settings and UK transfer safeguards appropriate to the functionality used and provide further information on request.
(b)Vercel (application delivery and hosting), Supabase (database, authentication and related infrastructure), Langfuse (AI observability), Sentry (error monitoring), Resend (transactional email), PostHog (product analytics) and Stripe (payment processing). The contracting entity, processing location, data categories and retention depend on the service and account configuration. Where a restricted transfer occurs, we apply the relevant mechanism described below and can provide information about the applicable provider and safeguard on request.

Where a recipient processes personal data outside the United Kingdom, we use an applicable UK transfer safeguard where required, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with supplementary measures where appropriate. The safeguard depends on the recipient, destination and data flow; contact us for relevant information.

We carry out proportionate diligence and require service providers to apply appropriate measures to protect personal data. Where required, our contracts restrict providers to processing personal data for specified purposes and on our instructions, subject to confidentiality, security, assistance, deletion and audit terms appropriate to the service and risk. Customer-enabled integrations may also be subject to the customer’s own arrangements with the integration provider.

We or the third parties mentioned above may occasionally also need to share your personal data with:

external auditors, e.g. in relation to the audit of our accounts and our company - the recipient of the information will be bound by confidentiality obligations
professional advisors (such as lawyers and other advisors)—the recipient of the information will be bound by confidentiality obligations
law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations
other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, financing, reorganisation or in the event of our insolvency—usually, information will be anonymised where possible, but where this is not possible the recipient will be bound by confidentiality obligations and data protection requirements

If you would like more information about who we share your personal data with and why, please contact us (see ‘How to contact us’ below).

We do not sell personal data. We disclose it only as described in this Privacy Policy, as instructed by a customer where we act as processor, or where otherwise required or permitted by law.

9 How long your personal data will be kept

We retain personal data only for as long as necessary for the relevant purpose, taking account of contractual requirements, legal obligations, limitation periods, security needs and documented backup cycles. The specific retention periods for each category of data are set out below: (i) Customer Data processed for a customer is retained during the service relationship and made available for supported export for 60 days after cancellation or termination, after which active copies are deleted or anonymised subject to legal retention requirements and documented backup cycles; (ii) account and customer-administration records are retained during the service relationship and for six years afterwards where needed for contract, claims and compliance purposes; (iii) authentication, security and technical logs are normally retained for up to 12 months after collection, but relevant records may be kept longer while an incident, investigation or claim remains active; (iv) support records are normally retained for three years after the relevant support matter is closed; (v) financial, invoicing and tax records are normally retained for six years or longer where required by law; and (vi) marketing suppression records and preference data are retained for as long as necessary to honour preferences and demonstrate compliance. The 60-day export period does not apply to controller records that we must or reasonably need to retain for tax, billing, security, claims, compliance or suppression purposes.

Following the end of the applicable retention periods, we will securely delete or anonymise your personal data, except where we are required or permitted by law to retain it for longer.

10 Transferring your personal data out of the UK

We may transfer personal data internationally as part of operating the Services. Under UK data protection laws, we can only transfer your personal data to a country outside the UK where: the UK government has decided the particular country ensures an adequate level of protection of personal data under Article 45 UK GDPR; there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law.

Accordingly, when transferring your personal data from the UK to:

The EEA: for transfers from the UK, we rely on applicable UK adequacy regulations while they remain in force. Where EU GDPR applies to a transfer from the EEA to the UK, the relevant exporter may rely on the European Commission’s UK adequacy decision while it remains in force.
Any country located outside the UK/EEA (including, where applicable, the United States or other countries in which our service providers, subprocessors or integration partners operate): we rely on appropriate safeguards under the UK GDPR, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms, together with supplementary technical and organisational measures where appropriate.

In the event that we could not continue to rely on either of those mechanisms at any time, we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative lawful mechanism or exception provided by UK data protection law.

11 Your rights

We are a controller for personal data that we process for our own purposes. You can exercise the rights below directly with us using the contact details in this Privacy Policy. If your request concerns personal data in an audit engagement file that we process for an audit firm, please contact that firm where practicable; we may refer or transmit your request to it and assist it in responding. For more information about data protection rights, please visit the ICO website.

Access to a copy of your personal data

The right to be provided with a copy of your personal data.

Correction (also known as rectification)

The right to require us to correct any mistakes in your personal data.

Erasure (also known as the right to be forgotten)

The right to require us to delete your personal data—in certain situations.

Restriction of use

The right to require us to restrict use of your personal data in certain circumstances, e.g. if you contest the accuracy of the data.

Data portability

The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations.

To object to use

The right to object:

at any time to your personal data being used for direct marketing (including profiling)
in certain other situations to our continued use of your personal data, e.g. where we use your personal data for our legitimate interests.

Not to be subject to decisions without human involvement

You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.

Use of artificial intelligence and automated processing: The Services may use third-party artificial intelligence models and related technology to process prompts, Customer Data and other inputs for features such as extraction, classification, summarisation, drafting assistance, search, recommendations, workflow support and analytics.

We do not currently use personal data in our controller capacity to make decisions based solely on automated processing that produce legal or similarly significant effects. Customers determine how AI-assisted features are used in their audit engagements and remain responsible for their professional decisions.

• processing of Customer Data is generally performed on the customer’s documented instructions to provide requested functionality;

• customer firms and their suitably qualified professionals retain control over use of the Services and whether any output is acted upon;

• outputs are draft tools or information for consideration, may be inaccurate, incomplete, outdated, biased, misleading or fabricated, and require independent review and verification against source evidence; and

• BalanceTrace is not the auditor, engagement partner or quality reviewer and does not issue or approve audit opinions.

If we introduce solely automated decision-making that produces legal or similarly significant effects, we will provide the information and safeguards required by law, including any applicable right to human intervention, to express your point of view and to contest the decision. If you believe processing through the Services has significantly affected you, contact us and, where it concerns Customer Data, the relevant customer firm.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR.

If you would like to exercise any of those rights, please email, call or write to us—see below: ‘How to contact us’. We will respond to your request without undue delay and in any event within one month, unless we notify you of a permitted extension. When contacting us please:

provide enough information to identify yourself (e.g., your full name and username) and any additional identity information we may reasonably request from you, and
let us know which right(s) you want to exercise and the information to which your request relates

12 Keeping your personal data secure

We implement appropriate technical and organisational security measures to protect your personal data in accordance with applicable data protection laws, including the UK GDPR. These measures include encryption of data in transit and at rest, role-based access controls, regular security assessments and monitoring, and incident response procedures.

Access to personal data is restricted and logged as appropriate. Customer administrators control Authorised User and invited end-client access within their organisation and audit engagements, subject to the functionality of the Services, and are responsible for removing access when no longer required.

We maintain procedures to identify, investigate and respond to suspected personal data breaches. Where we act as controller, we will notify the Information Commissioner’s Office without undue delay and, where feasible, not later than 72 hours after becoming aware of a breach that is likely to result in a risk to individuals’ rights and freedoms, and notify affected individuals without undue delay where a high risk threshold is met. Where we act as processor, we will notify and assist the relevant customer in accordance with our Data Processing Agreement so that it can meet its obligations.

Your security responsibilities: Depending on how you use the Services, you may upload or process sensitive, confidential or personal information. We therefore strongly recommend that you take the following steps to protect your account and data:

Use strong, unique passwords and enable multi-factor authentication;
Keep your login credentials confidential and do not share account access;
Promptly notify us of any unauthorised access or security concerns;
For business or team accounts: implement proper user access management, including promptly deactivating accounts when team members leave your organisation, regularly reviewing active user accounts, and ensuring appropriate permissions are maintained at all times;
Be mindful of the sensitivity of any information you upload or input into the Services, including personal data, confidential business information and any data relating to third parties, and ensure you have authority to use it in connection with the Services;
Regularly review and manage the data stored in your account, and delete content you no longer need;
Use secure network connections (avoid public Wi-Fi for sensitive uploads) when accessing the platform;
Be cautious about sharing outputs or content generated through the Services, as they may contain personal, confidential or commercially sensitive information. You are responsible for ensuring that any sharing or downstream use complies with applicable laws, contractual restrictions and internal policies; and
Report any suspected security incidents or unauthorised access to us immediately using the contact details provided in this policy.

For additional cybersecurity guidance, you may visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

13 How to complain

Please contact us if you have any queries or concerns about our use of your information (see below, ‘How to contact us’). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with the Information Commissioner.

The Information Commissioner can be contacted at https://ico.org.uk/make-a-complaint or telephone: 0303 123 1113.

14 Changes to this privacy policy

We may change this Privacy Policy from time to time. We will update the policy version date and, where required by law or appropriate for a material change, notify affected individuals through the Platform, by email or by other appropriate means at least 30 days before the change takes effect, unless a shorter period is necessary to comply with law or to address security concerns. Where a change requires consent, we will seek it before implementing the relevant processing.

15 How to contact us

You can contact us by post or email if you have questions about this Privacy Policy or personal data we control, wish to exercise a data protection right or make a complaint.

Our contact details are shown below:

Email: privacy@balancetrace.com
Post: BALANCETRACE LTD, Flat 40 Eaton House, Vicarage Crescent, London, England, SW11 3LE