Root & Branch

Governance & Data Protection

Privacy & Zero-Leakage Data Sovereignty Policy

Last updated: 19 October 2026 • Data Controller: Shaun Murdock (MCIL), trading as Root & Branch Translation

1. Client Confidentiality & Zero Public-Cloud AI Training

Root & Branch handles sensitive statutory, arbitral, corporate governance, and financial documentation across French, Spanish, Italian, Portuguese, Catalan, and English. In accordance with the Chartered Institute of Linguists (CIOL) Code of Professional Conduct and ISO 17100 information-security standards:

  • Strict Non-Disclosure: All source documents, term sheets, financial statements, arbitral pleadings, and bilateral translation memories (.sdltm / .sdltb) provided by clients are treated as strictly confidential commercial secrets.
  • Zero Public-Cloud AI Leakage: Client source texts and proprietary translations are never uploaded to public, consumer-grade machine translation portals or unsecured third-party large language models (LLMs) that retain user inputs for model training. All computer-assisted translation (CAT), terminology, and AI-assisted workflows are executed strictly within locally encrypted environments (Trados Studio 2024) and enterprise-grade zero-training accounts (Google Workspace Business Standard), ensuring client data is never used to train public AI models.
  • Mutual NDA Availability: I routinely execute bilateral Non-Disclosure Agreements (NDAs) prior to reviewing tender packages or unredacted legal and financial files.

2. UK GDPR & Data Protection Notice

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller is Shaun Murdock (trading as Root & Branch Translation) (shaun@rootandbranch.online).

  • Lawful Basis for Processing: I process personal data (such as names, institutional email addresses, and signatory details contained within contracts or enquiries) strictly on the basis of Contractual Necessity (Article 6(1)(b) UK GDPR) and Legitimate Interests (Article 6(1)(f) UK GDPR) for B2B communications.
  • Zero Invasive Tracking: This website is statically generated and does not deploy third-party advertising cookies or sell visitor data. Enquiry form submissions are processed securely for the sole purpose of responding to your request.
  • Data Retention & Erasure: Project files and statutory accounting records are retained for up to seven (7) years to comply with HM Revenue & Customs (HMRC) and professional indemnity requirements, unless earlier erasure of source files is requested in writing under a client NDA.