Privacy policy

Confia OÜ (Estonia)
Registry code: 14407886
Address: Pagari 1, Tallinn, Harjumaa, Estonia
Email: [email protected]

This policy explains how personal data is processed on companyfigures.co.uk under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). We have not appointed a data protection officer, as the processing does not meet the conditions for a mandatory appointment (UK GDPR Article 37).

Service — the website companyfigures.co.uk
Data subject — an individual whose personal data is processed
Companies House — the registrar of companies for England and Wales, Scotland and Northern Ireland

3.1. Data from Companies House

The Service republishes public information from Companies House about individuals connected with companies:

• officers (directors, secretaries, LLP members): name, role, month and year of birth, date of appointment and, where applicable, date of resignation;
• persons with significant control (PSC): name, month and year of birth, the nature of their control (for example the band of shares or voting rights held) and the date they were notified;
• previous company names and the names of companies, which may include an individual's name.

Companies House makes this data available to the public under the Companies Act 2006 and licenses it for re-use under the Open Government Licence v3.0.

3.2. Data from filed accounts

From the filed accounts we show the company's figures (balance sheet, profit and loss account where filed, number of employees) and the description of its principal activity. Names of individuals who signed the accounts are not shown.

3.3. What the Service does NOT process

• residential or correspondence addresses of officers or PSCs;
• full dates of birth (Companies House publishes only the month and year of birth, and only those are shown);
• nationality, country of residence or occupation of individuals;
• debts, county court judgments or credit information about individuals;
• special category data (health, political or religious beliefs, etc.);
• scores, ratings or assessments of individuals.

3.4. Technical server logs

When you use the Service, our hosting and CDN providers (see section 10) process technical request data (IP address, browser, page, time) for operation and security. The Service itself does not store IP addresses or search text.

When assessing a company, it matters who runs and controls it. The information is used for:

• checking business partners before entering into contracts;
• anti-money laundering and counter-terrorist financing checks;
• journalism and research;
• transparency in business.

Personal data is processed on the basis of UK GDPR Article 6(1)(f) — the legitimate interests of the controller and third parties in access to public company information. The data comes from a public register that the law requires to be open to everyone.

As the data is not collected from the data subjects themselves and informing each of them individually would involve disproportionate effort, the information required by Article 14 is provided through this policy (Article 14(5)(b)).

We have carried out and documented a legitimate interests assessment. A copy can be requested at [email protected].

The Service does not carry out profiling or automated decision-making within the meaning of UK GDPR Article 22 and does not assign scores or ratings to individuals. Calculated figures relate only to companies and are based on their filed accounts.

The Service is updated from Companies House data. Officers who have resigned are shown with their resignation date, as at Companies House; PSCs who have ceased are not shown. Information that Companies House no longer publishes is removed at the next update.

The Service has no pages about individuals. Names may appear on company pages, which are indexed because those pages are about the company.

As a data subject you have the right to:

9.1. Access — find out what personal data about you the Service processes.

9.2. Rectification. As the data comes from Companies House, the register itself must be corrected at Companies House. The Service shows corrections after the next update.

9.3. Object (UK GDPR Article 21). We assess your particular situation and stop the processing unless there are compelling legitimate grounds that override your interests. See Remove information.

9.4. Restriction or erasure in the cases set out in UK GDPR Articles 17 and 18.

9.5. Complain to a supervisory authority: the Information Commissioner's Office (UK) — ico.org.uk, or the supervisory authority of the controller's home country, the Estonian Data Protection Inspectorate — aki.ee.

Requests

Send requests to [email protected]. We reply within one month. For complex or numerous requests the period may be extended by two further months; we will tell you if so. We may ask for proof of identity.

Personal data is not disclosed to third parties, except to:

• processors providing the Service's technical infrastructure: hosting (Fly.io) and CDN/security (Cloudflare);
• Companies House: to refresh a company's officers, the server sends only the company number to the Companies House API — no data about you;
• LEIAdmin Lookup (search.leiadmin.com) and GLEIF (api.gleif.org): to look up a company's LEI status, the server sends only the company number — no data about you;
• Google Ireland Limited (Google Analytics, see section 11);
• where required by law.

Transfers outside the UK (for example to Cloudflare or Google in the United States) rely on the safeguards in UK GDPR Chapter V (the UK Extension to the EU-U.S. Data Privacy Framework and/or the International Data Transfer Addendum).

Security: encrypted storage, restricted and authenticated access to the infrastructure, read-only database access for the web application and encrypted connections (HTTPS/TLS).

11.1. Google Analytics 4 (Google Ireland Limited) is used to measure how the Service is used. Google sets cookies (such as _ga, _ga_*, up to 2 years) and processes information about page views and your device. Advertising features are not used. The cookie notice shown on your first visit informs you about this; it does not switch analytics on or off.

11.2. Our own statistics. The Service uses its own (first-party) visitor statistics to understand and improve the Service:

• the cookie entity_visitor (12 months): a random identifier for counting unique visitors. It does not contain a name, email or IP address, is HttpOnly and is sent only to the Service;
• browser local storage: entity_sid (session identifier, renewed after 30 minutes of inactivity), entity_theme(light/dark theme) and entity_notice (that you have seen the cookie notice).

11.3. What is measured: page views (page template and, on company pages, the company number), the previous page on the Service, the type of traffic source (for example a search engine or direct), clicks on buttons and links (page template, not the link text), scroll depth, active time and device type. We do not store IP addresses, search text or link text. Statistics are deleted after 90 days at the latest.

11.4. The legal basis for these statistics is our legitimate interest in understanding and improving the Service. To opt out, block or delete cookies for this site in your browser (the Service works without them) or install the Google Analytics opt-out browser add-on. You can also object at [email protected].

We may change this policy. The current version is always available on the Service. Significant changes will be announced on the Service.