Privacy notice

Check the Director produces reports for businesses on a person's history as a company officer, taken from the public Companies House register. This notice explains what personal data we use, why, and the rights you have. It covers the people our customers research (“subjects”), our customers' own users, people who write to us, and people at the firms we write to.

Who we are

Check the Director is operated by John Haigh, a sole trader trading as Priorform, whose business address is 26 Sandford Park Place, Cheltenham, GL52 6HP. We are registered with the Information Commissioner's Office under number ZC269901. For anything about your personal data, write to privacy@checkthedirector.co.uk.

If a report has been run about you

What we use

Information from the Companies House register and the documents filed there, The Gazette's corporate and personal insolvency notices, the UK Sanctions List, the US Treasury's list of Specially Designated Nationals, the EU's consolidated list of financial sanctions, the Individual Insolvency Register, HMRC's list of deliberate tax defaulters, the Charity Commission's registers, the FCA's Financial Services Register, France's register of companies and Norway's register of roles:

• your name as it appears on each of your officer records;
• your month and year of birth, as the register shows them;
• the correspondence addresses shown on your officer records;
• your appointments: the companies, your roles, and the dates;
• entries that concern you on the registers of people with significant control, in confirmation statements (shareholdings) and on the disqualified directors register;
• the filings of companies you have been an officer of, such as accounts, statements of affairs and strike-off notices;
• notices in The Gazette that a company you have been an officer of has been the subject of a petition to wind it up, or that such a petition was dismissed;
• whether the UK Sanctions List (Foreign, Commonwealth and Development Office) or the Individual Insolvency Register (Insolvency Service) holds an entry under your name, and, where it does, what the entry states (for the insolvency register, the case details only where the birth date matches yours; never the address);
• whether the US Treasury's list of Specially Designated Nationals (Office of Foreign Assets Control) or the EU's consolidated list of persons subject to financial sanctions (European Commission) holds an entry under your name, and, where it does, what the entry states: the names and aliases listed, the dates and place of birth, nationality, the sanctions programme or regime and the legal act it rests on, and the listing date. Whether a company you have been an officer of is listed with its company number is shown too. A listing binds US persons, or business within the EU, under those regimes; a report shows it as information, not as a prohibition in UK law;
• whether The Gazette has published personal insolvency notices (such as a bankruptcy order, a trustee's appointment, an annulment or a discharge) under your name, and, where it has, what each notice states: its type and dates, the court and case number, the birth date and the town it gives, and your occupation as stated. We keep a copy of every personal insolvency notice The Gazette publishes so that we can search it; a notice reaches a report only when its name contains yours;
• whether HMRC's published list of deliberate tax defaulters names you at an address on your Companies House records, or names a company you have been an officer of at its registered office, and, where it does, what the entry states (trade, period, tax and penalty, and the town; never the full address). An entry under your name at another address is shown as a shared name, not as you.
• whether the Charity Commission for England and Wales lists a trustee under your name, and which of those trusteeships the customer confirmed as yours (the register states no date of birth or address, so a listing is only a possible match until the customer confirms it); and whether the Commission's register of removed trustees names a person with your name, linked to you only where it is at a charity whose trusteeship the customer confirmed.
• whether the FCA's Financial Services Register lists an individual under your name, and what it records of them: regulatory status, the firms and controlled functions held with their dates, and any prohibition order or public disciplinary action with its notice. The register states no date of birth or address, so a listing is linked to you only where one of its firms carries the company number of a company you have been an officer of; any other listing is shown as a shared name, not as you.
• whether France's register of companies lists a company director whose name contains yours and who was born in your month and year of birth, and, where it does, the company, its SIREN number and status, the role, the nationality stated and when the register last updated the company's record. Companies whose director of your name was born in another month are counted, never listed.
• whether Norway's register of roles shows a person whose name contains yours, born in your month and year of birth, in a current role that runs, owns or represents a Norwegian organisation, and, where it does, the organisation, its number, legal form and any bankruptcy or winding-up, and the role. Roles held by people of your name born in another month are counted, never listed.

Beyond Companies House, we use The Gazette's corporate and personal insolvency notices, the UK Sanctions List, the US Treasury's and the EU's sanctions lists, the Individual Insolvency Register, HMRC's list of deliberate tax defaulters and the FCA's Financial Services Register (read through the FCA's own public API at the time of each report, never copied), and France's register of companies (INPI's national register, read through the French government's API Recherche d'entreprises at the time of each report: your name and your month and year of birth are sent to it as the search, within the EEA, and only the companies whose director matches both are kept), and Norway's register of roles (the Brønnøysund Register Centre's daily file, of which we hold a reduced copy: see below); the registers and HMRC's list are published under the Open Government Licence, the US Treasury's list is a work of the US Government, the EU's list is published for reuse by the European Commission, INPI's licence allows its register to be reused, Norway's register is published under the Norwegian Licence for Open Government Data, and the Gazette's notices are Crown copyright. We hold a copy of each of the three sanctions lists, replaced each night from its publisher's file, so that a report searches a dated copy. Where a Gazette petitioner is an individual, their name is not stored or shown. An entry or notice whose name matches yours but whose birth date does not is shown as excluded; one with no birth date is shown as a shared name, not as being you (or, where its postcode is one on your officer records, as an address match, stated as such). We also hold a copy of the Charity Commission for England and Wales' register of charities and their trustees, taken from the Commission's nightly extracts and replaced each morning, so that trusteeships can be searched by name; a trustee record states no birth date or address, so a trusteeship is shown only as a possible match until the customer confirms it. We do not use credit data, court records, social media or other websites. We do not process special category data.

A report on a person also names the other officers of their companies where the same officer record appears at two or more of them: the name as the register writes it, the role and dates at each of those companies, and what became of the company. If you have held office alongside a person a customer checks, a report on them may name you in this way, as the register does, with nothing added from any other source; you have the same rights, and the same request route, as the person the report is about.

A report on a company names its officers and people with significant control as the register does. Where the company's accounts disclose transactions with another company, we read that company's officer list and register of people with significant control from Companies House to see whether one of the company's own officers or controllers is also an officer or controller of it; a person is named in the report only where they are that connection, matched on the register's own officer record or on name and month and year of birth, never on a name alone, and with nothing added from any other source.

A report, on a person or on a company, can also name people from the company filings it reads: shareholders, as a confirmation statement or annual return lists them; subscribers, who took shares when a company was formed; and creditors, as a statement of affairs lists or describes them. Each is named as the filing gives them, with nothing added from any other source. We also hold with the report the names of those entitled under a company's registered charges, as the register gives them; the report itself shows only how many charges are outstanding and how many satisfied. If you are named in one of these ways, you have the same rights, and the same request route, as the person the report is about.

Why, and on what lawful basis

We compile reports for businesses and professionals with a legitimate business interest in the person, for example before an investment, a loan, a contract or a board appointment, or in insolvency and legal work. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): our interest in providing the service, and our customers' interest in making informed decisions from the public record. We have weighed these against your interests in a legitimate interests assessment. Every customer must confirm they have a legitimate business interest before running reports.

How a report is made

The customer confirms which officer records belong to the person. We then retrieve those records and the related company filings from Companies House. Text is read from the filings, by optical character recognition where a filing is a scanned image. An AI model extracts figures from documents and drafts neutral wording from the extracted facts. Every statement in a report cites the filing it came from. Flags are raised only by fixed, published criteria; they are prompts for questions, never findings about anyone's character or conduct. We make no decisions about you, and nothing in a report is produced to judge you.

Watching

A customer that has run a report on you may ask us to watch your record for up to twelve months. Each month (or each week, if the customer chooses) we re-read the register entries the report drew on, and the Gazette copy, and tell the customer what has changed: a new or ended appointment, a change in a company's status, a filing of a kind the report reads, a petition advertised in The Gazette, an entry on the disqualified directors register, or a criterion newly met or no longer met. Nothing is downloaded from the filings and no AI model is involved; the check compares the register as it is with the register as it was. The customer is told only that there are changes and how many; the changes themselves are read after signing in. A watch ends after twelve months unless the customer starts it again, and the customer can stop it at any time. A customer may also watch a company it has a report on. If you are an officer of, or a person with significant control over, a watched company, a change in the register's entry for you (an appointment, a resignation, a notification or a cessation) is noted for the customer with the name the register gives, and the disqualified directors register is re-read for the company's current officers.

Who sees it

Only the customer organisation that ran the report. Reports and watches are never shown to other customers and never published. Our service providers, listed below, process data on our behalf. To search France's register of companies, your name and your month and year of birth are sent to the French government's API Recherche d'entreprises (run by DINUM, in France) as the search; it is told nothing else, and not who asked. To show a role in Norway, only the organisation's number is looked up in Norway's register; nothing about you is sent there.

How long we keep it

Each report, and the documents retrieved for it, is kept for the period the customer organisation has chosen (6, 12 or 24 months; 24 by default) and then deleted. A watch's checks are kept for the same period. We keep a record of which organisations ran reports on, or watched, which officer records, and when, for six years. That record is what lets us answer a request from you.

Your rights

You can ask us for a copy of what has been reported about you, when, and the kind of organisation that asked for it (a business customer carrying out due diligence). We don't name our customers unless the law or a court order requires it. You can also ask us to correct our processing, to stop using your data or to delete it, and you can object to our use of it. See how to make a request. Mistakes on the Companies House register itself can only be corrected by Companies House.

If you are on the register of people with significant control

Companies House publishes its register of people with significant control every day as one file, for anyone to reuse. We load it each day into an index. When a customer runs a report on a person, the index lets us find companies that person controls without being one of their officers. For each individual on the register, the index keeps only:

• their surname and first forename, in the simplified form we use to compare names;
• their month and year of birth, as the register shows them;
• a one-way code made from their service address, which we can compare but cannot turn back into the address;
• the company, and the register entry it came from.

Nobody can search or browse the index, including our customers. It is used only once a customer has chosen a person to report on, to propose matching entries for the customer to confirm. A report then shows only what the customer confirmed, read afresh from the register. Our lawful basis is legitimate interests, as above. Each day's copy replaces the one before, which is deleted the same day. A replaced copy can remain in our backups for up to seven days.

If you hold a role in a Norwegian organisation

Norway's Brønnøysund Register Centre publishes every role in its register of legal entities each day as one file, for anyone to reuse, and its register cannot be searched by a person's name. We load the file each day into a copy. When a customer runs a report on a person, the copy lets us find roles in Norway held by someone of the same name and month and year of birth. The copy keeps only the current roles of living people that run, own or represent an organisation (board members and the chair, the chief executive, proprietors, partners, business managers and a foreign entity's representative), and for each only:

• your name, as the register lists it;
• your month and year of birth (never the day);
• the role, and the organisation's number.

Nobody can search or browse the copy, including our customers. It is read only once a customer has chosen a person to report on, for that person's registered names and month and year of birth; a report shows a role only where both match, and counts the others without reading them. Our lawful basis is legitimate interests, as above. Each day's copy replaces the one before, which is deleted the same day. A replaced copy can remain in our backups for up to seven days.

If you use Check the Director

We use your name, email address and organisation details (name, billing address and VAT number). We also use your role, sign-in sessions, purchases and credits, and the activity record your organisation's account holder can see. Payments are taken by Stripe; we never see or store card details.

• To provide the service you signed up for, including your account, reports, billing and support: performance of our contract (Article 6(1)(b)).
• To keep financial and accounting records: legal obligation (Article 6(1)(c)).
• To keep the service secure and working, and to prevent misuse: legitimate interests (Article 6(1)(f)).

We keep account data while your account is open. Billing and credit records, and the activity record, are kept for six years. Sign-in sessions end after 30 days, or when you sign out.

If you contact us

When you send a message through our contact form, we receive your name, your email address, your organisation if you give it, what the message is about and the message itself. We use them to reply to you and to keep a record of the conversation. Our lawful basis is our legitimate interest in answering the people who write to us (Article 6(1)(f)); where you are asking about buying from us, it is also taking the steps you ask for before a contract (Article 6(1)(b)).

The message is emailed to us through Resend and kept in our database. So that the form cannot be used to flood us, we also keep, with each message, a keyed code made from the internet address it came from, not the address itself. We delete messages, with that code, twelve months after they arrive. Nothing is sent to the address you type in until we reply.

If we have written to your firm

We write to firms that may have a use for Check the Director: insolvency practitioners, solicitors, accountants, investors and lenders, and firms that appoint or recommend builders and contractors, such as letting agents, property managers, housing associations, main contractors, architects and surveyors. We use the business contact address a firm publishes on its own website, or the register entry that names it, and nothing from brokers or bought lists. Where that address names a person rather than a role, we write only where the firm itself publishes it as its business contact. The lawful basis is our legitimate interest in telling firms about the service; every message says who we are and carries an unsubscribe link, and an opt-out is honoured permanently, for the address. To stop any further message, use the link or reply to the email.

Server logs

Our web server keeps a log of each request it receives: the IP address it came from, the time, the page or file requested and the browser's identification, including requests made with an organisation's API key. We use it to run and secure the service and to see, in aggregate, how the site is used, on the basis of our legitimate interest in doing so. It is kept for 30 days and then deleted. Error reports go to Sentry (below) with technical details only.

Backups

Our hosting provider keeps copies of our whole server, including its database, so that the service can be restored after a fault. Each copy is kept for seven days and then deleted. So something we delete, whether at the end of one of the periods above or because you asked us to, can remain in a copy for up to seven days afterwards. We use the copies only to restore the service.

Our service providers

These providers process personal data for us, under data processing agreements:

• our hosting provider, which runs our servers and database;
• our object storage provider, which stores retrieved filings and report PDFs;
• Stripe, for payments and invoices;
• Resend, for sending email;
• Anthropic, whose AI model reads filings and drafts report wording. It receives filing text and the facts extracted from it;
• Sentry, for error monitoring. It is set up not to receive details of the people reports are about;
• Google, only if you choose to sign in with Google.
• Microsoft, only if you choose to sign in with Microsoft.
• your organisation's own identity provider, only if your organisation has set up single sign-on and you sign in through it. It tells us your name and work email address; it is your organisation's provider, not ours.

Some of these providers are outside the UK. Transfers are made under UK adequacy regulations or the Information Commissioner's international data transfer agreement or addendum.

Cookies

We use only the cookies needed to sign you in. See cookies.

Complaints

Please contact us first at privacy@checkthedirector.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.