Privacy Policy
Last updated: 19 October 2026
UK Company Intelligence is a product of Rapid Agentic Development Ltd, a company registered in England and Wales (company number 17458231, registered office 181 Coniscliffe Road, Darlington, England, DL3 8DE) ("we", "us", "our"), which is the data controller for the personal data described in this policy. This policy explains how we collect, use, store, and share information in connection with our website and services at ukcompanyintel.co.uk (the "Service").
We are registered with the Information Commissioner's Office (registration number ZC248420). For any privacy matter, email legal@rapidagenticdevelopment.com or use our contact form.
If you are named in information this Service holds and you believe it is wrong, you can ask us to correct it without creating an account — report an inaccuracy or request a correction.
1. Who This Policy Is For
This policy covers two groups of people:
- (A) Our customers and website users — people who create an account, contact us, or use the Service. Sections 2–10 apply to you.
- (B) Individuals named in public records that the Service processes — for example company directors, secretaries and other officers, persons with significant control, and other individuals whose details appear in official public registers we draw on. If information about you appears in the Service because you are (or were) an officer or a person with significant control of a UK company or are named in a relevant public record, Section 6 is written for you. We did not obtain your information from you directly; Section 6 gives the transparency information required by Article 14 of the UK GDPR.
2. Information We Collect (customers)
2.1 Account Information
When you register we collect your email address and a hashed password. You may optionally provide a display name.
2.2 Usage Data
We automatically record:
- IP address, browser type, and operating system
- Pages visited, features used, and timestamps
- Companies you search for, track, and analyse
2.3 Company and Public-Record Information
When you use the Service, we retrieve and process publicly available information about UK companies — principally filings, accounts and register data from Companies House. This information includes personal data about identifiable individuals — for example the names, roles, partial dates of birth, nationalities and correspondence or registered-office addresses of company directors, secretaries and other officers, persons with significant control (their names, the nature of their control and the dates it was notified or ceased), and (where relevant) other individuals named in the records. We process this information to provide the Service's company-intelligence, analysis, reporting and due-diligence features. How we handle the personal data of those individuals, and their rights, are set out in Section 6.
3. Legal Basis for Processing (UK GDPR Art. 6)
| Purpose | Legal Basis |
|---|---|
| Providing and maintaining the Service for you | Performance of contract (Art. 6(1)(b)) |
| Account security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Protecting our sign-up, sign-in, password-reset, contact and correction-request forms from automated abuse (Google reCAPTCHA — Section 7) | Legitimate interest (Art. 6(1)(f)) |
| Sending transactional emails (e.g. password resets) | Performance of contract (Art. 6(1)(b)) |
| Responding to your contact-form enquiries | Legitimate interest (Art. 6(1)(f)) |
| Improving the Service and fixing bugs | Legitimate interest (Art. 6(1)(f)) |
| Processing personal data of directors, officers and other individuals named in public records, to provide company-intelligence and due-diligence features | Legitimate interest (Art. 6(1)(f)) — see Section 6 |
Where we rely on legitimate interests, we have carried out a balancing assessment weighing our and our customers' interests against the rights of the individuals concerned, and you have the right to object (Sections 6 and 8).
4. How We Use Your Information
- To create and manage your account
- To retrieve, analyse, and present company and public-record information you request
- To identify and present company officers, persons with significant control and related public-record information
- To generate AI-powered interpretations of financial filings (where enabled), which may reference individuals named in those filings
- To send you service-related communications
- To enforce our Terms & Conditions and prevent misuse
- To improve, maintain, and secure the Service
5. Data Retention (customer data)
We retain your account data for as long as your account is active. Different categories of data are kept for different lengths of time, after which they are automatically purged by scheduled retention jobs:
| Category | Retention | Lawful basis |
|---|---|---|
| Account profile (email, hashed password, display name) | Lifetime of the account | Performance of contract |
| Security & anti-abuse audit (IP, user-agent, request log) | 90 days | Legitimate interest |
| AI job audit (user id, AI provider, cost, errors) | Personal fields (user id, email, error details) are anonymised after 90 days; the remaining non-personal record (AI provider, token usage, cost, provider reference) is retained for supplier-cost reconciliation for up to 6 years, then deleted. On account erasure the row is deleted outright. | Legitimate interest |
| Contact-form submissions | 180 days | Legitimate interest |
| Organisation invitations (after accepted, revoked, or expired) | 90 days after resolution | Performance of contract |
| Outgoing email queue (transactional emails) | Recipient details scrubbed after 48 hours; row deleted after 90 days | Legitimate interest |
| Paid purchase records (Deep Dive, etc.) | 6 years (UK HMRC requirement). On erasure, your identity is pseudonymised but the financial record is preserved. | Legal obligation |
| Report runs & verification records (organisation-owned) | Durable. On erasure, your user reference is removed; the underlying report content is owned by the organisation and survives. | Performance of contract |
| Server log files (Serilog rolling file sink) | 90 days | Legitimate interest |
| GDPR-compliance evidence log (records of deletion and export actions — no personal data, only counts and entity types) | 365 days | Legal obligation |
Your IP address is used only for the 90-day security audit window — never for advertising, profiling, or analytics.
Account closure. When you request account deletion, your account enters a 7-day cooling-off period during which you can cancel. After the cooling-off window expires, an automated job runs the per-category erasure handlers above and removes your account row. Data we are required to keep (paid-purchase records under HMRC law, items still inside their security-audit window) is left in place until its statutory or operational retention period ends, at which point it is also purged.
Retention of public-record information (about individuals named in public registers) is described in Section 6.
6. Individuals Named in Public Records (Article 14 information)
This section is for group (B) in Section 1 — for example if you are, or were, a director, secretary or other officer of a UK company, or are otherwise named in a public record the Service processes.
What we process. Information that already appears about you in official public registers — principally your name, role and appointment dates, the company or companies you are associated with, your partial date of birth, nationality, and correspondence or registered-office address as filed. We also generate derived analysis (including AI-assisted commentary) about the companies you are associated with, which may reference you where you are named in a filing.
Where we obtain it. From official and public sources. Today this is principally Companies House (the register of companies and their officers). Additional public sources may be used for the screening features described below, once those features are active.
Why we process it (purpose and lawful basis). To provide business-intelligence and due-diligence tools that help our customers assess companies and the people associated with them — a legitimate interest under Art. 6(1)(f). We process only information that is already in the public domain for this purpose, present it with its source, and apply the safeguards in this section.
We did not obtain your data from you. Because your information comes from public records rather than from you, we give you this notice under Article 14 of the UK GDPR. This policy, published on our website, is the means by which we provide that information; if you contact us we will also respond directly.
Accuracy, retention and keeping information current. We aim to reflect the public record accurately. We retain public-record information only for as long as necessary to provide the Service and to keep a reliable, evidenced record; where an official source corrects, updates or removes an entry, we update or remove the corresponding information accordingly. If you believe anything we hold or present about you is inaccurate, out of date, or unfairly presented, you can ask us to correct or remove it (see "Your rights" below), and we will investigate.
Your rights. You have the rights in Section 8 in respect of your information, including to access what we hold about you, to ask us to correct it, to object to our processing on the legitimate-interests basis, and to ask us to remove it. To exercise them, email legal@rapidagenticdevelopment.com or use our contact form; describe the report, company or record concerned and what you believe is wrong. We will acknowledge your request, may ask for enough information to confirm your identity and locate the record, and will respond within one month. Where a request concerns a live report that may contain a materially inaccurate statement about you, we can suspend the disputed content while we investigate.
Screening features (introduced progressively). The Service is being extended with features that compare companies and named individuals against additional official lists — for example sanctions lists, the register of disqualified directors, personal-insolvency notices, and tax-related lists published by HMRC. Before we activate any feature that screens a named individual against such a list, we complete a data-protection assessment for that feature and update this policy to describe it. Any match the Service surfaces is similarity-based and provided as an investigative lead, not a confirmed identification or an assertion of wrongdoing; matches must be verified against the official source before being relied on.
7. Data Sharing and Transfers
We do not sell your personal data. We may share data with:
- Companies House — API requests to retrieve public filing data.
- AI providers — to generate interpretations of financial filings. We do not send your account details (such as your name or email) to AI providers. However, the filing content we send may itself contain personal data of individuals named in the filing (for example directors or the signing auditor); those providers act as our processors under contract and process it only to generate the analysis we request.
- Infrastructure providers — hosting, email delivery, and database services. Where data is transferred outside the UK/EEA, we rely on appropriate safeguards (UK International Data Transfer Agreement or Standard Contractual Clauses).
- Stripe — payment processing for paid plans and one-off purchases. Card details are entered directly into Stripe's secure form; we never see or store your card number.
- Google (reCAPTCHA) — to protect our forms from automated abuse. The pages for creating an account, resetting a password, resending a confirmation email, contacting us and requesting a correction use Google reCAPTCHA v3, which runs in the background without a puzzle. On the sign-in page it is used only after repeated failed sign-in attempts from your device or network. Google's script collects information about your device and browser and how you interact with the page (for example your IP address, browser and device details, and cookies Google has already set in your browser) and sends it to Google. When you submit the form, we send Google the result and your IP address, and Google tells us how likely the submission is to come from a person rather than an automated program. We use that only to decide whether to accept the submission; refused checks are noted in our security logs. Google processes this information under its own Privacy Policy and Terms of Service, and may do so outside the UK, including in the United States.
- Law enforcement — only where required by law or valid legal process.
Cross-customer caching of AI interpretations. Because Companies House filings are public records, the AI-generated interpretation of a given filing is the same regardless of who requested it. We cache these interpretations and may serve a cached result to another customer who later analyses the same filing, to avoid reprocessing public data and keep costs down. The cache stores the public filing reference, the model parameters, and the AI's analysis of that public filing. That analysis is derived solely from public records but may reference individuals named in the filing (for example directors). It does not contain any of your account information and does not record which customer requested it. Personal data within a cached analysis is subject to the same rights and correction process as the rest of the Service (Sections 6 and 8).
8. Your Rights (UK GDPR)
Under the UK GDPR and the Data Protection Act 2018 you have the right to access & portability, rectification, erasure, restriction, and objection.
If you are a customer, the fastest routes are self-serve:
- Access & Portability — sign in and use Account › Data Export to generate a ZIP archive containing one file per data category. You'll receive an email when it's ready to download.
- Rectification — most fields are editable directly on your settings pages; for anything not editable in the UI, contact us using the address below.
- Erasure — sign in and use Account › Delete Account. Your account enters a 7-day cooling-off period (during which you can cancel via a link emailed to you); after that, an automated job purges or pseudonymises your data per category, as described in Section 5.
- Restriction / Objection, or anything the self-serve tools don't cover — email the address below.
If your information appears in the Service because you are named in a public record (Section 6), email legal@rapidagenticdevelopment.com or use our contact form to exercise any of these rights, including to correct or remove information about you or to object to our processing.
We respond to rights requests within one month (extendable by up to two further months for complex requests, with notice). Where we rely on legitimate interests, we will stop the processing on objection unless we can show compelling legitimate grounds, which we will explain to you.
Evidence of compliance. Every deletion, pseudonymisation, and data-export action is recorded in an internal audit log (containing only counts and entity types, no personal data) so we can demonstrate to the Information Commissioner's Office that your request was carried out. The log itself is kept for 365 days.
9. Cookies
We use strictly necessary cookies to maintain your authenticated session. We do not use tracking, advertising, or analytics cookies. Because these cookies are essential for the Service to function, consent is not required under the UK PECR.
The pages that use Google reCAPTCHA (Section 7) also load Google's script, which sets a
cookie of its own (_GRECAPTCHA) and can read cookies Google has already placed in
your browser, so that it can tell people apart from automated programs. We use it only to
protect those forms from abuse, not for tracking, advertising or analytics, and treat it as
strictly necessary for that purpose. Ordinary sign-ins do not load it.
10. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted connections (TLS), hashed passwords, role-based access controls, and regular security reviews. No system is 100% secure; if you discover a vulnerability, please report it to legal@rapidagenticdevelopment.com.
11. Children
The Service is not intended for individuals under 18. We do not knowingly collect personal data from children. If we learn that we have collected data from a child, we will delete it promptly.
12. Changes to This Policy
We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. Minor changes, such as clarifications and corrections, take effect when we publish them. If we change how we use your personal data in a way that matters to you — for example, using it for a new purpose — we will tell account holders by email or with a notice on the Service before the change takes effect.
13. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) — though we'd welcome the chance to resolve it first:
- Website: ico.org.uk
- Helpline: 0303 123 1113
14. Contact
For any privacy-related questions, email legal@rapidagenticdevelopment.com or use our contact form.
You can also write to us at Rapid Agentic Development Ltd, 181 Coniscliffe Road, Darlington, England, DL3 8DE.