PRIVACY POLICY
Last updated August 2026
This Privacy Notice for Company Watcher ("we", "us", "our") describes how and why we process personal information in connection with our services (the "Services"): the Platform at companywatcher.co.uk (our account-based search, save and tracking service) and our Data Packs, pre-built CSV files sold via Payhip.
Questions or concerns? Contact us at hello@companywatcher.co.uk.
SUMMARY OF KEY POINTS
What personal information do we process? (1) Account data you provide when you register for the Platform — your email address, hashed password/authentication credentials, and account/alert preferences; (2) usage data associated with your account, such as companies you save or track and search activity within your account; (3) company data from Companies House — we only store PSCs that are themselves companies, not individuals; (4) if you purchase a Data Pack or make a voluntary contribution via Buy Me a Coffee, your name/email and any message you leave, visible to us via our seller/supporter dashboards for support and acknowledgment purposes — we do not see or store your payment card data.
Do we process any sensitive personal information? No.
Do we collect information from third parties? Yes — company and officer/PSC data from Companies House, the UK's public register.
Do we use cookies or analytics? We use cookies strictly necessary to keep you logged in to the Platform. We do not currently use any analytics or tracking cookies. If this changes, we will update this notice in advance.
What are your rights? If you hold an account with us or have purchased a Data Pack, you have rights under UK GDPR and the Data (Use and Access) Act 2025, including rights of access, rectification, erasure, restriction, and objection, as set out below.
TABLE OF CONTENTS
- What Personal Data Do We Process, and Why?
- What Legal Basis Do We Rely On?
- With Whom Do We Share Personal Data?
- International Data Transfers
- How Long Do We Keep Personal Data?
- How Do We Keep Personal Data Safe?
- Do We Collect Information From Minors?
- What Are Your Privacy Rights?
- Data Subject Requests
- Complaints Procedure
- Cookies and Analytics
- Do We Make Updates to This Notice?
- How Can You Contact Us?
- Governing Law and Jurisdiction
1. WHAT PERSONAL DATA DO WE PROCESS, AND WHY?
Account data (the Platform)
When you register for a Platform account, we collect your business email address and an authentication credential (managed via our authentication provider, Supabase — passwords are hashed and are never visible to us in plain text). We use this to create and secure your account, let you log in, and communicate with you about your account.
Once registered, we process data generated by your use of the Platform, including: companies you search for, save, or track; your alert preferences; and any saved lists or notes you create. We use this data solely to provide the Platform's functionality to you (for example, sending you the daily email alerts you have opted into) and to maintain and improve the Service.
We also process limited technical/log data (such as IP address and timestamps) for security, fraud-prevention, and troubleshooting purposes.
Company officer and PSC data
We only screen for corporate PSCs — persons with significant control that are themselves companies, not individuals — which we use to power the Platform's ownership-tree and family-group discovery features. This reflects relationships between companies, not personal data about individuals.
Officer and PSC data reflects what is filed with Companies House and is not independently verified by us. If it is inaccurate on the Companies House register, it will be inaccurate here.
Feedback
If you submit feedback via our in-Platform feedback widget or by email, we process the content of that feedback and your associated account/email address to review and respond to it.
Location data for search
We use postcode.io, a UK postcode lookup service, to convert company registered postcodes into geographic coordinates to power location-based search. This uses company address data already published on the Companies House register, not data specific to you as a user.
Data Pack purchases
When you purchase a Data Pack via our Payhip storefront, your payment card data is collected and processed directly by Payhip and Stripe; we never receive or store it. However, as the seller, we can see your order details — including your email address — via our Payhip seller dashboard. We use this only to provide customer support, process refund requests, and prevent fraud in connection with your order. We do not use it for marketing. See Payhip's Privacy Policy (payhip.com/privacy) and Stripe's Privacy Policy (stripe.com/gb/privacy) for how they separately process your data.
We process your order email address under UK GDPR Article 6(1)(b) (necessary to fulfil and support your purchase) and, for fraud-prevention purposes, Article 6(1)(f) (legitimate interests). We retain order email addresses for up to 2 years from the date of purchase, or longer where needed to resolve an active dispute or refund request.
Buy Me a Coffee
We also link to a Buy Me a Coffee page for optional, voluntary support of Company Watcher. If you make a contribution, Buy Me a Coffee processes your payment directly; we never receive or store your payment card data. However, we can see your name, email address, and any message you choose to leave, via our Buy Me a Coffee dashboard. We use this only to acknowledge your support and respond to any message you leave — we do not use it for marketing. See Buy Me a Coffee's Privacy Policy (buymeacoffee.com/privacy) for how they separately process your data.
A contribution is a voluntary gift, not a purchase of the Platform or a Data Pack, and does not create any service entitlement. We process this data under UK GDPR Article 6(1)(f) (legitimate interests in acknowledging support and preventing fraud) and retain it for up to 2 years, consistent with our other order-related data.
2. WHAT LEGAL BASIS DO WE RELY ON?
Contract. We process your account data (email, credentials, saved companies, alert preferences) under UK GDPR Article 6(1)(b), as necessary to provide the Platform service you have signed up for.
Legitimate Interests. We rely on Article 6(1)(f) to screen officer and PSC data against US and Canada connections, and to store corporate PSC data to power ownership-tree features. We have assessed that this does not override individuals' rights and freedoms, given that: (i) the underlying data is publicly registered and legally published by Companies House; (ii) individual director/PSC data is used only for screening and is not retained or displayed; and (iii) it is used to power B2B research tools, not consumer marketing. This is further supported by Section 107 of the Data (Use and Access) Act 2025.
We also rely on legitimate interests for technical/log data processed for security and fraud prevention.
Legal Obligations. We may process personal data where necessary to comply with our legal obligations, cooperate with a law enforcement or regulatory body, exercise or defend our legal rights, or as evidence in litigation.
4. INTERNATIONAL DATA TRANSFERS
Resend, Stripe, and Buy Me a Coffee are based in the United States. Transfers of personal data to these providers are protected by Standard Contractual Clauses, including the UK International Data Transfer Addendum issued by the Information Commissioner. All other processors listed in Section 3 store and process data within the UK or EEA.
5. HOW LONG DO WE KEEP PERSONAL DATA?
We retain your account data for as long as your account remains active. If you close your account, we will delete or anonymise your account data within 30 days, except where we are required or permitted to retain it for legal, security, tax, or fraud-prevention purposes. Email correspondence with us (for example, support or feedback emails) is retained for up to 2 years. If we introduce paid subscriptions, billing and transaction records will be retained for 7 years in line with HMRC requirements.
Corporate PSC data sourced from Companies House is retained and refreshed for as long as we operate the Platform, reflecting the ongoing public register. Individual director and PSC data is not retained beyond the US/Canada screening check described in Section 1.
6. HOW DO WE KEEP PERSONAL DATA SAFE?
We have implemented appropriate technical and organisational measures, including multi-factor authentication on administrative systems, encryption of data in transit, database access controls, and restriction of production system access to a single operator. In the event of a personal data breach likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, where required by law. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay.
7. DO WE COLLECT INFORMATION FROM MINORS?
We do not knowingly collect data from or about individuals under 18. Our Services are directed exclusively at businesses and professionals, and Platform accounts must be registered by an individual acting in a business capacity.
8. WHAT ARE YOUR PRIVACY RIGHTS?
If you hold a Platform account or have purchased a Data Pack, you have the following rights under UK GDPR, subject to applicable exemptions: the right to access your personal data; the right to rectification of inaccurate data; the right to erasure in certain circumstances; the right to restrict processing; the right to object to processing based on legitimate interests; and the right to data portability, where applicable to data processed under contract.
Individual director and PSC data is used only for the US/Canada screening described in Section 1 and is not retained, so there is no ongoing processing of that data to object to. If you are a corporate PSC and wish to raise a query about how we display your company's PSC relationship, contact us using the details below; note that we cannot alter or suppress the underlying Companies House public register itself, which is maintained independently by Companies House.
If you are located in the UK, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. If you are in the EEA, you may lodge a complaint with your local supervisory authority.
9. DATA SUBJECT REQUESTS
To exercise any of the rights above, contact us at hello@companywatcher.co.uk with the subject line "Data Subject Request." We will respond within one calendar month. We may extend this by a further two months for complex requests, and will explain why if so. In accordance with Section 78 of the Data (Use and Access) Act 2025, our obligation to respond to a request is limited to what is reasonable and proportionate having regard to its nature and complexity and any previous requests from the same individual. We reserve the right to charge a reasonable fee or decline requests that are vexatious or excessive, in accordance with UK GDPR.
10. COMPLAINTS PROCEDURE
To raise a complaint about our processing of personal data, contact us at hello@companywatcher.co.uk with the subject line "Privacy Complaint." We will acknowledge receipt promptly, investigate, and provide a substantive response without undue delay. This procedure is intended to satisfy the statutory complaints-handling obligation introduced by Section 103 of the Data (Use and Access) Act 2025.
12. DO WE MAKE UPDATES TO THIS NOTICE?
Yes. We will update this notice as necessary to reflect changes to our processing activities or to stay compliant with applicable law. The updated version will be indicated by a new "Last updated" date above. Where changes are material, we will take reasonable steps to notify account holders (for example, by email or an in-Platform notice).
13. HOW CAN YOU CONTACT US?
Email us at hello@companywatcher.co.uk.
14. GOVERNING LAW AND JURISDICTION
This Privacy Notice and any dispute or claim arising out of or in connection with it are governed by and construed in accordance with the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction over any such dispute or claim.
Our Services are intended for use by businesses based in the United Kingdom. We do not target users in the United States of America, Canada, or any other jurisdiction where providing the Services would require additional regulatory approvals or compliance obligations.