Privacy Policy

This policy explains what personal information we handle when you use companysearchuk.co.uk or buy a report, why we handle it, who receives it, how long we keep it and the rights you have.

Version 1.0. Effective from 3 August 2026.

1. Who we are

Company Search UK is an Australian-operated online company information service. We operate companysearchuk.co.uk and offer UK company search and report services to customers in the United Kingdom. We are the controller of the personal information described in this policy.

Privacy enquiries and data rights requests can be sent to help@companysearchuk.co.uk.

2. Operating from outside the United Kingdom

We operate from Australia and offer our service to people in the United Kingdom, so UK data protection law applies to the processing described in this policy. Where the law requires a UK representative to be appointed, that representative’s name and contact details will be published in this section. We do not claim to be registered with the UK Information Commissioner’s Office, to be exempt from registration, or to have appointed a UK representative unless that is stated here.

You can contact us directly about any privacy matter by emailing help@companysearchuk.co.uk.

3. What we collect

Your email address, and your name if you choose to give it.
The company you select and the product you purchase.
Order records: order reference, amount, currency, payment status and timestamps.
A private order-page access token, which is the key to your order page.
The company names and company numbers you search for.
The generated report PDF and the snapshot of Companies House data used to build it.
Support correspondence, including messages sent through our contact form.
Technical information collected automatically by our infrastructure: IP address, device and browser information, requests, security events and error logs.
Payment identifiers and payment status received from Stripe.
Companies House public register information, including officers and persons with significant control.

Full payment card details are entered directly into Stripe’s payment form. They are not received or stored by Company Search UK. We receive only the payment status and Stripe’s transaction identifiers.

Where Companies House publishes only the month and year of an officer’s date of birth, that is the information we display and include in reports. We do not add a full date of birth.

We do not offer customer accounts, we do not send marketing emails, we do not sell personal information, we do not buy personal information from data brokers, and we do not use personal information for third-party advertising.

4. Why we use it and our lawful bases

Free company searches carried out before you place an order: our legitimate interests in operating a working company-search service.
Creating your order, taking payment, generating and delivering your report, and order-related support: performance of a contract with you.
Keeping accounting, tax and transaction records: compliance with a legal obligation.
Securing the service, preventing fraud and abuse, and keeping the service technically reliable: our legitimate interests.
Providing customer support and resolving complaints, refunds and disputes: our legitimate interests, alongside our contract with you.
Displaying and compiling official public-register information: our legitimate interests, and those of our customers, in access to officially published company information.

Providing an email address is necessary to enter into the contract, because it identifies your order and is how your report is made available to you. Without one we cannot supply a report.

5. Processing summary

Information	Purpose	Lawful basis	Recipients	Retention
Order and customer details: email address, optional name, company selected, product purchased, order reference, amount, currency, payment status, timestamps and a private order-page access token	Creating your order, taking payment, preparing and delivering your report, and order support	Performance of a contract	Stripe, Supabase, Lovable	6 years from the transaction date; unpaid or abandoned orders 30 days
Payment card details	Processing your payment	Performance of a contract	Stripe only	Held by Stripe under its own policy; we hold only payment identifiers and status
Stripe payment identifiers and payment status	Matching payments to orders, handling refunds and chargebacks	Performance of a contract, and legal obligations for financial records	Stripe, Supabase, Lovable	6 years from the transaction date
Search terms and company numbers you enter	Returning search results and retrieving register information	Legitimate interests in operating the company-search service before an order is placed; performance of a contract once you order	Companies House, Supabase, Lovable	Search results cached for 1 hour; company profile data cached for 24 hours
Generated report PDF and the Companies House data snapshot behind it	Delivering your report and allowing re-download and support	Performance of a contract	Supabase private storage	12 months from generation
Support correspondence and contact form messages	Answering enquiries, handling refunds and resolving complaints	Performance of a contract, and legitimate interests in running a support service	Supabase	Complaints, refunds, chargebacks and disputes: 6 years after closure
Technical logs: IP address, device and browser information, requests, security events and errors	Operating and securing the service, diagnosing faults, preventing fraud and abuse	Legitimate interests in security, reliability and abuse prevention	Lovable, Supabase, Stripe	Routine logs 90 days; security, fraud and abuse-prevention logs up to 12 months
Companies House public register information, including officers and persons with significant control	Displaying company information and compiling the report you purchase	Legitimate interests in providing access to official public-register information	Included in your report; stored with your order snapshot	Cached data 24 hours; report snapshots 12 months from generation

6. Cookies and similar technologies

Our public website uses only technologies that are strictly necessary: those needed to serve the site securely, to keep your session working, to complete checkout and to deliver your report. During checkout, Stripe sets its own strictly necessary cookies and similar technologies to process the payment and to detect and prevent fraud.

We do not currently operate analytics, advertising, pixels, fingerprinting or cross-site tracking, and no non-essential technologies load on our pages. For that reason no cookie consent banner is shown. If we later introduce any non-essential technology, we will ask for your consent before it loads, with equally prominent accept and reject options, and you will be able to change your choice at any time.

7. Who receives your information

Stripe: payment processing, fraud prevention, refunds and chargebacks.
Supabase: database, access controls, server-side functions and private file storage for report PDFs.
Lovable: website hosting and application infrastructure, including request and error logging.
Companies House: receives the company name or number you search for so that register information can be returned. It does not receive your identity or contact details.
Professional advisers, courts, law enforcement and regulators, where disclosure is legally required or permitted.

We do not currently use a transactional email provider. Your report is made available through your private order page rather than sent as an email attachment. If we introduce email delivery, this policy will be updated to name the provider.

8. Companies House public register information

Company profiles and reports include information taken from the Companies House public register. That information can include officers and persons with significant control. We do not control or alter the official register, and we cannot amend it.

We use register information only to display it and to compile purchased reports. We do not use it for marketing, personal profiling, scoring or automated eligibility decisions.

If you are named in register information shown by our service, you can contact us at help@companysearchuk.co.uk and we will consider your request. Corrections to the official source must be requested through Companies House or the company concerned. Once the register is corrected, the correction appears the next time we retrieve the information. Public availability of the register does not remove your data protection rights.

Reports that a customer has already lawfully downloaded are held by that customer. We cannot retrieve or alter copies that are already in a customer’s possession.

9. International transfers

We operate from Australia. Our providers may process information in Australia, the United Kingdom, the European Economic Area, the United States or other locations disclosed by those providers. Personal information relating to UK customers is therefore accessed and stored outside the United Kingdom.

Where a restricted transfer takes place, it is protected using UK adequacy regulations where they apply, or otherwise by approved contractual safeguards offered by the relevant provider, together with technical and organisational measures such as encryption in transit and access controls. You can ask for further information about the safeguards that apply to a particular provider by emailing help@companysearchuk.co.uk.

10. How long we keep information

Completed order and transaction records: 6 years from the transaction date.
Report PDFs and the related Companies House snapshot: 12 months from generation.
Private order-page access tokens: invalidated after 1 month, in line with the 30-day report access period.
Unpaid or abandoned orders: 30 days.
Routine technical logs: 90 days.
Security, fraud and abuse-prevention logs: up to 12 months where reasonably necessary.
Complaints, refunds, chargebacks and disputes: 6 years after the matter is closed.
Backups: removed through normal backup rotation within 30 days after the live record reaches the end of its retention period.

These periods are the retention periods we apply. Deletion at the end of a period is carried out by us as part of periodic review rather than by an automatic process, so a short delay is possible. Information may be kept for longer where it is needed for an active legal obligation, dispute, fraud investigation or legal claim, and its use is then limited to that purpose.

11. Security

Information is transmitted over encrypted connections and stored with access controls that limit who can reach order records. Report files are held in private storage and are released only through short-lived signed download links issued from an order page that requires your order reference and private access token.

Anyone holding your private order-page link can reach your report, so please keep that link confidential. No online service can be completely secure, and we cannot guarantee absolute security.

12. Your rights

Subject to the conditions and exemptions in data protection law, you have the right to:

Access a copy of the personal information we hold about you.
Have inaccurate personal information corrected.
Request erasure.
Request restriction of processing.
Object to processing based on legitimate interests.
Receive certain information in a portable format, where that right applies.
Withdraw consent at any time, where processing is based on consent.

Email help@companysearchuk.co.uk to make a request. We may ask for information to verify your identity. We normally respond within one month. Where a request is complex or where several requests are made, that period may be extended by up to two further months, and we will tell you if that happens and why.

Where you ask us to delete information, we will delete what is no longer required, though transaction records may still be kept where necessary for tax, accounting, fraud prevention or legal claims.

Customers, and people named in Companies House records shown by our service, may complain to the UK Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. You do not have to contact us first, although we are glad to try to resolve matters directly.

13. Automated decision-making and children

Reports are compiled automatically from register data, but this is not automated decision-making that produces legal or similarly significant effects on any person. We do not profile individuals or make automated eligibility decisions.

Our service is not directed at children and we do not knowingly collect information from anyone under 18. If you believe a child has provided information to us, contact help@companysearchuk.co.uk and we will delete it.

14. Links to other websites

Our website links to third-party sites, including Companies House. We are not responsible for their content or privacy practices, and this policy does not apply to them.

15. Changes to this policy

We may update this policy to reflect changes in our service, providers or the law. The version number and effective date at the top of this page always show the current version. Where a change is significant we will make that clear on the website.