Privacy
Privacy notice
This notice explains what personal data SafeToPay collects, why, how long we keep it and what your rights are under UK GDPR and the Data Protection Act 2018. It covers people who use the service and people who appear in reports (directors and owners of companies, whose details come from public registers).
1. Who is responsible
The data controller is Continox Ltd (company no. 09967278), trading as SafeToPay, registered office as shown in the footer. Contact for privacy matters: privacy@safetopay.co.uk.
2. People who use the service
What we collect
| Data | When | Why (purpose) | Lawful basis |
|---|---|---|---|
| Website address you check; the report produced | Every check | To run the check and show you the report | Contract (free service you request) |
| IP address; browser type | Every check | Daily free-check limits; abuse prevention; security | Legitimate interests |
| Email address (if you ask to be emailed a report) | When given | To send the report; to limit free checks per person | Contract |
| Account: email, name (optional), password (hashed), Google sign-in identifier | When you create an account | To keep your reports, apply your daily limit and credits | Contract |
| Payment: what you bought, when, amount; payment reference | When you buy a report | To unlock the report; accounting; refunds | Contract; legal obligation (tax records) |
| Messages you send us | When you write | To reply | Legitimate interests |
We do not see or store card numbers. Payments are processed by our payment provider, which handles card data under its own privacy notice.
How long we keep it
- Reports and the website address checked: 12 months from the check, then deleted or anonymised for aggregate statistics.
- IP addresses: 30 days (limits and security), then deleted.
- Account data: while the account exists and for 12 months after it is closed.
- Payment records: 6 years (HMRC requirement).
- Correspondence: 2 years.
Who we share it with
Only processors who help us run the service, under contract: our hosting and application platform, our payment provider, our email provider, and Google (for Business profile data requested by the service; Google does not receive your identity). We do not sell personal data, and we do not share who checked which business with the business concerned.
3. People who appear in reports
Reports include the names of company directors and persons with significant control as published by Companies House, together with the roles, dates and other appointments the register shows. This is public data published under the Companies Act 2006 for the purpose of transparency about who controls companies. We process it in our legitimate interest and yours as a consumer: knowing who you are about to pay. We do not add private information about individuals, we do not publish residential addresses beyond what the register shows as a service address, and we do not profile individuals.
If you are a director and believe a report shows a fact about you incorrectly, use the correction form. Facts that are correctly copied from the register can only be changed at Companies House.
4. Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to processing based on legitimate interests, ask us to restrict processing, and take your data elsewhere. Write to privacy@safetopay.co.uk; we reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk.
5. Cookies and analytics
We use strictly necessary cookies (session, security, remembering reports you ran before creating an account). Details and any analytics we use are on the cookies page.
6. International transfers
Some processors store data outside the UK. Where they do, transfers rely on the UK International Data Transfer Agreement or adequacy regulations.
7. Changes
We will post changes here with a new version number and effective date. Material changes will be announced to account holders by email.