Registrum Limited, a company registered in England & Wales, no. 17335572, registered office 38 Chaucer Road, London E11 2RE ("we", "us"). We are the data controller for personal data collected through registrum.co.uk and the Registrum API, and for the Companies House register data we republish (section 3). ICO registration number ZC284753. Contact: support@registrum.co.uk
2. Data we collect
Email address - collected when you request an API key. Used to deliver your key and send service notifications.
API usage logs - endpoint called, timestamp, response time, company number looked up, whether the result was cached. Used for rate limiting, billing, and service improvement.
Report purchasers - if you buy a report, we collect your email address and the company you ordered. Payment is taken by Stripe; we receive the payment confirmation and your email, not your card details. We email you the report and keep a record of the order.
IP addresses - logged by our infrastructure for security and abuse prevention. Retained for 30 days.
3. If you are a director, other officer or person with significant control
If you are, or have been, a director, other officer or person with significant control (PSC) of a UK company, we may process information about you that Companies House publishes on its public register. This section is our notice to you under Article 14 of the UK GDPR, because you did not give the information to us directly.
Source - the Companies House public register only. We do not obtain information about you from anywhere else.
What we process - for officers: name, role, appointment and resignation dates, your other appointments, and the month and year of birth, nationality and occupation recorded on the register. For PSCs: name, the nature of control, notification and cessation dates, identity-verification status, and the month and year of birth, nationality, country of residence and service address recorded on the register.
Where it appears - our company pages show names, roles, appointment dates, current other appointments and, for PSCs, the nature of control. We never show month and year of birth or nationality on our web pages. The fuller data is supplied through our API, paid reports and our MCP server for AI assistants. We never process a day of birth or a usual residential address: Companies House does not publish them.
Purpose and lawful basis - legitimate interests (Article 6(1)(f)): letting businesses, lenders, compliance professionals and the public see who runs and controls a company they deal with, and which other companies those people are involved in. This is the purpose for which the register is public.
Recipients - visitors to our website, our API customers, buyers of our reports, and users of AI assistants connected to our MCP server.
Retention - our copy is refreshed from Companies House on a 30-day cycle, so changes on the register (a resignation, a dissolution) reach us within that period.
Accuracy - if anything we show differs from the Companies House register, or presents a past appointment as current, tell us and we will correct it for everyone. Errors in the register itself must be corrected with Companies House.
Your right to object - you have the right to object to this processing on grounds relating to your particular situation (Article 21(1)), for example a risk to your safety. Email us with those grounds and we will assess them individually and reply within one month. You also have the rights listed in section 8.
4. Data we do NOT collect
We do not collect payment card details (handled entirely by Stripe). We do not track visitors with advertising cookies or share data with ad networks. Looking up a company does not tell us anything about you beyond the usage log described in section 2.
5. Legal basis for processing
We process your email and usage data under contract (to provide the API service you requested) and legitimate interests (to prevent abuse and improve the service).
6. Data retention
Email addresses and API keys: retained while your account is active, deleted within 30 days of account closure on request.
Usage logs: retained for 12 months, then deleted.
IP address logs: retained for 30 days.
7. Third-party processors
Supabase - Database (API keys, usage logs, cached Companies House data). EU (Ireland).
Railway - API hosting. EU (Frankfurt).
Vercel - Website hosting. Global CDN.
Stripe - Payment processing (subscriptions and report purchases). EU / US.
Anthropic - Writes the plain-English verdict in paid reports from the report's company data. US.
Cloudflare - DNS and email routing for registrum.co.uk. Global.
Google Workspace - Support mailbox where customer emails and data subject requests arrive. US / EU.
Telegram - Internal operational alerts to our team (can include a buyer's email address). Global.
Better Stack - Uptime monitoring (receives no customer personal data). EU.
International transfers
Some sub-processors are based in, or can access data from, the United States or elsewhere outside the UK. We rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US providers, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in the provider's data processing terms.
8. Your rights (UK GDPR)
You have the right to access, correct, or delete your personal data; to restrict or object to processing; and to data portability. To exercise any right, email support@registrum.co.uk. We will respond within one month. You also have the right to lodge a complaint with the ICO at ico.org.uk.
9. Cookies
We do not use advertising cookies and we do not share cookie data with ad networks. We set the cookies below. One of them, reg_attr, is not strictly necessary: it is a first-party cookie that records the page you landed on and the site that referred you, for 90 days, so we can measure which channels bring customers. It is used only for these statistics, and its identifier is passed to Stripe as checkout metadata if you buy, so we can tie a payment back to the page that produced it. You can turn it off below, and we also honour Global Privacy Control and Do Not Track signals without any click. Nothing else on the site depends on it.
dash_session - Keeps you signed in to your dashboard. 7 days. Essential.
wsid - Identifies your Web plan subscription after checkout. 1 year. Essential.
reg_attr - Records the page and referring site of your first visit so we can tell which channels bring customers; first-party, never shared with ad networks. 90 days.
reg_attr_optout - Remembers that you turned off reg_attr. 1 year. Essential.
10. Changes to this policy
Material changes will be notified by email to registered users at least 14 days before taking effect.