Last updated: 26 July 2026

Who we are

CheckAFirm is operated by David Skillett, a UK sole operator, who is the data controller for the personal data described in this policy. You can contact us at any time at hello@checkafirm.co.uk. We are registered with the Information Commissioner’s Office under reference ZC104940.

This policy covers two quite different things: the small amount of data we collect about you, the person using the site, and the public register data we process about company directors and firms. Both are explained below.

What we collect about you

  • Search queries. The company names and company numbers you look up, and the reports you view. We use this to return your result, to cache results so the site stays fast, and to understand which checks people actually use.
  • Your email address, only if you buy a report. We need it to send you the report and your receipt, and to deal with any refund or support request afterwards. The free check does not ask for an email address and does not require an account.
  • Payment information, which we never see. Card payments are taken by Stripe on their own checkout page. Your card number never reaches our servers and we never store card details. Stripe passes us the fact that a payment succeeded, the amount, and your email address. Stripe acts as an independent controller for its own fraud prevention and regulatory purposes and publishes its own privacy policy.
  • Basic technical and usage data. Standard server information such as the pages requested and the time of the request, plus privacy-friendly aggregate analytics from Vercel Analytics, which we use to see which pages work. We do not use advertising cookies and we do not run third-party ad trackers.

We do not sell, rent or trade your personal data. We do not share it with data brokers or advertisers. Ever.

Our lawful basis

  • Performance of a contract for anything connected with a purchase: taking payment, producing and delivering the report you paid for, sending your receipt, and handling refunds.
  • Legitimate interests for running the free lookups, for keeping the service secure and working, for basic aggregate analytics, and for processing the public register data described in the next section. Our legitimate interest is in providing a transparency service that helps consumers and small businesses avoid financial loss, using information that is already published by law.
  • Legal obligation where we have to keep records of transactions for tax and accounting purposes.

Public register data about directors and firms

Some of what a report contains is personal data about identifiable people, usually company directors: names, months and years of birth as published, appointment histories, correspondence addresses as filed, disqualifications, and involvement in other companies. We also process names appearing in HSE enforcement records and in employment tribunal decisions.

We process that data under legitimate interests. All of it is published by the relevant public body under statute, and much of it is published precisely so that people dealing with a company can inform themselves before parting with money. We have considered the impact on the individuals concerned and we limit that impact in the following ways:

  • We only reproduce what the register already publishes. We do not enrich it with private data, and we do not build hidden profiles.
  • We link every item to the official source so anybody can check it and see its context.
  • We present findings as questions to ask rather than as accusations, and we say clearly when a match is based on a name alone and may be a different person.
  • We respect suppression. Where an individual has had a residential address protected or suppressed at Companies House, we do not display it, and if a source record is corrected or removed we reflect that at our next refresh.
  • Reports and register data are refreshed from source rather than frozen, so corrections at source flow through.

Your right to object

Because we rely on legitimate interests for the public register processing, you have the right to object to it. If you are named in a report and you want to object, email hello@checkafirm.co.uk with the company name or number, the page concerned, and what you want us to do. We will consider the objection properly and we will reply. Where the information is wrong or wrongly matched to you, we will correct or remove it. Where the information is accurate and is published by an official register, we may keep showing it, but we will tell you why and how we reached that decision, and we will always point you to the register that publishes it.

Your other rights

Under UK GDPR you also have the right to:

  • Ask what personal data we hold about you and get a copy.
  • Have inaccurate data corrected.
  • Ask for erasure, where there is no overriding reason for us to keep it.
  • Ask us to restrict processing while a dispute is resolved.
  • Receive data you gave us in a portable format, where that applies.
  • Withdraw consent, where we relied on consent.

Email hello@checkafirm.co.uk and we will respond within one month. There is no charge for making a request.

Who processes data on our behalf

  • Stripe processes payments and handles card data.
  • Resend sends transactional emails such as your report and receipt.
  • Vercel hosts the site and provides aggregate analytics.

These providers may process data outside the UK. Where they do, the transfer is covered by the appropriate safeguards, such as the UK International Data Transfer Addendum or the equivalent standard contractual clauses.

How long we keep things

  • Purchase records including your email address: six years after the end of the relevant tax year, because tax and accounting law requires it.
  • Reports you bought: kept so you can access them again, and deleted on request once any refund window and record keeping obligation has passed.
  • Cached register data: refreshed regularly and replaced with current data from source rather than kept indefinitely in old form.
  • Server logs and analytics: short retention, measured in months, and held in aggregate form where possible.

Cookies

We use only what the site needs to work, such as keeping your session straight during checkout. We do not use advertising or profiling cookies, and we do not sell audience data.

Children

The service is intended for adults making decisions about paying firms. It is not aimed at children and we do not knowingly collect data from them.

Complaints

If you are unhappy with how we have handled your data, please tell us first at hello@checkafirm.co.uk so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or by calling their helpline on 0303 123 1113.

Changes to this policy

If we change how we handle data we will update this page and change the date at the top. Material changes affecting people who have bought a report will also be notified by email.