Privacy Policy

About This Business is operated by [COMPANY LEGAL NAME] (company number [COMPANY NUMBER]), registered at [REGISTERED ADDRESS]. We are the data controller for the personal data described here. Our ICO registration number is [ICO REGISTRATION NUMBER].

• Account data for business owners: name, email address, sign-in details and the businesses you are connected to.
• Draft profile content: the facts, wording, images and photos of people you add to a private Business DNA draft, including any consent records you give for people's photos.
• Evidence links: links and notes you provide to support individual facts, and staff review notes about them.
• Domain-control check data: DNS challenge tokens and, if you use Google Search Console, a record of whether your account is a site owner for the website. We do not keep your Google access token after the check.
• Analytics and cookies: basic, aggregated information about how pages are used. See "Cookies" below.
• Server logs: IP address, browser type, pages requested and time of request, used for security and fault-finding.
• Developer interest form: name, email, organisation and message, if you register interest on the Developers page.

• Contract: account data, draft content and evidence links, so we can provide the service you signed up for.
• Legitimate interests: domain-control checks, server logs and security, preventing impersonation and keeping the record accurate.
• Consent: non-essential cookies and analytics, where used, and the developer interest form. You can withdraw consent at any time.
• Legal obligation: records we must keep for tax, accounting or regulatory reasons.

Drafts are private. When a Business DNA record is published, the facts approved for publication become public on a web page, in structured data and in a public JSON file. They can be read, copied and indexed by anyone, including search engines and AI assistants. We cannot control how third parties store or reuse public information, and we do not promise that any search engine or AI system will index or cite a record.

Home addresses are never published; home-based businesses are shown at town level only. Each fact shows its own status: "Authenticated by KwikChex", "Company-provided — unauthenticated", "Awaiting KwikChex authentication", "Information pending", "Not applicable" or "Expired". No status means the business as a whole is authenticated or safe.

We use these service providers, under contracts that require them to protect your data:

• Hosting: [HOSTING PROVIDER], which serves the website.
• Database and authentication: Supabase, which stores accounts, drafts and published records and handles sign-in, including Google sign-in where you choose it.
• Payments: [PAYMENT PROVIDER], if and when paid subscriptions are taken online. We do not store card details.
• AI writing assistance: an AI model provider, used only when you click to request writing help. It receives the company statements shown on screen, not evidence excerpts or sensitive personal details.
• KwikChex: KwikChex staff authenticate individual facts and see the facts and evidence needed to do so.
• Mapping and official sources: OpenStreetMap's geocoding service receives a town or business address to place it on a map; Companies House receives company numbers or names for record checks.

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.

• Account and draft data: while your account is active and for [ACCOUNT RETENTION PERIOD] afterwards.
• Server logs: [SERVER LOG RETENTION PERIOD].
• Published records and their dated change history: while the record is published. Removing a record takes it off the site, but copies made by third parties may remain.
• Financial records: as long as UK law requires (normally six years).

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have data erased in certain circumstances;
• restrict how we use it;
• object to processing based on legitimate interests;
• receive data you gave us in a portable format (portability);
• withdraw consent at any time, where we rely on consent.

We will respond within one month. Business facts are corrected through the business owner's account, and changes are reviewed before publication.

If you are unhappy with how we handle your data, please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

We use strictly necessary cookies and browser storage to keep you signed in and to save private drafts in your browser. These do not need consent. If we add analytics or other non-essential cookies ([ANALYTICS PROVIDER, IF USED]), we will ask for your consent first.

The service is for businesses and is not intended for anyone under 18. We do not knowingly collect children's data.

We will update this page when our practices change and show the new "Last updated" date. Significant changes will be notified to account holders by email. See also our Terms & Conditions.

For privacy questions or to exercise your rights, email [PRIVACY CONTACT EMAIL] or write to us at the address below.