Privacy notice

Topfed Inc, 254 Chapman Rd, Ste 208 #10042, Newark, DE 19702, United States, operates TrustValet at trustvalet.co.uk. For anything about your personal data, write to info@trustvalet.co.uk with the subject "Privacy".

Topfed Inc is not established in the United Kingdom, so it has appointed a representative there under Article 27 of the UK GDPR: Anatol Borodan, 311 Middlemore Road, Handsworth, Birmingham B21 0AL, United Kingdom, telephone +44 7944 571577. You can contact the representative, as well as or instead of us, about anything to do with your personal data, and so can the Information Commissioner's Office.

We apply the UK General Data Protection Regulation and the Data Protection Act 2018 to the personal data of people in the United Kingdom, and the EU General Data Protection Regulation where it applies.

• people who visit the website;
• people who sign in, claim a company page or buy a service for a company;
• people who write to us or subscribe to our newsletter;
• directors and other officers of companies in the register, whose names appear in the public register at Companies House.

We did not collect this information from you. We read it from the public register kept by Companies House under the Companies Act 2006.

What we hold: the names of a company's officers, their role, their appointment and resignation dates, and whether Companies House shows their identity as verified. For people with significant control we keep only the kind and size of control, never the name of an individual.

What we publish: nothing that identifies you. A company page shows the number of active directors and how many have verified their identity, not their names. We show only the town and postcode district of the registered office, never a full address, and never a date of birth or residential address. We do not publish pages for companies whose name is the name of one of their directors.

Why: to check that a person who claims a company page is one of its officers, which protects the company from false claims. Our lawful basis is our legitimate interest, and the company's, in preventing false claims. We have balanced it against your interests: the data is already public, we do not publish it, and we use it for nothing else.

You can object to this use at any time (see Your rights). We keep the data for as long as the company has a page, and refresh it from Companies House roughly once a month.

When you sign in we store your email address and the dates you signed in. When you claim a company page we also store the name, role and phone number you give, the result of comparing your name with the company's officers, the decision and who made it, and the IP address the claim came from.

We use this to run your account, decide the claim, contact you about it and prevent fraud. Our lawful bases are the performance of our agreement with you and our legitimate interest in preventing false claims.

Content a company adds to its page (trading name, website, phone number, description) is published on the page. If it includes personal data, such as a named contact, the company is responsible for having the right to share it.

Payments are made through Stripe. Stripe collects the card and billing details; we do not see or store full card numbers. We receive and keep the payer's name and email, the billing country and address, any VAT number given, the amount, the invoice and the status of the payment and subscription.

We use this to provide the service, to issue and refund payments and to keep the accounting records the law requires. Our lawful bases are the performance of our agreement and our legal obligations.

When you use a form on the website (contact, support, report a listing, removals, right of reply, press, recommend a company), we store what you send, your email address if you give it, and the IP address the message came from, to answer you and to prevent abuse. Our lawful basis is our legitimate interest in running the register and answering the people who write to us.

If you subscribe to the newsletter, we store your email address and the date. Our lawful basis is your consent, which you can withdraw at any time by writing to info@trustvalet.co.uk; every newsletter will also carry an unsubscribe link.

Like any website, our servers record the IP address, browser, page requested and time of each request. We use these logs only to keep the website secure and working, and they are deleted automatically after 14 days.

We count visits with Plausible Analytics, which we host ourselves at analytics.buum.md. It uses no cookies and stores no IP addresses: it cannot recognise you from one day to the next or across websites. It records the pages viewed, the website that sent you, your country, your type of device and browser, and a few actions such as sending a form or completing a payment (with the plan, never your details or anything you type). Our lawful basis is our legitimate interest in understanding how the register is used.

We do not use advertising tools and we do not build profiles of visitors.

We do not sell personal data and we do not pass your details to the companies listed. We use these service providers, who process data on our instructions:

We also send requests to Companies House, HMRC, the EU VIES service, domain registries (RDAP) and The Gazette to carry out checks. These requests contain company details, not your personal data.

We may disclose data where the law requires it, to protect our rights or the safety of others, or to a buyer of the register, who would be bound by this notice.

Topfed Inc is based in the United States, and some of our providers process data outside the UK. Our database is hosted in Germany, which the UK recognises as providing adequate protection. Where personal data is transferred to a country without such recognition, we rely on the safeguards the law provides, such as the UK International Data Transfer Addendum to the EU standard contractual clauses or the UK Extension to the EU-US Data Privacy Framework. You can ask us for details at info@trustvalet.co.uk.

Deletion runs automatically every day. When a period ends we delete the data or remove the part that identifies you.

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete data, where we have no overriding reason to keep it;
• ask us to restrict how we use it while a question is resolved;
• object to our use of data based on legitimate interests, including officers' names read from Companies House;
• receive data you gave us in a portable format;
• withdraw consent, such as for the newsletter, at any time.

Write to info@trustvalet.co.uk. We may ask you to confirm your identity. We reply within one month, and tell you if we need longer because the request is complex. Exercising these rights is free.

A claim may be accepted automatically when your name matches exactly the name of an officer on the public register. Refusing a claim, and every verification decision, is always done by a person.

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live.

We protect personal data with encrypted connections, access limited to the people who need it, sign-in codes that expire after 15 minutes, and session tokens stored only in hashed form. No system is perfectly secure; if a breach affects your data and puts you at risk, we will tell you and the regulator as the law requires.

The register and our services are meant for adults acting for businesses. We do not knowingly collect personal data from anyone under 18.

We update this notice when our practices change. The date at the top shows the latest version. If a change affects how we use data we already hold, we will tell account holders by email.