Privacy notice

CreditorTrack UK watches the UK companies you trade with and tells you when their public record changes. It is run by HuBelor Limited, a company registered in England and Wales. We are the controller of the personal data described here, and we are responsible for keeping it safe. To contact us about your data, use our contact form and choose “My data or privacy”.

What we collect about you

• Your account: your email address, a securely hashed password, your role in your organisation, your email settings, and when you last signed in.
• Your organisation and team: your organisation's name, and the email address and role of each person on your team or invited to join it.
• Your customer lists: the companies you choose to watch, the labels you give them, and any VAT numbers you add.
• VAT checks: when you add a VAT number, we ask HMRC whether it is registered. HMRC tells us the name and postcode it holds for that registration, and we keep that answer with the date we checked.
• Messages to us: if you use our contact form, your name, email address and what you write, together with our replies.
• Billing: if you subscribe, Stripe takes your card details directly. We keep only Stripe's references for you, your plan, and a record of each payment and invoice. We never see or store your card number.
• Security records: sign-in attempts and a log of important account actions, with the IP address used, to protect accounts and investigate misuse.

Why we use it, and our lawful basis

• To provide the service you signed up for, including alerts, digests, VAT checks, your team and support: this is necessary for our contract with you (Article 6(1)(b) UK GDPR).
• To take payments and keep accounting records: contract, and our legal obligations under tax law (Article 6(1)(c)).
• To keep the service and your account secure: our legitimate interest in preventing fraud and misuse (Article 6(1)(f)).
• To email you about your account and the service: contract. We don't send marketing emails, and we never share your data with anyone for their marketing.

We don't make automated decisions about you that have legal or similarly significant effects. Our warnings are about companies, and what you do with them is your decision.

Information about companies

To tell you when a company's position changes, we use public sources:

• Companies House, the public register of UK companies. Officer names sometimes appear in that data. We discard them before storing anything; for director resignations we keep only a count and the dates.
• The Gazette, for winding-up petitions. We keep only the company number, the dates and the notice reference, never the petitioner's name.
• The UK Sanctions List, published by the government. We keep only entries for organisations, not for individuals.
• HMRC, for the VAT checks described above.

We do this on the basis of our legitimate interest, and yours, in knowing when a business you deal with gets into difficulty. We have assessed that this doesn't override the rights of the people involved, because we keep only what is needed and it comes from official public records.

Who we share it with

• 20i, who host our servers and database and send our email, in London.
• Stripe, who process payments. Stripe may process data outside the UK under the safeguards UK law requires.
• HMRC, who receive the VAT numbers you ask us to check.
• Your reseller, if you joined through one. They see your organisation's name, your administrator's email address, how many people and companies you have, when you were last active and what they charge you, so they can approve and bill your account. They never see your lists, labels, VAT numbers, alerts or messages.

The providers above act on our instructions, apart from HMRC, which uses VAT data under its own legal powers. We don't sell personal data.

Where it's kept and how we protect it

Our servers and database are in the UK. Every connection is encrypted, passwords are stored only as secure hashes, access tokens for the services we use are encrypted before they're stored, and each organisation's data is kept apart from every other's. Staff access depends on role, and the administration area needs an authenticator code. See our security page for more, including how to report a problem.

How long we keep it

• Your account and lists: for as long as your account is open. When an administrator closes it, we delete your organisation, its people, lists, labels and VAT numbers straight away.
• Payment records: six years, as tax law requires.
• Messages to us: two years after the last message in the conversation.
• Security records: sign-in attempts for about a day; the account activity log for two years, with IP addresses removed after 90 days.
• Company information: until 90 days after the last subscriber stops watching that company. Petition records for 180 days.

Your rights

You can ask for a copy of your data, ask us to correct it or delete it, object to how we use it, or ask us to restrict it. You can download a copy of your data yourself at any time from your email settings page, and an administrator can close your organisation's account from the Plan page. For anything else, use our contact form and choose “My data or privacy”. We'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use one essential cookie to keep you signed in. We don't use advertising or analytics cookies.

Changes

If we change this notice in a way that matters, we'll email account holders before the change takes effect.