Privacy policy

1. Scope of this policy

UK GDPR and the Data Protection Act 2018 apply to the collection, storage and processing of personal data. Personal data means any information relating to an identified or identifiable living individual.

We process personal data in the following situations:

• when you email us;
• when you create a user account and access your dashboard;
• when we publish information from public sources (Companies House and Food Standards Agency FHRS data) on the Site, within the limits of applicable law and licences;
• when you visit www.foodprospect.co.uk;
• when you pay for a Live watch subscription via Stripe (including legacy one-off purchases still shown in your dashboard, if any).

The Site does not use audience analytics or marketing tracking tools (no Google Analytics, Matomo, tag managers or equivalent).

2. Email enquiries

2.1 Purpose, lawful basis and data processed

If you contact us by email, we may process:

• your email address; and
• any personal data you choose to include in your message.

We use this information to handle your enquiry and reply where appropriate. The lawful basis is our legitimate interest in managing customer relations (UK GDPR Article 6(1)(f)).

2.2 Retention

We keep correspondence for as long as needed to handle your message and any follow-up, then for up to 5 years for evidential purposes in line with applicable limitation periods, after which data is deleted.

2.3 International transfers

Personal data is hosted on secure cloud infrastructure located within the European Economic Area (France — OVH SAS). Transfers between the UK and the EEA rely on the UK Government's formal adequacy regulations under UK GDPR Article 45, ensuring equivalent standards of data protection.

Email correspondence is stored and processed within the same EEA infrastructure; we do not routinely transfer it to countries outside the UK or EEA without appropriate safeguards.

2.4 Recipients

Data may be accessed by staff who need it to perform their duties, by auditors or regulators where required by law, or where disclosure is necessary to enforce our Terms of Service.

2.5 Your rights

You have the right to access, rectify, erase, restrict or object to processing, and to data portability where applicable. Contact us via Contact or contact@foodprospect.co.uk.

You may also lodge a complaint with the ICO:

3. User account data

3.1 Purpose, lawful basis and data processed

When you register and use your dashboard, we process:

• email address;
• first and last name (stored in the profile name field);
• password: stored only as a hashed value (no plain-text passwords are kept).

We do not collect other account fields (phone, postal address, etc.). Processing is based on contract performance (Article 6(1)(b)) and our legitimate interest in securing access to the service (Article 6(1)(f)).

3.2 Retention and account deletion

Account data is kept for as long as your registration is active. You may delete your account at any time:

• from your dashboard Settings page; or
• by emailing contact@foodprospect.co.uk.

Deletion removes your identification data (email, name) from our servers within a reasonable period.

3.3 International transfers

Personal data is hosted on secure cloud infrastructure located within the European Economic Area (France — OVH SAS). Transfers between the UK and the EEA rely on the UK Government's formal adequacy regulations under UK GDPR Article 45, ensuring equivalent standards of data protection.

Account data is not routinely transferred to countries outside the UK or EEA without appropriate safeguards.

3.4 Recipients

Data may be accessed by authorised staff and disclosed to authorities where required by law.

3.5 Your rights

You may update your name from Settings or exercise your UK GDPR rights via Contact. You may complain to the ICO:

4. Public data from Companies House and FHRS

4.1 Purpose, lawful basis and data processed

The Site aggregates and displays information from official UK public sources, including:

• Companies House (the registrar of companies for England and Wales): gov.uk — Companies House;
• Food Standards Agency (Food Hygiene Rating Scheme — FHRS): food.gov.uk — FHRS.

This information supports public and business access to open register data. It may include data relating to identifiable individuals (e.g. company officers, premises addresses) as published by the source authorities.

We do not collect this data directly from data subjects; it is obtained from official open-data feeds. Processing is based on our legitimate interests and those of users in accessing public information lawfully published by source bodies (Article 6(1)(f)).

Because public registers contain hundreds of thousands of records, providing individual notice to every company officer or sole trader is impossible or would involve disproportionate effort within the meaning of UK GDPR Article 14(5)(b). We fulfil our transparency obligations by publishing this privacy notice publicly.

4.2 Retention

Published data is refreshed according to source updates and kept while relevant to the business or premises concerned, plus applicable statutory retention periods.

4.3 International transfers

Public register data is processed and hosted within the EEA as described in section 2.3. We do not routinely transfer this category of data to countries outside the UK or EEA without appropriate safeguards.

4.4 Recipients

Published data is accessible to Site visitors and may be disclosed to staff or authorities where required by law.

4.5 Your rights

You have UK GDPR rights in principle, but information from Companies House and FHRS:

• is public register or open-data information;
• was collected by public authorities, not by us directly from you;
• is made available under each source publisher's licence terms.

We may not always be able to erase or rectify public register data on request, because the underlying records remain published by Companies House or local authorities. Individuals may exercise their right to object under UK GDPR Article 21. When a verified objection is received from a sole trader or company director on legitimate grounds, we may suppress or redact the individual's personal name from our search index and commercial feeds, while retaining non-personal corporate records required for historical accuracy. If you believe published information is inaccurate, contact us via Contact and we will review your request. You may also contact the source authority or the ICO:

5. Site visits and server logs

5.1 Purpose, lawful basis and data processed

When you visit the Site, your browser automatically sends data that may be logged temporarily:

• IP address;
• date and time of access;
• page requested;
• referring URL;
• browser and operating system.

We process this on the basis of legitimate interests (Article 6(1)(f)) to operate, secure and administer the Site. It is not intended to identify you personally.

5.2 Retention

Log data is kept for up to 12 months unless a longer period is required by law.

5.3 Recipients and transfers

Log data is not shared with third parties except where required by law or necessary to perform a contract.

5.4 Your rights

Contact us via Contact to exercise your rights. ICO complaints:

5.5 Cookies

We use only strictly necessary cookies: session authentication and, during checkout, Stripe security cookies. We do not use analytics, advertising or marketing cookies.

Summary of cookies used:

You may configure your browser to refuse cookies; login and payment features may then not work correctly.

6. Stripe payments

Payments and billing compliance for Live watch subscriptions (and any legacy one-off purchases) are administered via Stripe Managed Payments (Stripe Payments UK Ltd), acting as merchant of record and independent controller for payment processing, fraud detection, and sales tax / VAT compliance.

We send Stripe only the information needed for billing (email, order reference, amount).

We do not collect or store raw card numbers on our servers. Payment is handled on Stripe's PCI-DSS certified infrastructure.

Stripe may collect device and usage data (including IP address) for fraud prevention and acts as an independent controller for that processing. See stripe.com/gb/privacy.

7. Security

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or destruction, having regard to the nature of the data and available technology.

8. Third-party websites

The Site may link to third-party websites (open-data sources, Stripe, etc.). We do not control their content or privacy practices and are not responsible for their processing of your data. Please read their privacy policies.

9. Contact

For questions about this policy or to exercise your rights, contact us via Contact or contact@foodprospect.co.uk.

10. Changes to this policy

We may update this Privacy policy at any time, including following legal, regulatory or operational changes. The current version published on the Site applies. Please review it periodically.