Privacy Notice
Last updated: 24 October 2026 · Version: 1.0
1. Who we are
The controller of your personal data is Smudgestone Ltd, trading as Biz History Check, a company registered in England and Wales (company number 12756947), registered office Chatterton House, Little Catterton Lane, Islington, Tadcaster, England, LS24 8EA. ICO registration number: ZC282460. Contact us about privacy at [email protected].
2. Whose data we handle
- Customers: people who use the site or order a report.
- People named in public records: for example directors, company secretaries, persons with significant control, premises licence holders and designated premises supervisors, and people named in planning or Gazette notices, connected to the business being checked.
- People mentioned in uploads or online content: for example names in brochures, adverts or public reviews.
3. What we collect
| From | Data |
|---|---|
| You | Name, email, phone (optional), order details, the advert link or business name and town, uploads (adverts, screenshots, brochures, documents), and messages to us |
| Stripe | Payment confirmation, billing name and address, last 4 card digits and card type. We never see your full card number. |
| Our website host | Technical data such as IP address, browser type and security logs |
| Public sources | Companies House, The Gazette, FSA, local authority licensing and planning registers, VOA, HM Land Registry (only with your agreement), online reviews and public social media: names, roles, appointment dates, other directorships, correspondence addresses, insolvency or disqualification notices and similar |
Please don't upload documents containing more personal data than we need (for example staff payroll, bank statements of individuals, or health information). Remove or black out such details where you can.
4. Why we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Taking and delivering your order, including AI-assisted drafting and human review | Contract |
| Taking payment and preventing fraud | Contract; legitimate interests |
| Accounting and tax records | Legal obligation |
| Researching people named in public records about the business you're checking | Legitimate interests (helping buyers make informed decisions about a business purchase, using information already made public for transparency). We've balanced this against the individuals' interests and limit it to business roles and relevant records. |
| Answering questions and complaints | Legitimate interests; contract |
| Service emails about your order | Contract |
| Marketing emails (only if you opt in) | Consent – you can withdraw at any time |
| Improving our checks (anonymised or aggregated only) | Legitimate interests |
Where records relate to criminal offences or allegations (for example director disqualifications or licensing prosecutions), we rely on DPA 2018 Schedule 1, paragraph 10 (preventing or detecting unlawful acts) and paragraph 36 (substantial public interest), and hold an appropriate policy document. We keep this to what is publicly recorded and relevant to the business being checked.
We do not make decisions about you that have legal or similar significant effects by automated means alone. Every report is reviewed by a person.
5. Who we share it with
We don't sell personal data. We use these service providers (processors), who act on our instructions: - Stripe – payments. - Cloudflare – website hosting, security, private storage of orders and uploads (R2), and email routing.
- AI drafting providers (USA) – to help draft reports from the information collected, under a data processing agreement; its business terms say it does not use our data to train its models.
- Cloudflare (USA/global) – also routes email sent to our address.
- Google (Gmail; USA/EEA) – email.
We may also share data with our professional advisers, or where the law requires.
6. International transfers
Some providers process data outside the UK (for example in the USA or the EEA). The safeguard for each is:
| Provider | Where | Safeguard |
|---|---|---|
| Stripe | USA | UK Extension to the EU–US Data Privacy Framework (UK–US data bridge) |
| Cloudflare | USA/global | UK Extension to the EU–US Data Privacy Framework |
| Google (Gmail) | USA/EEA | UK adequacy regulations (EEA); UK Extension to the EU–US Data Privacy Framework (USA) |
| AI drafting providers | USA | UK Extension to the EU–US Data Privacy Framework and/or ICO International Data Transfer Addendum |
7. How long we keep it
| Data | Kept for |
|---|---|
| Uploads (adverts, screenshots, brochures, documents) | Deleted 90 days after the report is delivered |
| Reports and the research behind them | 6 years after delivery, with access restricted to authorised staff, then deleted |
| Private report links | Disabled after 12 months |
| Order and payment records | 6 years after the end of the financial year (tax law) |
| Emails with you | 2 years after our last contact |
| Unused 3-pack credits | Order record kept until the credits expire, then as above |
| Security logs | As set by Cloudflare, usually days to weeks |
8. Your rights
You have the right to: access your data; have it corrected; have it erased; restrict or object to our use of it (including our legitimate-interests research); data portability; not to be subject to decisions based solely on automated processing that have legal or similarly significant effects; and withdraw consent at any time. Making a request is free. If you are named in a report we prepared, you can also contact us to exercise these rights. Some rights have limits; we will explain if one applies.
Email [email protected]. We will reply within one month.
8A. If you are named in a report
If you are a director, company secretary, person with significant control, licence holder or designated premises supervisor of a business that a customer is thinking of buying, your name and business role may appear in a report.
- Sources: public registers such as Companies House, The Gazette, local authority licensing and planning registers, the FSA, the VOA and HM Land Registry, plus public reviews and social media about the business.
- Purpose: to help a buyer (or agent) understand the history of a business for sale. We only use business roles and relevant public records, not your private life.
- Lawful basis: legitimate interests (see section 4). We keep a written legitimate interests assessment.
- Who sees it: the customer who ordered the report and their advisers.
- How long: as set out in section 7.
- Your rights: you can object at any time, and exercise the other rights in section 8, by emailing [email protected].
9. Security
Uploads and reports are stored privately. Reports are delivered by a private, hard-to-guess link. Only authorised people can access orders. Please don't forward your report link.
10. Complaints
Please contact us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
11. Changes
We'll post any update here and change the date at the top.