Privacy policy

SnapDue is a trading name of DryKISS Ltd (registered in England and Wales, company number 08660082), which decides why and how the personal data described here is processed, and is therefore the controller for it. The registered office is 3rd Floor 86-90 Paul Street, London, England, EC2A 4NE. Data protection questions go to [email protected].

SnapDue helps a company owner assemble the records a buyer, lender or advisor will ask for. Doing that means holding information about real people, so this notice says what is held, why, for how long, and what you can ask us to do about it.

Processing needs a lawful basis before it starts. Each category below names the basis relied on and the period the data is kept for.

Account details

Your name and email address, held to give you an account and to contact you about it. Basis: performance of our contract with you. Kept while the account is open and for twelve months after it closes.

Company membership

Which companies you belong to and your role in each. Basis: performance of our contract. Kept while the membership lasts, then retained in the access record so a later question about who could see what can be answered.

Checklist answers

What you record against each of the twenty four sections. Basis: performance of our contract. Kept while the company record is held.

Uploaded documents

Statutory and identity documents you attach to a checklist section. Basis: performance of our contract, and legal obligation where the document is an anti money laundering record. Retention below.

Identity check results

The outcome of a document and liveness check, which produces biometric data used to identify you. Basis: legal obligation under the Money Laundering Regulations 2017, with a substantial public interest condition under the Data Protection Act 2018 covering the prevention of unlawful acts. Kept for five years after the business relationship ends.

Public register data

Filings, officers and charges copied from Companies House. This is already public. Basis: our legitimate interest in showing you an accurate record without asking you to retype it. Refreshed rather than retained, it is a cache of a record that belongs to somebody else.

HMRC connection

The tokens that let you read your own HMRC position through SnapDue. Basis: performance of our contract. Held until you disconnect or the eighteen month grant expires, whichever comes first.

Security records

Sign in attempts, access to documents and administrative actions. Basis: our legitimate interest in keeping accounts and records secure. Kept for twelve months.

Two retention clocks run here and they behave differently. Most data runs on the life of your account. Anti money laundering records run for five years from the end of the business relationship, not from the date they were uploaded, because that is what the Money Laundering Regulations 2017 require.

That second clock is why an anti money laundering record survives a deletion request. Where the law requires us to keep something, we keep it, and we tell you which records those are rather than quietly ignoring the request.

We use a small number of suppliers to run the service. Each one acts on our instructions, is bound by a written agreement, and receives only what it needs to do its job.

• Hosting and object storage, which hold the application and your uploaded documents
• An identity verification provider, which performs the document and liveness check
• An email provider, which sends verification and notification messages

Companies House and HMRC are not our suppliers. Companies House is a public source we read from, and HMRC decides for itself how it handles the data you authorise us to see, so it is a separate controller rather than a processor.

You can ask us to do any of the following, and we answer within one month.

• Give you a copy of what we hold about you
• Correct anything that is wrong
• Delete what we hold, except records the law requires us to keep
• Give you your data in a machine readable form
• Object to processing we do on the basis of legitimate interests
• Restrict what we do with your data while a dispute is resolved

We keep a record of the request itself either way, including where we could not act on it, so that we can show later how it was handled.

Every connection is encrypted in transit. Uploaded documents sit in private storage that is encrypted at rest, refuses to list its contents, and is never served directly. A document is reached only through a link that expires in fifteen minutes, and only after we have checked that the person asking is a member of that company with permission to see it.

Access inside a company is by role. Someone invited to a company sees what their role allows and nothing else, and nobody can raise their own permissions.

If something goes wrong and personal data is exposed in a way that puts people at risk, we report it to the Information Commissioner, the UK regulator, within seventy two hours of becoming aware, and we tell the people affected without undue delay where the risk to them is high.

If you are unhappy with how we have handled your data, write to [email protected] first so we can put it right. You can also complain to the Information Commissioner at ico.org.uk, and you do not have to come to us first.