Privacy
Privacy Policy
This policy explains how Regstead collects, uses, stores and shares personal information when you use our website, request a scan, contact us or use a Regstead subscription.
1. Who we are
Regstead is a trading name of Foundry Vale Ltd (“Regstead”, “we”, “us” or “our”).
For UK data protection law, Foundry Vale Ltd is the controller of personal information described in this policy, except where we expressly act as a processor on behalf of a customer.
Business address: 23 Berrow Park Road, Plymouth, Devon, PL3 5PZ
Email: privacy@regstead.co.uk
Company number: 17465033
2. Information we collect
Information you provide to us
- your name, work email address and other contact details;
- the name of your firm or organisation;
- the website or domain you ask us to scan or monitor;
- information you include in a scan request, enquiry, support request or other correspondence;
- subscription, account and billing information; and
- marketing preferences and consent choices.
Information produced when we provide the service
- scan records, timestamps, URLs, page and document metadata;
- website findings, evidence snippets, status labels and comparison history;
- service configuration and usage information; and
- technical and security logs needed to operate, protect and troubleshoot the service.
Publicly available website information
When Regstead scans a website, it may process information already made publicly available on that website. This can include names, professional biographies, job titles, business contact details, regulatory information and other material published by the website owner.
Regstead is designed to analyse public website content, not to build profiles about individuals. We do not intentionally collect special category personal data for the purpose of our website monitoring service.
3. Where we get personal information from
We may obtain personal information:
- directly from you when you complete a form, contact us or subscribe;
- from your employer or organisation where you are acting as its contact person;
- from publicly accessible websites that Regstead is asked or configured to scan;
- from our payment provider where necessary to confirm payment status; and
- from technical logs generated when you use our website or service.
4. Why we use personal information and our lawful bases
| Purpose | Typical information | Lawful basis |
|---|---|---|
| Responding to enquiries and free scan requests | Contact, organisation and website details | Legitimate interests in responding to business enquiries and providing the requested scan; where applicable, steps taken at your request before entering a contract |
| Providing and administering a paid Regstead service | Account, contact, website, scan and billing information | Contract where the contract is with you personally; otherwise our legitimate interests in delivering and administering services to your organisation |
| Scanning and monitoring publicly accessible website content | Public website content, URLs, documents and evidence | Our legitimate interests and those of our customer in monitoring, reviewing and evidencing the customer’s public website |
| Security, fraud prevention, troubleshooting and service integrity | Technical logs, IP and usage information | Legitimate interests in protecting Regstead, our customers and our systems |
| Accounting, tax, regulatory and legal record keeping | Contract, invoice, payment and correspondence records | Legal obligation and, where relevant, legitimate interests in establishing, exercising or defending legal rights |
| Improving Regstead | Service usage, scan outcomes and aggregated statistics | Legitimate interests in improving the reliability, accuracy and usefulness of the service |
| Marketing | Name, work email and preferences | Consent where required; otherwise legitimate interests where direct marketing law permits. You can opt out at any time. |
| Non-essential analytics or similar cookies | Cookie and device information | Consent where required |
Our legitimate interests: operating a B2B website-monitoring service, responding to prospective customers, maintaining evidence and scan history, improving product reliability, protecting our systems and communicating with business contacts in a proportionate way.
5. Website scans and automated analysis
Regstead uses software to map and analyse publicly accessible website material. The service may assign analytical labels such as PASS, WARNING, POTENTIAL ISSUE or UNKNOWN, depending on the relevant product and rule set.
These labels are evidence and review aids. They are not legal determinations, compliance certifications or decisions about an individual. Regstead does not use this analysis to make solely automated decisions about people that produce legal or similarly significant effects.
Findings may also be human-reviewed before they are shared.
6. Who we share information with
We may share personal information where necessary with:
- hosting, infrastructure and email providers;
- payment providers when paid subscriptions are enabled;
- professional advisers such as accountants, lawyers or insurers;
- suppliers that support security, support or service administration; and
- public authorities where disclosure is required by law.
Our website and form data are hosted on infrastructure supplied by DreamHost. Form entries submitted through our self-hosted Gravity Forms installation are stored in our WordPress database; Gravity Forms states that it does not itself receive or store those form entries unless we configure an integration that sends data elsewhere.
We do not sell personal information.
7. International transfers
Some service providers may process personal information outside the United Kingdom. For example, our hosting provider may process hosted data in the United States.
Where UK data protection law requires safeguards for a restricted transfer, we use appropriate mechanisms such as adequacy regulations, the UK International Data Transfer Agreement, or approved standard contractual clauses together with the UK Addendum, as appropriate.
8. How long we keep information
| Information | Typical retention period |
|---|---|
| Free scan and prospective customer enquiries | Up to 12 months after the last meaningful contact, unless there is a reason to keep it longer |
| Customer, contract, invoice and accounting records | During the relationship and normally for 6 years afterwards where needed for legal, tax or accounting purposes |
| Scan data and monitoring history | While the service is active. Following termination, production data will normally be deleted or anonymised within 90 days unless a longer period is required by law or agreed with the customer |
| Backups containing deleted service data | May remain until normal backup rotation completes, normally no longer than a further 90 days |
| Support correspondence | Normally up to 24 months after the matter is closed, unless linked to a contract or legal issue requiring longer retention |
| Security and operational logs | Normally up to 90 days, unless required for an active security investigation |
| Marketing records | Until you opt out or we determine the information is no longer needed; suppression records may be kept to ensure we respect your opt-out |
We may retain anonymised or aggregated information that no longer identifies an individual.
9. Security
We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration or disclosure. No internet service can guarantee absolute security.
Please do not send passwords, payment card details, special category data or other highly sensitive personal information through our general website forms.
10. Cookies and similar technologies
We use cookies and similar technologies where necessary to operate the website and may use optional analytics or other non-essential technologies where enabled. Where consent is required, non-essential cookies should not be set before you have made a choice.
More detail should be provided in our Cookie Policy and through the website’s cookie preference controls.
11. Your data protection rights
Depending on the circumstances and the lawful basis we rely on, you may have rights to:
- ask for access to your personal information;
- ask us to correct inaccurate information;
- ask us to erase information;
- ask us to restrict how information is used;
- object to certain uses of your information, including direct marketing;
- receive certain information in a portable format; and
- withdraw consent at any time where we rely on consent.
Your right to object: where we rely on legitimate interests, you may object to our use of your personal information. You always have the right to object to direct marketing.
To exercise a right, email privacy@regstead.co.uk. We may need to verify your identity before acting on a request.
12. Complaints
If you have concerns about how we use personal information, please contact us first so we can try to resolve them.
You also have the right to complain to the UK Information Commissioner’s Office (ICO). Information about making a complaint is available at ico.org.uk.
13. Changes to this policy
We may update this policy as Regstead develops or where legal, regulatory or operational requirements change. The latest version will be published on this page with an updated review date. Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected users.