Version 1.2 · Effective date: 3 August 2026
Self-serve pay-as-you-go company reports · records.knowyourcustomer.com
This notice explains how we process personal data in connection with the Company Records service, including personal data about individuals who appear on official company registers, and how we use cookies on this site. It supports our Terms of Service and Acceptable Use Policy.
Company Records is operated by Know Your Customer (Ireland) Limited (CRO number 595161), registered office Castleyard OfficePods 14, 20 St. Patricks Road, A96 D573 Dalkey, Co. Dublin, Ireland. We are the controller of the personal data described here. You can contact our data protection contact at legal@knowyourcustomer.com.
To produce company due-diligence reports for our business customers, we process information published on official company registers. Where a company's records name individuals — for example directors, officers, and natural-person beneficial owners of corporate shareholders — we process their name, role or position, appointment or cessation dates, register-listed address, and shareholding, as those details appear on the official register. Our reports contain official company-registry data only; they do not include any screening data (AML, sanctions, or PEP) or any other data source. We do not seek special-category data.
We also process the account, contact, and usage data of our business customers' own personnel (for example the name and business email used to register, and the record of searches and orders placed). That data is provided to us by the customer or generated as they use the Service.
If you allow us to, we also collect information about how visitors use this website. That is measurement statistics, a visual reconstruction of how pages were used on screen, and the advertising consent signals your cookie choice authorises being sent to Google. All of it is described under Cookies, analytics, session recording and advertising below, and it is the only processing in this notice that depends on your consent.
We compile and supply these reports so that regulated and other businesses can carry out KYC/CDD, anti-money-laundering and sanctions compliance, counterparty and supplier due diligence, and fraud prevention. Our lawful basis for processing the personal data that appears in reports is our legitimate interests, and the legitimate interests of our customers and the public, in enabling accurate due diligence and combating financial crime (Article 6(1)(f) GDPR). We have carried out a balancing assessment; you can ask us for a summary.
For our business customers' account and usage data, we rely on our legitimate interests and, where applicable, the performance of our contract with the customer and our legal obligations (for example tax and accounting record-keeping).
Website analytics, session recording, and the advertising consent signals described below, are different: they rest on your consent, and on nothing else. The basis, the cookies involved, and how to withdraw are all set out under Cookies, analytics, session recording and advertising.
Our business customers receive the reports they purchase and use them, as independent controllers, only for permitted business purposes under our Acceptable Use Policy (which prohibits, among other things, consumer-credit, employment, tenancy, marketing, profiling, harassment, bulk extraction, and resale). Our reports are supplied only to businesses; we do not offer a people-search product on individuals, and follow-on reports are on corporate entities only.
We use service providers to host the Service (Microsoft Azure, in the EU/West Europe), to process payments, to deliver email, and to record your cookie choice (OneTrust, trading as CookiePro); company-register retrieval is carried out via our group's KYC engine in Hong Kong under intra-group Standard Contractual Clauses.
If, and only if, you consent to analytics cookies, two further processors receive website data. Google receives website analytics data. Hotjar, a Contentsquare company established in the European Union, receives session recordings and heatmap data. Both act on our instructions as our processors, and neither receives anything at all unless you allow analytics cookies.
If you consent to targeting cookies as well, advertising consent signals are sent to Google alongside its analytics data, which permit Google to use it for advertising purposes under Google's own terms. No advertising signal is sent to Hotjar. All of this is described under Cookies, analytics, session recording and advertising.
Some of the data described in this notice is transferred outside the European Economic Area.
You can ask us for more detail about these safeguards, including a copy of the relevant clauses, at legal@knowyourcustomer.com. Our commitment on where we hold this data is set out under Where we hold report content and account data.
This section is a commitment rather than a description, and it is deliberately limited to two categories of data:
For those two categories, we host, store and process the data in the European Union (Microsoft Azure, West Europe), and company-register retrieval is carried out by our group's KYC engine in Hong Kong under the Standard Contractual Clauses described above. We do not host, store, or process either category in the United States. We will not add or change a processing location for them without publishing the change here at least 30 days before it takes effect and notifying registered customers. If we ever have to move processing at short notice to keep the Service running, we will keep it within the European Economic Area and tell you as soon as we can.
What this commitment does not cover, so that it is not read more widely than it is meant:
We have drawn it this way on purpose. A blanket claim that no data of any kind ever reaches a particular jurisdiction is not one we could keep as our supplier chain changes, and a commitment you cannot rely on is worse than none. This one covers the data we hold end to end, and only our own act can break it.
We keep report content for 365 days (one year) and then purge it, and the business that bought the report can delete it sooner. We hold it for that period so that the business can retrieve it if it is audited or has to answer a regulatory query; we do not keep it beyond that ceiling. We keep usage records for 12 months and then purge them. We retain transaction records (for accounting, tax, and legal record-keeping) for 6–7 years. After the report-content purge, only transaction metadata is kept.
How long analytics data and cookies last is set out under Cookies, analytics, session recording and advertising.
Strictly necessary cookies are always set, because the Service and the security layer in front of it do not work without them: your sign-in session, security and bot-protection tokens, and the record of the cookie choice you make here. Some of those are set at knowyourcustomer.com and reach this site too, because this site is a subdomain of it. No analytics or session-recording cookie is set until you allow one, and nothing outside that strictly necessary set is set unless you agree to it.
Analytics, with your consent. We use Google Analytics 4 (measurement ID G-B3XGLG8WT7, the same analytics property used across the Know Your Customer website) to understand how people find and use this site. Analytics is off until you allow it, and it is not merely muted: we run Google Consent Mode with every signal, analytics and advertising alike, denied until you choose otherwise, and the Google Analytics tag is not loaded at all until you accept Performance cookies. If you accept, Google sets the _ga and _ga_<id> cookies, for up to two years, to distinguish visitors and sessions, and Google retains the underlying event-level analytics data for no longer than 14 months before deleting it automatically.
What we send Google, and what we never send. We send Google the page address and title, plus non-identifying events such as the jurisdiction you selected, a price, or a result count. We never send Google a search term, an email address, or an order or cart reference. There is one page on this site where a company name reaches Google, described under The one exception below, and it is the only one. The Google Analytics tag is not loaded at all on the cart, order, account, or password-reset pages.
The one exception, and here is exactly how far it goes. A public company record page, at an address of the form /company/<jurisdiction>/<number>, has the company's name in its page title. Google Analytics reports the title of every page it runs on, and we cannot change that or filter it. So on those pages, through the title and through nothing else, Google receives the name of the company whose record you are looking at. Nothing else in what we never send Google above is narrowed by this. We still send Google no email address, no order and no cart reference, and the pages that carry those things still carry no Google Analytics tag at all. We still never send the contents of the search box, and search results pages carry no Google Analytics tag either. We would rather you knew the limit of that last one: if you search for a company and then open its record, the title of the record page tells Google which company you were looking for, even though the words you typed are not sent.
The only thing you can do about this is decline Performance cookies, or withdraw them, which stops Google Analytics everywhere on this site rather than on those pages alone. There is no separate control for the page title and we are not going to pretend there is. Session recording also runs on company record pages, and what that adds is set out below.
Session recording and heatmaps, with your consent. We also use Hotjar to see how pages are actually used, so that we can find the places where this site is confusing. Hotjar records a reconstruction of the page as your browser drew it, together with mouse movement, clicks, scrolling, and the pages you moved between, and it combines that across visitors into heatmaps. It is not a video of you: there is no camera, no microphone, and no audio. Like Google Analytics, Hotjar is not loaded at all until you accept Performance cookies, and it runs on that same choice. Withdrawing stops Google Analytics at once. It stops Hotjar from the next page you open, but not on the page you are already on: Hotjar's software gives us no way to stop a recording once it has started, so if you want the page you are on to stop being recorded, close it or reload it.
Where Hotjar runs, and where it does not. Unlike Google Analytics, Hotjar runs on the signed-in pages: the cart, your order history, and your account pages. We chose that because those are the pages where a problem costs you the most and where, until now, we could see the least. It does not run at all on the home page or on search results, because the address of a search results page contains the company you typed and Hotjar records the address of every page it sees. It does not run on the password-reset page either, because that page carries no analytics of any kind and the link that brings you there carries a single-use token in its address. It does run on the cart, and on the page you land on after paying, and on those two we do something different: the cart token or order reference that brought you there is taken out of the address before Hotjar is started, so it never forms part of the recording. If taking it out does not succeed, Hotjar is not started on that page load at all, so you get no recording rather than a recording with the reference in it.
Company record pages are recorded too. These are the same public company record pages described under The one exception above, where the company name reaches Google through the page title. A recording of one shows the company record you were looking at, which is what that page shows to anyone, together with the rest of your visit. The difference between the two is that Google receives the title and Hotjar receives the page.
On the cart, order and account pages we have marked every field you can type into, along with the cart and order listings and the places your email address is shown, so that they are blanked inside your browser and their contents are never sent to Hotjar at all rather than being sent and then hidden.
What we have not marked. We have marked the sign-up fields that carry your details and every field on the cart, order and account pages, so that their contents are blanked inside your browser and never sent. We have also marked the search box, as a second layer behind the fact that the home page and search results are not recorded at all. We have not marked ordinary form controls that carry nothing about you, such as choosing a jurisdiction or ticking a box, and we do not promise that anything typed into a field we have not marked stays out of the recording. Two things are blanked wherever they appear and whatever we configure, because Hotjar enforces them and we cannot switch them off: passwords, and anything you type into a field that asks for an email address. Hotjar also blanks any run of nine digits or more, and anything matching an email address, wherever it appears on a page.
Everything we promise here is done by the pages of this site, not by a setting. The blanking we commit to above is written into the pages themselves, so it cannot be turned off without changing this site. We have deliberately not rested any promise in this notice on a switch in a third party's console, because a promise that someone could undo without changing this site is not one we could keep.
About one session in three is recorded, rather than every session. We check the blanking rather than assuming it: at each release we check the marking in the pages, which is the part we control, and we review recordings of the cart, order, and account pages whenever recordings of them exist. If you would rather not be recorded at all, decline Performance cookies, or withdraw them later on the terms described above; this site works identically either way.
The cookies and storage Hotjar uses. If you accept Performance cookies, Hotjar sets _hjSessionUser_<id>, for up to 365 days, so that a later visit to this site is recognised as the same browser, and _hjSession_<id>, for 30 minutes and extended while you keep using the site, to tie a single visit together. It also sets four very short-lived cookies (_hjCookieTest, _hjLocalStorageTest, _hjSessionStorageTest and _hjTLDTest) purely to test whether storage works, and removes them again immediately. Hotjar also uses your browser's local and session storage to hold the size of your browser window. All of these are first-party, set on this site's own domain, and none of them is set unless you accept Performance cookies. Hotjar does not track you across other websites. Hotjar keeps the recording and heatmap data for no longer than 365 days and then deletes it automatically.
Where the recording data is held. Hotjar is part of the Contentsquare group and is established in the European Union. The recording and heatmap data from this site is stored in Ireland, and it is not hosted in the United States. Contentsquare group companies and support providers outside the European Economic Area, including one in the United States, may access it for support and maintenance under Standard Contractual Clauses, and that is set out under International transfers.
Advertising, and what the Targeting category does here. The cookie banner on this site is the one used across the Know Your Customer website, and it offers a Targeting category alongside Performance. Targeting is the advertising category, so this notice sets out exactly what choosing it does on this site. That matters particularly if you chose it on knowyourcustomer.com, because your choice carries across and you will not be asked again here.
We run no advertising on this site. There is no Google Ads tag, no conversion tag, and no advertising or remarketing pixel on any page of records.knowyourcustomer.com, and allowing Targeting places no additional cookie on this site.
What allowing Targeting changes is what we tell Google. Google Consent Mode carries four signals, and all four start as denied. Allowing Performance sets the analytics signal to granted. Allowing Targeting additionally sets the three advertising signals, ad_storage, ad_user_data and ad_personalization, to granted, and those signals travel with the analytics we collect. They permit Google to use data from your visit for advertising purposes, including building advertising audiences, under Google's own terms. The analytics property we use is shared with the rest of the Know Your Customer website, so that permission is given on the shared account and not only for this site.
You can allow one without the other, and this site works identically either way. Allowing Performance without Targeting gives us the measurement and tells Google the advertising signals are refused. Allowing Targeting without Performance sends nothing at all, because the advertising signals travel only with analytics data, and we fetch no analytics tag until Performance is allowed.
If that changes, you will read it here first. If we introduce advertising on this site, whether a Google Ads tag, a conversion tag, or any other advertising integration, we will update this notice to say so before it starts.
How your choice is recorded. We manage cookie choices with OneTrust (CookiePro), the same consent tool used on knowyourcustomer.com. Your choice is stored in the OptanonConsent and OptanonAlertBoxClosed cookies for up to one year, on knowyourcustomer.com and its subdomains, so a choice you make on either site applies to both and you are not asked twice.
Changing or withdrawing your choice. You can change or withdraw your choice at any time, using the cookie preferences control below or the cookie icon shown on every page except the password-reset page. That one page shows no cookie control, because it loads no analytics, no session recording and no consent tool at all, so there is nothing on it for you to change; to change or withdraw your choice, use any other page on this site. Withdrawing Performance stops analytics collection at once, and stops session recording from the next page you open, for the reason given under Session recording and heatmaps, with your consent above. Withdrawing Targeting stops the advertising signals. Withdrawal does not affect processing already carried out.
If our consent tool cannot load for any reason, and you have not previously made a choice, nothing is collected and nothing is sent, so there is nothing to withdraw. If you had already given consent, we go on honouring the choice you made, because it is your choice and not a default; in that case the preferences control on this page will not appear until the tool loads, and you can withdraw on knowyourcustomer.com or by clearing this site's cookies in your browser.
Lawful basis. Our lawful basis for analytics and session-recording cookies, and for the analytics and session recording they enable, is your consent (Article 6(1)(a) GDPR). The same is true of the advertising signals: they are sent only where you have consented to targeting cookies, and they rest on that consent and on nothing else. Strictly necessary cookies do not require consent. If you make no choice, no analytics or session-recording cookie is set, no analytics data is collected, no recording is made, and no advertising signal is sent.
You have the right to access, rectify, erase, restrict, and object to our processing of your personal data, and the right to data portability where it applies. You also have the right to complain to the Irish Data Protection Commission (www.dataprotection.ie).
Because our reports draw on official registers, the authoritative record is the register itself, and we will also point you to the relevant register for corrections; we will restrict or delete the report content we hold about you on request where appropriate. The retention ceiling above limits how long we hold report content in any event, and our customer can delete it sooner.
Right to object (Article 21). Because we rely on legitimate interests for report content, you can object to our processing of your personal data. We will assess your objection and, unless we have compelling legitimate grounds that override your interests, we will stop processing your data in report content. Website analytics, session recording, and the advertising signals do not rely on legitimate interests, so there is nothing to object to there: you simply decline or withdraw your consent, as described under Cookies, analytics, session recording and advertising.
To exercise any right, or to object under Article 21, contact legal@knowyourcustomer.com. We log requests and answer them within the statutory timeframes.
We may update this notice. When we do, we will post the updated notice here and change the version number and effective date shown at the top and in the footer, so that you can tell which version you are reading.
