Privacy Policy

Sterling Financial Planning Limited, a company registered in England & Wales (operating the DirectorLenz service), is the data controller for personal data processed through DirectorLenz. If you have questions about how we handle your data, contact us at legal@directorlenz.co.uk.

If the DirectorLenz service is transferred to a successor entity within the same corporate group, the successor entity will become the data controller from the effective date of transfer (registered users notified at least 30 days in advance).

We collect the following categories of personal data:

• Account data: email address, hashed password, account type (broker or lender), organisation name.
• Usage data: reports generated, search queries (company names, company numbers, director names), credit transaction history.
• Technical data: IP address, browser user-agent, and device fingerprint collected at sign-up for fraud prevention and abuse detection.
• Communications: any correspondence you send to us by email.

We do not collect or store payment card details. Payments are processed by our payment processor; we receive only a transaction confirmation and payment reference.

We process your personal data on the following lawful bases under UK GDPR:

• Contract performance (Article 6(1)(b)): processing your account data and generating reports is necessary to provide the service you have contracted for.
• Legitimate interests (Article 6(1)(f)): IP and fingerprint data is processed to prevent fraud, account farming, and service abuse — interests which do not override your rights.
• Legal obligation (Article 6(1)(c)): we retain certain transaction records to comply with HMRC and financial record-keeping requirements.
• Consent (Article 6(1)(a)): analytics and non-essential cookies are only set after you consent via the cookie banner.

We use your data to:

• Create and manage your account.
• Process credit purchases and track your credit balance.
• Generate and deliver due-diligence reports.
• Send transactional emails (account verification, report-ready notifications, password reset).
• Detect and prevent fraud, abuse, and unauthorised access.
• Comply with legal obligations.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

We use cookies in compliance with the Privacy and Electronic Communications Regulations (PECR) and the Data Use and Access Act 2025 (DUAA 2025).

• Essential cookies: used to keep you signed in (session management). These do not require consent and cannot be rejected without affecting your ability to use the service.
• Non-essential cookies: analytics and performance cookies. These are only set after you click “Accept All” in the cookie consent banner. You may reject them by clicking “Reject Non-Essential”.

Your cookie preference is stored in your browser's local storage and persists across sessions. You can change your preference at any time by clearing your browser storage.

We retain your personal data for as long as your account is active. Following account deletion we will anonymise or erase personal data within 30 days, except where we are required to retain records by law (e.g. HMRC financial records, which are retained for 6 years).

Generated report PDFs are stored in our secure cloud storage. You may request deletion of your reports at any time by contacting us.

We use industry-standard security measures including encrypted connections (TLS), encrypted storage, row-level security on our database, and role-based access controls. We use a UK-compliant cloud infrastructure provider.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and affected users without undue delay.

Our service is hosted on cloud infrastructure based in the United Kingdom and European Economic Area. Where data is processed outside the UK we ensure appropriate safeguards are in place as required by UK GDPR Chapter V.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Use and Access Act 2025, you have the following rights:

• Right of access: request a copy of your personal data.
• Right to rectification: request correction of inaccurate data.
• Right to erasure: request deletion of your data (“right to be forgotten”), subject to legal retention obligations.
• Right to restriction: request that we restrict processing.
• Right to data portability: receive your data in a structured, commonly-used, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Rights related to automated decision-making: we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, email us at legal@directorlenz.co.uk. We will respond within 30 calendar days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We may update this Privacy Policy from time to time. Material changes will be notified by email to registered users at least 14 days before taking effect. The “Last updated” date at the top of this page reflects the most recent revision.

For any privacy-related queries, contact us at legal@directorlenz.co.uk.