Privacy Notice

1. Who is responsible

CODENAV LTD, a private company limited by shares registered in England and Wales with company number 16998604, whose registered office is at 71-75 Shelton Street, London WC2H 9JQ is the controller of the personal data described here, under the UK General Data Protection Regulation and the Data Protection Act 2018. It is registered with the Information Commissioner's Office, reference ZC156578. You can write about anything in this notice to director@codenav.dev or to the registered office.

2. What the registry holds

Your particulars: your name and former names, date of birth, nationality, country of residence, the type, issuing country and expiry of your identity document and its number (kept encrypted), your residential and service addresses, your email address and telephone number.

Your account: your account number, role, status, the review of your application, your password (in a form that cannot be read back), your authenticator secret (encrypted), and, if you link one, your CodeNav Account identifier and email.

Your activity: each sign-in and failed attempt, the sessions you open, and each action you take on the desk, with its time, internet address and browser; your votes, approvals and signatures; and the agreements you accepted.

Your holdings and offices: where you are a member, director or holder of another instrument, the entries about you in the company's registers.

3. Why, and on what basis

To keep the registers and records the Companies Act 2006 requires, and to send you what the Act and the articles require: because the law obliges the company to (UK GDPR Article 6(1)(c)).

To open and run your desk account and act on what you do through it: because it is needed for the agreement between you and the company (Article 6(1)(b)).

To verify your identity, keep the desk secure, detect misuse and keep evidence of what was done: in the company's legitimate interest in sound and provable records (Article 6(1)(f)).

The registry does not use your personal data for marketing, and does not make decisions about you by automated means alone.

Your particulars are needed both by law, for the registers the company must keep of its members and officers, and for the agreement that opens your account. If you do not give them, the company cannot open a desk account for you; it will still deal with you on paper as the law requires.

4. Who it is shared with

Companies House and other public authorities, where the law requires the company to file or disclose information. Your service address and holdings appear on the company's register of members, which members and, in the cases the law allows, others may inspect; your residential address and identity document do not.

Service providers that run the registry for the company, under contract and only on its instructions: the company that hosts the server; Cloudflare, which carries the site's traffic; and Amazon Web Services, which delivers the registry's email. Some of them may process data outside the United Kingdom, under safeguards the UK GDPR recognises.

The company's professional advisers, and anyone to whom the law requires disclosure.

5. How long it is kept

Records on the desk are append-only, so that what was done can always be shown, and the company keeps them as its records.

Your account, particulars, signed application and the record of your activity are kept while the account is open and for ten years after it closes. Ten years is how long the Companies Act 2006 lets a former member's entry stay in the register of members (section 121), and it covers the time within which claims about what was done may be brought. After that the company removes or anonymises what it no longer needs, except where the law requires it to keep a record, such as entries in its statutory registers and the minutes and resolutions it must keep.

An application that is rejected is kept for six years from the decision, then removed in the same way.

6. Your rights

You may ask for a copy of your personal data, ask for it to be corrected, ask for its use to be restricted, object to its use on the basis of legitimate interest, and ask for data you provided to be given to you in a portable form. You may ask for erasure; the company cannot erase what the law requires it to keep, or what it needs as evidence of acts on the desk, and will tell you if that applies.

Most corrections are made by adding a new version of your particulars on the desk; the earlier version is kept, marked as replaced.

You may complain to the Information Commissioner's Office (ico.org.uk). The company would be glad of the chance to deal with your concern first.