How we use public-record information

1. The controller

UKGovscan is operated by Elenchos Ltd, a company registered in England and Wales. Elenchos Ltd is responsible for the processing described in this notice.

Privacy enquiries and data requests: [email protected]. Our registered number and office are in our terms.

2. The information we process

The data subjects are individuals holding public office or a regulated position, and individuals whose donations or loans to a political party or regulated donee are reportable under the Political Parties, Elections and Referendums Act 2000. Depending on the source, the categories of personal data processed include:

• names and public roles;
• company directorships and other appointments, and persons with significant control;
• charity trusteeships;
• registered financial interests, outside employment and declared earnings;
• gifts, hospitality and travel recorded in official registers;
• political donations and loans;
• consultant lobbying registrations and records of ministerial meetings;
• director disqualifications and other published company information; and
• names appearing in records of public expenditure, procurement and grant awards.

We do not obtain further information about an individual by reason only of their appearance in one of these records. What is available depends on what the source publishes.

3. Sources

No personal data is obtained from the data subject. All personal data described in this notice is obtained from publicly accessible sources, each of which publishes it under a statutory or regulatory duty.

We record the source of each record and, where it is available at a stable address, link to it, so that the original publication can be examined in its context. A fuller description of the datasets in use is on our Data sources page.

4. Processing carried out by us

We do not reproduce the source datasets in isolation. We standardise the records, index them for search, and connect records that appear to relate to the same person or organisation. A connection between a public contract and a political donation made by a person connected with the supplier is displayed where it exists.

Identity matching. Two records are treated as relating to the same individual only where a shared identifier or corroborating data supports that conclusion. Where records share a name only, the match is labelled unconfirmed and is excluded from all totals. A payee named in a published ledger without a company number is matched to the Companies House register by name, and the page states that the match was made on that basis.

Automated matching does not produce decisions about an individual having legal or similarly significant effects.

Connecting records that were published separately can increase the privacy impact of information that was already public. The accuracy, relevance and proportionality of the connections we create are accordingly assessed, rather than assumed from the fact that the underlying records are published.

5. Lawful basis

The processing is carried out under Article 6(1)(f) of the UK GDPR, legitimate interests. The interests pursued are the scrutiny of public office, public expenditure and political influence; the support of research, journalism and due diligence; and making official information more accessible by connecting records that are published separately.

A legitimate interests assessment has been recorded and is available on request.

Special category data

Records of political donations may reveal an individual’s political opinions, which are special category data under Article 9 of the UK GDPR. Processing of that kind requires a condition under Article 9 in addition to a lawful basis under Article 6. The condition applicable to this processing is being determined with external counsel, and this notice will be amended to state it once it has been confirmed.

We do not infer political opinions from unrelated information, and we do not use public-record information to construct political profiles for advertising or campaigning.

6. Individual notification

The records described in this notice concern a very large number of individuals, and we do not write to them individually.

This notice is published so that the information required by Article 14 is available to any person to whom it relates. Where we correspond with an individual directly and further privacy information is required, it is provided at that point.

7. Accuracy and correction

We reproduce published records as published, and distinguish information supplied by a source from a connection or classification created by us. Source records may nonetheless contain errors, become out of date, or be corrected after we have collected them, and our matching processes can err, particularly between individuals of similar name.

Where a data subject informs us that a record may be inaccurate, we will compare our record with its source, review any connection we created, and correct any inaccuracy for which we are responsible.

We do not amend a published figure independently of its source. Where a source record itself appears to be inaccurate, we will identify the body responsible for it. Where presenting the record without qualification would be misleading in the meantime, we may annotate it, restrict its visibility, or remove a connection that we created and cannot substantiate.

Reports may be made by email to [email protected].

8. Publication and indexing

Pages are accessible to search engine crawlers and to crawlers operated by providers of AI assistants, and their content may appear in search results and in the output of those services.

Profile pages for individual donors and for company officers are marked not to be indexed by search engines. Bulk retrieval of the website is disallowed in our robots.txt and constrained by rate limiting; neither measure can prevent retrieval by a party that disregards them.

Where a record is removed from this website following a request, we have no control over copies already held by third parties, and will identify the relevant third party on request.

We do not supply public-record information to advertisers for behavioural advertising or for political campaigning.

9. Service providers and international processing

The service providers engaged in operating UKGovscan, and the role each performs, are identified in our Privacy Policy. Our principal servers are in Germany. Certain providers process personal data outside the United Kingdom.

Where a restricted transfer arises, an appropriate transfer mechanism is used, as described in our Privacy Policy.

10. Retention

A record is retained only for as long as its retention remains necessary for the purposes stated in section 5. In assessing that, we consider:

• whether the record remains published, or recognised, by its source;
• whether it continues to serve the purpose of public scrutiny;
• its age and sensitivity, and whether circumstances have changed since publication; and
• the effect of continued publication on the individual concerned.

Records are refreshed from their sources. Where a source corrects, withdraws or alters a record, we review the corresponding record and update it, mark it as withdrawn, restrict its visibility or remove it, as the circumstances require. Retention is also reconsidered where an individual raises a concern about a record relating to them.

11. Rights of data subjects

The rights below arise under the UK GDPR. Which of them applies, and to what extent, depends on the circumstances and on the lawful basis relied on.

• Access (Article 15). Confirmation of whether we process personal data relating to you, and a copy of it.
• Rectification (Article 16). Correction of inaccurate or incomplete data, on the basis described in section 7.
• Erasure (Article 17). Erasure where the right applies. The right is not absolute.
• Objection (Article 21). Where an objection is made on grounds relating to your particular situation, we will cease the processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or that the processing is necessary for the establishment, exercise or defence of legal claims. You will be informed of the outcome and of the grounds for it.
• Restriction (Article 18). Restriction of processing in certain circumstances, including while the accuracy of a record is contested.

Requests may be made by email to [email protected], and need not use any particular form of words. Please identify the record concerned.

We respond within one month of receiving a request. Where a request is complex, or where you have made several, the law allows more time; if that applies we will tell you within the first month and explain why.

We may ask for what is reasonably necessary to confirm your identity, or your authority to act for someone else, before we act on a request. We will not ask for more than the request requires.

No fee is charged. Article 12(5) of the UK GDPR permits a reasonable fee, or a refusal, where a request is manifestly unfounded or excessive, or where further copies are requested. If we rely on that, we will say why and how to challenge it.

An assertion that a record does not relate to the requester at all is treated as an accuracy matter requiring priority.

12. Complaints

Section 164A of the Data Protection Act 2018 gives you the right to complain to us about our processing of your personal data. You can complain by emailing [email protected].

We will acknowledge receipt of your complaint within 30 days. Without undue delay, we will then take appropriate steps to respond to it and tell you the outcome.

You can complain at any time to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint. The ICO recommends giving us an opportunity to complete our complaints process first.

13. Changes to this notice

This notice may be amended, including where we add a materially different dataset or change the way records are connected. The current version and its effective date are always at ukgovscan.com/how-we-use-public-data.