Article 14 notice

Under Article 14 of the UK GDPR, when an organisation processes personal data it did not collect from the person it is about, it must tell them. This page is that notice. The controller is Xpectrum Ltd, trading as Dulycore — hello@dulycore.com.

What we hold, and where it came from

Dulycore processes information from public registers — principally the Companies House register, which is published under the Open Government Licence. For company officers and people with significant control, that can include: name, appointments and their dates, role, month and year of birth as published, nationality as published, correspondence address as published, and the company's registered filing dates. Where a company has published a business contact address or email in public sources, we may hold that too.

What we use it for

Compliance calendars. Filing dates and officer facts from the register drive the deadline calendar a company sees for itself.
Deadline briefings. We may send a company a one-off note of its own upcoming statutory deadlines, drawn from its own public record, at its published business contact details.

Lawful basis

Legitimate interests (UK GDPR Article 6(1)(f)): helping companies meet statutory obligations that already attach to them, using data the law already makes public for exactly this kind of transparency. The balancing test is published in our legitimate interests assessment.

Who we share it with

Categories of recipients only, and no more than the service needs: hosting and infrastructure providers that run the product; database and storage providers that hold the data; a payment processor, for customers who buy a paid module; and error-monitoring and analytics providers that keep the service working. We do not sell this data, and no recipient may use it for its own purposes.

International transfers

Customer data is stored in the United Kingdom. Where a service provider in the categories above processes data outside the UK, the transfer relies on a UK adequacy decision or the applicable UK transfer safeguards (the International Data Transfer Agreement or Addendum), and is limited to what operating the service requires.

This notice is layered: our privacy notice carries the fuller statement of recipients, transfers, retention and your rights, and controls if the two differ.

How long we keep it

Register-derived data is refreshed from the register and retained while it remains on the public record or while an account uses it. Contact details used for a deadline briefing are suppressed permanently on request.

Your rights

You can object to this processing, ask what we hold about you, ask for correction, and ask for erasure or suppression. Email hello@dulycore.com from any address, tell us who you are, and we will act within one month — objections to briefing email are actioned as permanent suppression, not deletion, so the address cannot be re-derived from the register later. You can also complain to the Information Commissioner's Office at ico.org.uk.