Privacy notice
Version 2026-09-29 · 29 September 2026
In short
- We hold the personal data needed to run your account, your calendar and your reminders.
- We read public registers to work out your deadlines, and keep only a short-lived copy.
- We never sell personal data, never share it for advertising, and set no tracking cookies.
- You can ask to see, correct or delete what we hold, and complain to us or to the ICO.
Who we are
Dulycore is operated by Xpectrum Ltd, trading as Dulycore, a company registered in England and Wales with company number [company number], registered office [registered office address]. We are the controller of the personal data described here, registered with the Information Commissioner's Office under number [ICO registration number]. Contact us at hello@dulycore.com.
What we hold, and why
| Data | Where it comes from | Why | Lawful basis |
|---|---|---|---|
| Account details: name, email address, sign-in identifiers, which account you belong to | You, or the colleague who invites you | Signing you in, running your account, sending the reminders you asked for | Contract; for invited colleagues, legitimate interests |
| Your company's number and name, and your answers to our questions about how it operates | You | Working out which obligations apply and when | Contract |
| Public-register information about your company's officers and people with significant control: names, roles, appointment and resignation dates, and identity verification dates as published | Companies House | Building your calendar and showing who must do what | Legitimate interests (see our assessment) |
| Reminder settings, and a record of which reminders were sent, delayed or failed | You, and the service | Sending reminders, and being able to show what was sent and when | Contract; legitimate interests |
| Your acceptance of our terms: which version, when, and the IP address and browser details of the request | Your browser, when you accept | Evidence of what was agreed, by whom and when | Legitimate interests (establishing and defending legal claims) |
| An activity record of actions taken in your account, such as attaching a company or changing settings | The service | Security, accountability, and evidence of what happened | Legitimate interests |
| Billing references and the plan you are on. Card details are held by our payment processor, not by us | You, at checkout | Taking payment, and meeting tax and accounting duties | Contract; legal obligation |
| Correspondence with us | You | Answering you, and keeping a record of what was agreed | Legitimate interests |
| Technical request information, such as IP address, browser and errors | Your browser, automatically | Keeping the service secure and working | Legitimate interests |
We do not accept document uploads today. If that changes, this notice will say so before it happens.
Legitimate interests
Where we rely on legitimate interests, we have weighed our interest against yours. For the public-register data, the interest is helping companies meet statutory deadlines that already apply to them, using information the law publishes for exactly this kind of transparency; we read only the published record, combine it with no private source, and hold no special category data. The balancing test is published in full in our legitimate interests assessment. You can object to any processing based on legitimate interests (see your rights, below).
Data about people we did not collect it from
Officers and people with significant control appear in the public register whether or not they use Dulycore. If that is you, our Article 14 notice explains what we hold about you, where it came from, and how to object.
Who receives it
Only the kinds of service provider needed to run the product: a sign-in and identity provider, an email delivery provider, hosting and database providers, a payment processor, and a logging and monitoring provider. Each processes personal data under contract and on our instructions. Our sub-processor register names each one and where it processes data. We never sell personal data and never share it for advertising.
Where it is held
Our database is in the United Kingdom, and data is encrypted in transit and at rest. Some of the providers above process data outside the UK, for example to sign you in or deliver email. Where they do, the transfer relies on UK adequacy regulations or the UK's approved transfer safeguards, and is limited to what running the service needs.
How long we keep it
- Account data, your answers and reminder settings: while your account is open. When it closes, it is marked for deletion and our policy is to delete it permanently 30 days later. That final step is not yet automated; until it is, it depends on a manual action, and you can ask us at any time to confirm it has happened.
- Public-register data: not stored in our database. We keep a temporary copy and replace it from the register within a day.
- Reminder history: [reminder history retention period].
- Terms acceptance records, including the IP address and browser details: kept with the acceptance record as evidence of the agreement, including after your account closes.
- Activity record: kept as the account's history. If you ask us to erase your data, we replace your identifier in it rather than deleting the history.
- Billing records: for as long as tax and accounting law requires.
- Technical request information: [service log retention period].
Reminder and statutory-deadline email carries no tracking pixels and no rewritten links. We do not measure opens on mail whose job is telling you a deadline is coming.
Your rights
You can ask for a copy of your personal data, and ask us to correct it, erase it, restrict how we use it, or give it to you in a portable form. You can object to processing based on legitimate interests. To do any of these, write to hello@dulycore.com; we respond within one month. Account holders can also export their account's data from their account settings at any time.
Complaints
If you are unhappy with how we have handled your personal data, write to hello@dulycore.com first. We will acknowledge your complaint within [complaint acknowledgement period], look into it, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes
When this notice changes, the version line at the top changes with it. We tell account holders about material changes by email.