Privacy notice
Last updated 27 August 2026
Who we are
Dulycore is operated by Xpectrum Ltd ("we", "us"), a company registered in England and Wales, trading as Dulycore. We are the data controller for the personal data described in this notice. You can reach us at hello@dulycore.com.
What we collect, and why
| Data | Where it comes from | Why we process it | Lawful basis |
|---|---|---|---|
| Account details — name, email address, sign-in identifiers | You, when you create an account | Operating your account and sending the reminders you asked for | Contract |
| Company records — company numbers, filing dates, officer appointments | Public registers, principally Companies House | Building and maintaining your compliance calendar | Legitimate interests |
| Documents you upload, and the dates and fields extracted from them | You | Tracking the obligations the documents evidence | Contract |
| Billing details | You, at checkout | Taking payment and meeting tax and accounting duties | Contract; legal obligation |
| Support correspondence | You, when you email us | Answering you, and keeping a record of what was agreed | Legitimate interests |
Where we process personal data about company officers taken from public registers rather than from the person directly, our Article 14 notice explains that processing, and our legitimate interests assessment sets out the balancing test behind it.
Where your data lives
Customer data is stored and processed in the United Kingdom, encrypted in transit and at rest. Where a service provider processes data on our behalf outside the UK, we use recognised transfer safeguards.
Who receives it
We share personal data only with the categories of service provider needed to run the product: cloud hosting and infrastructure providers, an authentication provider, a payment processor, an email delivery provider, document-processing services used to extract dates and fields from files you upload, and error-monitoring and logging services. Each processes data under contract, on our instructions. We never sell personal data, never share it for advertising, and never use your documents to train public AI models.
How long we keep it
Account data is kept while your account is open and deleted or anonymised within 90 days of closure, except where law requires longer (for example, accounting records). Uploaded documents are deleted when you delete them or close your account. Reminder and audit logs are kept for as long as the record they evidence remains live, because they are the record of what was checked and confirmed.
Reminder and statutory-deadline email carries no tracking pixels and no rewritten links. We do not measure opens on mail whose job is telling you a deadline is coming.
Your rights
You can ask for access to your personal data, correction, erasure, restriction, a portable copy, and you can object to processing based on legitimate interests. Write to hello@dulycore.com — we respond within one month. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes
When this notice changes materially we will say so on this page and, for account holders, by email. The date at the top is the date of the current version.