Privacy notice
This notice explains what personal data Basic Reporting holds, why, for how long and what your rights are. It is written for people who visit the website, people who use the service on behalf of their firm, and people who contact us.
Who we are
Basic Reporting is a service of Regulatory Advice Limited ("we"), registered in England and Wales, company number 12194508, registered office 3 Sovereign Place, Hatfield AL9 5ET. We are registered with the Information Commissioner's Office, registration number ZB265569. Contact us about anything in this notice at support@basicreporting.com.
Two different roles
- For our own users and visitors we are the controller. That covers the details of the people who use the service for their firm, billing contacts, website visitors and anyone who writes to us. This notice is about that data.
- For the transaction reports firms send us, we act for the firm. Reports contain personal data about the firm's clients and staff, such as names, dates of birth and national identifiers, because UK MiFIR requires it. The firm decides what is reported and is the controller of that data; we process it only on the firm's instructions, under the data protection terms in our terms (the Schedule). If you are named in a firm's transaction report and want to exercise your rights, contact that firm. We help it answer.
What we hold, why, and for how long
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Visits to the website: your IP address, the page asked for and the time, in our server's log | To keep the service running and secure, and to look into misuse | Our legitimate interest in running a secure service | 90 days |
| Your account: your name, work email address, your firm and its LEI, and a salted hash of your password (we never hold the password itself) | To give you access to the service | The contract with your firm | While your firm uses the service, then six years |
| Sign-in and activity records: when you signed in, and what you did in the service (uploads, decisions to send reports despite warnings, reports set aside, changes to settings) | Security, and a record of the instructions your firm gave us, which our terms promise to keep | The contract with your firm, and our legitimate interest in being able to show what was done and by whom | Five years |
| Agreements: who accepted our terms and declarations, when, from which IP address and browser, and the wording accepted | Proof of what was agreed | The contract, and our legitimate interest in being able to show it | While your firm uses the service, then six years |
| Billing: the billing contact's name and address, VAT number, invoices and payments. Card details are taken by Stripe on its own page and never reach us | To bill for the service and keep the accounting records the law requires | The contract, and our legal obligation to keep accounting records | Six years after the end of the financial year they relate to |
| Emails: messages you send us, and the service and alert emails we send you | To answer you and run the service | Our legitimate interest in running the service and answering enquiries | Two years |
| Backups of all of the above | To recover the service after a failure | Our legitimate interest in a resilient service | Daily for 30 days and one a month for 12 months, so deleted data leaves the backups within 13 months |
We do not sell personal data, use it for advertising, or combine it with data from elsewhere to profile anyone.
Cookies
The service sets one cookie, basik_session, which keeps you signed in. It is strictly necessary, so it needs no consent. It lasts until you sign out or after 30 minutes without activity. We use no analytics, advertising or tracking cookies and no third-party scripts.
Who we share it with
| Who | What for | Where |
|---|---|---|
| Mythic Beasts | Hosts our main server | United Kingdom |
| Krystal | Holds our encrypted backups | United Kingdom |
| See "Transfers" | ||
| Stripe | Card payments and invoices | See "Transfers" |
| DTCC (our Approved Reporting Mechanism) | Receives the transaction reports we submit for firms, and passes them to the FCA | Germany, with Ireland as back-up |
| Objectivus Financial Consulting Limited | Our standby operator. The standby operator sees data only while running the service because our director is unavailable | United Kingdom |
| Our professional advisers, and the FCA or other authorities | Where needed for advice, or where the law requires | United Kingdom |
Transfers outside the United Kingdom
Our own servers are in the United Kingdom. DTCC processes reports in the European Economic Area, which UK law treats as adequate. Google and Stripe may process data in the United States; those transfers rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the International Data Transfer Addendum to the EU standard contractual clauses.
Security
The website is served only over HTTPS. Passwords are stored as salted hashes, sessions end after inactivity, every firm sees only its own data, and backups are encrypted and test-restored every month. The service has been tested by an independent security tester, from outside and while signed in.
Automated checks
The service checks every report automatically and holds back or flags reports it finds problems with. These checks are about the data in reports. They do not make decisions with legal or similarly significant effects on you: your firm decides what to send.
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, or to have it in a portable form. Some of these rights are limited where we must keep records, for example accounting records or the record of a firm's instructions. Write to support@basicreporting.com. We answer within one month.
If you are unhappy with how we have handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Changes
We will update this notice when what we do changes, and show the date of the latest version here. This version: 6 November 2026.
Another question? Ask your own AI assistant: tell it to read basicreporting.com/llms-full.txt.