Privacy policy

Last updated: 3 October 2026

1. Who we are

DebtRadar is a product of IRH Consulting Limited (“IRH”, “we”, “us” or “our”).

• Registered in England and Wales, company number 07610148.
• Registered office: 16 Old Place, Sleaford, NG34 7HR, England.
• Registered with the Information Commissioner’s Office (ICO), registration number ZC087568.

IRH is the controller of the personal data this policy describes. You can contact us about it at privacy@debtradar.co.uk.

2. Who this policy is for

This policy covers people who:

• visit the DebtRadar website;
• ask for a sample through our website, or email us;
• receive the DebtRadar weekly email at a subscribing firm;
• work at an advisory firm that we contact about DebtRadar; or
• are named in the public registers we use (section 3): the directors, company secretaries, LLP members and people with significant control of UK companies and LLPs, and the insolvency practitioners, auditors, other signatories and lenders named in what those companies file or in notices about them.

3. Notice to people named in public registers

This section is our notice under Article 14 of the UK GDPR. It is for everyone whose details we take from public registers:

• anyone who is, or has been, a director, company secretary, LLP member or person with significant control (PSC) of a UK company or LLP;
• insolvency practitioners named in a notice about a company, or in a document a company has filed;
• auditors named in a company’s accounts, such as the senior statutory auditor who signs the auditor’s report;
• anyone else who signs a document that a company files without being one of its directors; and
• anyone named as the lender, or “person entitled”, on a charge that a company has registered.

Where your information comes from. We collect it from public registers:

• the register of companies kept by Companies House, including the registers of officers, of people with significant control and of charges, and the documents that companies file there; and
• The Gazette, the UK’s official public record, including its insolvency notices.

What we hold. What those registers show about you, which can include:

• your name, and the role or capacity in which the register names you (for example director, PSC, liquidator, auditor or lender);
• if you are a director, company secretary, LLP member or PSC: the dates you were appointed or resigned, or became or stopped being a PSC; your month and year of birth, nationality, country of residence and occupation; and the correspondence address shown on the register;
• if you are a PSC, the nature of your control, such as the band your shares or voting rights fall into;
• if a charge names you as the lender, the charge: when it was created or satisfied, and what it secures; and
• your name, and the details printed with it such as your firm and its address, where it appears in a document a company has filed or in a notice about a company. Examples are the director who signed its accounts, the auditor who signed its auditor’s report and the insolvency practitioner a notice names.

Our archive of notices from The Gazette also holds personal insolvency notices, such as bankruptcy orders: we do not use them, and we are reviewing whether to keep them.

Why we use it. DebtRadar flags UK companies that show early signs of refinancing pressure or distress, so that advisory firms can offer them help. We use your information to:

• work out how companies are grouped and who controls them;
• spot changes at a company, such as several directors leaving in a short time;
• read the accounts, other filings and notices that a flag rests on, which name the people who signed or issued them; and
• show subscribers who lends to a company, from the charges it has registered.

What our leads show. A lead is about a company. It does not name the company’s directors or PSCs, or the insolvency practitioners, auditors or other signatories in its documents. It may name the lenders on the company’s registered charges. Most lenders are banks or other businesses. Where a lender is a person, the lead calls them “a private individual” and does not give their name. A lead may link to a document on the public register that names you, but we do not copy your name into the lead.

Our flags are about companies. We do not score, rank or profile you.

Our lawful basis. Legitimate interests (Article 6(1)(f) UK GDPR). Our interest, and our subscribers’, is to find companies that may need refinancing or restructuring advice. Those companies have an interest in getting that advice early, while there is still time to act. We record how we weigh these interests against yours in a legitimate interests assessment. Its main points are that the information is already public, that it concerns your dealings with a company rather than your private life, and that we use only what we need. You can ask us for a summary of that assessment.

Who receives it.

• Subscribers. These are debt advisory, restructuring and insolvency firms that receive our weekly email. A lead does not give them your name, as “What our leads show” explains.
• Firms that ask for a sample. A firm that asks for a sample on our website receives a sample of our leads by email. It may not be a subscriber, and may never become one. A sample follows the same rules as a lead.
• Each subscriber, and each firm that receives a sample, is a separate controller of what it takes from a lead. If one of them contacts you, that firm is responsible for the contact, and it must comply with data protection law and the Privacy and Electronic Communications Regulations (PECR). You can object to that firm directly as well as to us.
• Our service providers, listed in section 6, who process it on our behalf. Section 7 covers transfers abroad.

How long we keep it. We keep our archive of public documents about companies, which can name people such as a signing director, an auditor or a lender, for as long as DebtRadar runs, as the evidence behind our leads, and nothing in it is deleted, unless you successfully object or the law requires it. The archive includes our copies of the registers. When a register changes, we update our copy the next time we refresh it.

Your other rights are in section 9. They include the right to complain to the ICO.

Why we have not written to you. We do not contact people because a register names them, so we publish this notice instead of writing to each of them (Article 14(5)(e) UK GDPR). If you also work at an advisory firm, we may email you about DebtRadar, as section 4 explains.

Automated decisions. We make no decision about you by automated means. See section 5.

4. Information you give us

We use this information only for these purposes.

5. How we use AI

DebtRadar uses AI to read company documents and data and to spot the early signs of refinancing pressure and distress.

• Our flags are about companies. A flag is a reason for an advisor to look more closely at a company. It is not a judgement about any person.
• We make no decision about any person by automated means, and nothing DebtRadar does has a legal or similarly significant effect on anyone (Article 22 UK GDPR).
• We use Anthropic’s Claude models, both through Anthropic’s own service and through AWS Bedrock. The documents we send them can contain people’s names.
• Anthropic and AWS process this data only for us. Their terms do not allow them to use it to train their models.

6. Who we share data with

We share personal data only with:

• subscribers, and firms that ask for a sample, as section 3 describes;
• the service providers below, who process it for us under contracts that require them to keep it secure and to use it only on our instructions; and
• anyone the law requires us to share it with.

7. International transfers

We store DebtRadar’s data in the UK, in AWS’s London region, and we send our emails from there through Amazon SES. Some processing happens abroad:

• Anthropic (United States). Our contract is with Anthropic Ireland, Limited, and Anthropic processes the data in the United States. The transfer is covered by the EU standard contractual clauses with the UK International Data Transfer Addendum issued by the ICO. Both are part of Anthropic’s data processing addendum.
• AWS Bedrock (Europe). When we use Claude models through AWS Bedrock, a request may be processed in an AWS region elsewhere in Europe. UK law recognises the European Economic Area and Switzerland as giving adequate protection.
• DigitalOcean (EU or United States). Batch jobs that need specialist hardware may run in DigitalOcean’s EU or US data centres. The EU is covered as above. For the US, DigitalOcean is certified to the UK Extension of the EU-US Data Privacy Framework (the “UK-US data bridge”).
• Google (United States and elsewhere). Google may store our email inboxes in any country where it or its subprocessors have facilities. For the US, Google LLC is certified to the UK-US data bridge. For other countries, Google’s data processing terms provide standard contractual clauses.

You can ask us for a copy of these safeguards at privacy@debtradar.co.uk.

8. How long we keep data

Where we keep data for 6 years, that is the usual time limit for contract claims in England and Wales.

We keep our archive of public documents about companies, which can name people such as a signing director, an auditor or a lender, for as long as DebtRadar runs, as the evidence behind our leads, and nothing in it is deleted, unless you successfully object or the law requires it.

9. Your rights

Under UK data protection law you have the right to:

• object to our use of your data where we rely on legitimate interests, and to direct marketing at any time (see the box at the top of this policy);
• access your data, by asking for a copy of what we hold;
• correct data that is wrong or incomplete;
• delete your data, in some circumstances, including from our archive if you successfully object or the law requires it (section 8);
• restrict how we use your data, in some circumstances; and
• port data you gave us, in a machine-readable format, where we rely on a contract with you.

To use any of these rights, email privacy@debtradar.co.uk. We reply within one month. If a request is complex, or you send us several, we can take up to two more months, and we will tell you within the first month if we need to. We may ask you to confirm your identity. There is normally no charge.

If you are unhappy with how we have handled your data, please tell us first at privacy@debtradar.co.uk. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.

10. Security

• Data is encrypted in transit (TLS), and the data we store in AWS is encrypted at rest.
• Access is limited to the people and systems that run DebtRadar.
• The temporary servers we use for batch jobs are deleted when each job ends.

No system is completely secure, so we cannot guarantee security. If a breach affects your data, we will tell you and the ICO where the law requires it.

11. Cookies

The DebtRadar website sets no cookies and loads nothing from other companies’ servers. Our cookie statement says more.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change is significant, we will email subscribers before it takes effect.

13. Contact

For questions about this policy or your data, email privacy@debtradar.co.uk, or write to IRH Consulting Limited, 16 Old Place, Sleaford, NG34 7HR, England.