Purpose	Lawful Basis
Handle complaints, disputes and our professional records	Legitimate interests in resolving issues and establishing or defending legal claims; legal obligation where a specific duty applies.
Measure website use and advertising performance and support relevant advertising through optional analytics and advertising tags	Consent where required by cookie and electronic-marketing rules. RegScreener's optional analytics uses consent. See section 6 for each website.
Send newsletters and relevant business marketing	Consent for newsletter subscriptions requested through an opt-in. Legitimate interests for other business marketing where electronic-marketing rules permit; consent where those rules require it. You can object at any time.
Coordinate relevant consulting support and service-related referrals	Legitimate interests in obtaining specialist help and responding to the enquiry, subject to the limits in section 5. Consent where required or where a proposed optional disclosure falls outside reasonable expectations.
Operate and protect our websites and services, investigate misuse and resolve technical problems	Legitimate interests in making the websites available, securing our services, preventing abuse and keeping them reliable.
Administer payments and keep financial records	Contract or legitimate interests in collecting payment, depending on the relationship above; legal obligation for required accounting and tax records.
Provide accounts, subscriptions, support and consulting	Contract where you personally are the contracting party. For contacts and users of a corporate customer, legitimate interests in providing and administering the service.
Respond to website enquiries, arrange consultations and manage business relationships	Legitimate interests in answering requests, understanding requirements and communicating with business contacts. Where you personally are the prospective contracting party, steps you request before a contract may apply.

1. Who we are and what this notice covers

R&R Compliance Consultancy Ltd, trading as RR Compliance Associates, operates RegScreener (also referred to as RegScreen). We are registered in England and Wales under company number 12070286, with our registered office at 51 Lime Street, London, England, EC3M 7DQ.

This notice covers rrcompliance.com, our consulting and compliance-support services, and the RegScreener website and service at regscreener.regzone.io. It explains our use of information about website visitors, enquirers, newsletter subscribers, client and supplier contacts, account users and people included in checks.

RegScreener provides company-register comparison, sanctions and AML screening, automated reminders and monitoring, and compliance records and reports. The screening-specific paragraphs below apply to that service. The website, contact, consulting and marketing paragraphs apply to the relevant activities across both websites.

For privacy enquiries, rights requests or complaints, contact us by email at contact@rrcompliance.com. You can also telephone +44 (0) 203 488 4322 or write to our registered office, marked “Privacy”.

2. Our role when information is used

We decide how information is used to operate our websites, respond to enquiries, arrange consultations, manage newsletters, accounts and billing, protect our services and maintain our own consulting and legal records. For those activities, we are the data controller.

When a customer submits someone for screening, the customer decides why the check is needed and must have a lawful reason to use that person's information. We carry out the check and manage the resulting records on the customer's instructions. For that work, we are a data processor, or a subprocessor if the customer acts for another organisation. These processing arrangements are included in the RegScreener terms of service. Where we handle personal information solely on a consulting client's instructions, the applicable engagement and data-processing arrangements govern that work.

If you have been screened by a customer, its privacy information explains its reasons and decisions. Contact that organisation about its use of the results, or contact us for help directing your request. We remain responsible for our own data-protection duties.

3. Information we handle and its sources

We receive information through website forms, newsletter sign-ups, correspondence, consultation requests and use of our services. Information may also come from the organisation using the service, its authorised users and representatives, and relevant service providers.

RegScreener checks use supported sources, including Companies House, the Financial Conduct Authority register, the ICO register and screening datasets accessed through OpenSanctions. Source references accompanying results identify the underlying records where available. Public availability does not remove data-protection obligations.

Depending on the service used, information includes:

Contact and account details: name, business, role, email, telephone number, permissions, authentication records and support correspondence.
Website enquiries and subscriptions: contact-form messages, consultation arrangements, service requirements, newsletter choices and records of subscription or withdrawal.
Screening details: names and aliases, dates of birth or other relevant dates, nationality or country, addresses, company links and identifiers submitted for a check or returned by a source.
Results and compliance records: possible sanctions, politically exposed person and structured adverse-information matches, source evidence, scores, reports, review notes and decisions, monitoring settings and reminders.
Consulting information: relevant instructions, documents, advice, findings and correspondence from a consulting or compliance-support engagement.
Payment records: RegScreener billing contacts, subscription and credit purchases, invoices, transaction references and payment status, together with consulting invoice records where relevant. Payment providers handle payment details through their services. rrcompliance.com does not take website payments.
Technical and preference information: IP address, device and browser information, access and security logs, website interactions, cookie choices and marketing preferences.

On rrcompliance.com, Google Analytics and LinkedIn/Meta advertising tags may collect online identifiers, device and browser information and website interactions, depending on the relevant consent choices and configuration. These tools help measure website use and advertising performance and support relevant advertising.

Source material or review notes may contain sensitive information, including political affiliations, or allegations, convictions and other criminal-offence information. These categories require additional legal conditions and safeguards. Legitimate interests alone do not satisfy those additional requirements. We handle customer screening records under lawful instructions and applicable source restrictions.

We identify information needed to answer an enquiry, arrange a consultation, open an account, take payment or perform a requested check when it is collected. Without it, we may be unable to provide the relevant function. Supply only information relevant to your request. Newsletter subscriptions are optional.

4. Why we use information

This table explains our reasons for using information to operate rrcompliance.com and RegScreener and provide consulting. Customer-directed screening follows the arrangement explained in section 2.

PurposeLawful basis

We assess whether each use based on legitimate interests is necessary and whether your interests, rights or reasonable expectations outweigh it. Accepting the service terms does not constitute consent to optional analytics or marketing that requires consent.

5. Who we share information with

Providers and authorised users

Relevant information may be shared with authorised account users; providers of website hosting and forms, storage, screening queries, email and newsletter delivery, consultation scheduling, payments and technical support; and professional advisers, insurers, regulators or public authorities where appropriate. We use Wix to provide rrcompliance.com and its website infrastructure. Google, LinkedIn and Meta receive information through the main website's analytics and advertising tools where enabled in accordance with the relevant choices. Payment processing relates to services such as RegScreener, not payments on rrcompliance.com. Screening queries disclose the identifiers needed for the selected check to the relevant source or query provider.

Providers working on our instructions must meet applicable confidentiality and data-protection requirements. Public registers and some service providers also act independently for their own activities. Current RegScreener subprocessor identities and relevant processing details are provided under the data-processing provisions in its terms; you can also request relevant website or service-provider details at contact@rrcompliance.com.

We may disclose information where required by law or lawfully necessary for legal claims. These disclosures do not require consent.

Affiliated consulting firms and referrals

Our consulting affiliates are specialist regulatory and compliance consulting firms that assist with related advice, specialist support and delivery of an engagement. Where necessary for those purposes, we may share relevant business contact details, an enquiry summary and the engagement information needed for their work. We rely on legitimate interests where the sharing is proportionate and reasonably expected, or contract where applicable. You can request details of the firms relevant to your enquiry or engagement at contact@rrcompliance.com.

We do not give these firms general access to screening records. Customer screening information is shared for consulting support only within the customer's lawful instructions and the applicable processing arrangements. We do not reuse screening inputs or reports as marketing leads.

For a referral, we explain the proposed introduction before sending your details. If the disclosure is outside your reasonable expectations, or consent is otherwise required, we ask for specific consent first. Any consent for another firm's own marketing identifies that firm. Information about recipient categories does not give affiliates unrestricted permission to contact you for marketing.

6. Cookies and marketing choices

rrcompliance.com

The main website uses Wix website infrastructure, newsletter sign-up and consultation booking, together with Google Analytics and LinkedIn/Meta advertising tags. Cookies and similar technologies support website functions, measure visits and advertising performance and support relevant advertising. Optional analytics and advertising technologies requiring consent must remain off until you choose to enable them. A newsletter subscription is separate from consent to tracking.

The cookie banner offers “Accept”, “Decline All” and “Cookie Settings”, where you can choose your preferences. For help changing or withdrawing your cookie choices, contact contact@rrcompliance.com. You can also use your browser settings to block or delete cookies, although this may reset saved preferences or affect website functions. Further information is set out in the rrcompliance.com cookie policy.

RegScreener

The RegScreener public website uses essential storage to remember privacy choices. Optional Google Analytics loads only after you opt in. Choose “Essential only” to decline it, or use “Privacy settings” to change your choice. Refusing analytics does not prevent you from using the service.

The analytics integration measures website visits and interactions. It is configured to exclude contact-form contents and signed-in screening records. Browser cookie lifetimes and Google's retention of collected information are separate; further information is available through the website's privacy controls and from contact@rrcompliance.com.

Cookie choices are managed on each website. A choice made on one website does not automatically apply to the other.

Newsletters and marketing

You can stop our marketing by using the unsubscribe link or contacting us. We retain only the information needed to respect an objection. Necessary account, security and service messages continue while relevant.

Where we rely on consent, you can withdraw it at any time through the relevant settings, unsubscribe link or contact@rrcompliance.com. Withdrawal stops future consent-based use; it does not undo lawful processing already completed.

7. UK hosting and international processing

RegScreener's core application runs on UK-hosted infrastructure. Its primary database of screening records, reports and decisions is stored in the UK. Screening queries, other service-provider processing and authorised access may involve locations outside the UK.

The main rrcompliance.com website, enquiry handling, newsletter delivery and consulting tools use their own service-provider arrangements. The UK hosting statement above applies to RegScreener's core systems; website providers and other suppliers may store or access information outside the UK. Transfers between the UK and the European Economic Area may rely on applicable adequacy arrangements. For other restricted transfers, we use applicable adequacy arrangements or appropriate contractual safeguards, with any required assessment and additional protections. Routine lawful transfers do not require separate consent for each transfer.

Contact contact@rrcompliance.com for information about relevant countries and a copy or explanation of the applicable safeguards, with confidential details protected where necessary.

8. How long information is kept

Customer screening records follow the retention arrangements in the service terms. When paid access ends or a renewal becomes unpaid, records remain available in read-only mode for 30 days. They are then held with restricted access for a further 11 calendar months. During that fixed period, authorised customers can request read-only access or exports at contact@rrcompliance.com. A later request does not restart the period, and restricted records are not used for new screening or monitoring.

At the end of that period, we return or delete customer records under the processing terms, subject to any legally required retention. Earlier lawful deletion instructions may end availability sooner.

For trial accounts that do not become paid subscriptions, we retain trial records for one year after the 30-day trial-credit period expires, then delete or anonymise them, subject to lawful earlier deletion and any required legal retention. This retention does not extend trial credits or entitle the account to further screening. If the account becomes paid, the paid-account retention arrangements apply.

For other information, retention depends on its purpose:

Unsuccessful website enquiries and consultation requests: one year after our last substantive contact. If an enquiry becomes an engagement, the relevant client-record retention arrangements apply.
Consulting records: for the engagement and the period needed to meet applicable obligations or handle a complaint or claim.
Accounts, support and security records: for account administration, resolution of the issue or incident and any necessary legal record.
Financial records: for the applicable accounting and tax retention period.
Marketing preferences and consent records: for as long as needed to apply the choice and demonstrate compliance, including minimal records needed to prevent unwanted contact.

We review retained information and delete or anonymise it when no longer needed. Backup copies awaiting deletion are protected and kept beyond ordinary use until removed through the applicable backup cycle. Specific records may be kept longer where law or a justified legal hold requires it.

9. Screening results and security

RegScreener compares submitted details with available source records and presents possible matches, sometimes with scores or rankings. Names, identifiers, matching thresholds and source coverage affect the result. Monitoring repeats instructed checks; reminders prompt review or follow-up. A possible match is not proof of identity or wrongdoing, and a no-match result is not proof that no risk exists.

The service supports human review. RegScreener does not itself reject a person, end a business relationship or decide that someone has committed wrongdoing. Customers assess the evidence and decide what action to take.

We use technical and organisational safeguards appropriate to the information and risks, including access restrictions and confidentiality obligations. Report suspected unauthorised access or a privacy incident to contact@rrcompliance.com.

10. Your rights

Depending on the circumstances, you may request access, correction, deletion, restricted use or transfer of certain information to you or another provider.

You can object to processing based on legitimate interests. You can object to direct marketing at any time, and we will stop that marketing use.

Contact contact@rrcompliance.com to exercise your rights. We normally respond within one month, subject to any extension or adjustment allowed by law, which we will explain. We may need proportionate information to verify your identity or clarify the request. Requests are normally free; legal exceptions may apply, and we will explain any relevant restriction.

For customer-directed screening, we assist the responsible customer with the request as explained in section 2. This does not prevent you contacting us or the regulator.

11. How to complain

Email contact@rrcompliance.com or write to our registered office with the subject “Data protection complaint”. Explain what happened and the outcome you seek. We acknowledge complaints within 30 days, investigate and communicate the outcome without undue delay, keeping you informed of progress.

You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. Where applicable, you may complain to the data-protection authority where you live or work in the EEA.

12. Changes to this notice

We update this notice when our activities or legal requirements change and show the revised date. We bring significant changes to your attention where appropriate and obtain fresh consent where required. An update does not automatically extend an existing consent.

16 September 2026

RR Compliance and RegZone.io privacy notice

​​