Privacy notice

Who we are, what personal data we hold, why we hold it, how long we keep it, and your rights. Written in plain English because that is how we would want to read it.

Who we are

City Solution (UK) Ltd (company no. 09145699), trading as UK Establishment, is the controller of personal data described in this notice. Registered office: 86–90 Paul Street, London EC2A 4NE. ICO registration ZA171285. Contact for anything in this notice: privacy@ukestablishment.com.

What we collect and why

• Enquiries. Name, work email, company, country and what you tell us about your plans, when you complete a form or email us. Used to answer you and, if you become a client, to open your file. Lawful basis: legitimate interests (responding to you), then contract.
• Client onboarding and identity verification. Passport or national ID, a live photograph, proof of address, date of birth, nationality, ownership information and screening results for every director and person with significant control. We are required to collect this by the Money Laundering Regulations 2017 and, as an Authorised Corporate Service Provider, by the Companies Act 2006. Lawful basis: legal obligation. Biometric verification is carried out by our identity-verification provider on our instructions; the check is not repeated without telling you.
• Running your company. Names, addresses, pay, tax codes, bank details and benefit information for directors and employees, as needed for Companies House filings, payroll, VAT and accounts. Lawful basis: contract and legal obligation.
• Website. Server logs (IP address, pages, browser) kept by our hosting provider for security. We do not use advertising cookies. If we add analytics we will use a privacy-respecting configuration and update this notice.

Who we share it with

Companies House and HMRC, as required to file and register. Our identity-verification and sanctions-screening provider. Our software providers (accounting, payroll, document storage, email), each under a data-processing agreement. Revolut Business or another bank, only when you ask us to support an application and only the information the application needs. Our professional indemnity insurers and legal advisers if a claim arises. Regulators and law enforcement where we are legally required — including suspicious activity reports, which we are prohibited from telling you about. We never sell personal data.

International transfers

Client data is held in the UK and the European Economic Area. Where a provider processes data outside the UK we rely on the UK International Data Transfer Agreement or UK adequacy regulations. Because our clients are overseas, we routinely email documents to you in your country; that is at your request.

How long we keep it

Identity, verification and anti-money-laundering records: five years after the end of the business relationship, as required by the Money Laundering Regulations, then deleted. Accounting and tax records: six years after the end of the accounting period they relate to. Enquiries that do not become clients: twelve months. Email: three years unless it forms part of a client file.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it (subject to the retention periods the law imposes on us), object to processing based on legitimate interests, and complain to the Information Commissioner’s Office at ico.org.uk. Write to privacy@ukestablishment.com; we respond within one month.

Changes

We update this notice when our processing changes and show the date at the top.

This notice is a draft prepared for review by the firm’s data-protection lead before publication.