CHART Privacy Statement

Last updated: 3 June 2026

This Privacy Statement explains how CHART uses personal data.

CHART is a business-to-business analytical platform for professional users. It helps users explore and interpret public and official data about UK companies, company activity, innovation, governance, finance, providers, projects and company-related people.

CHART is designed for professional screening, research and analysis. It is not legal, financial, tax, audit, credit, investment, procurement or other professional advice.

1. Who this Privacy Statement applies to

This Privacy Statement applies to:

users of the CHART platform;
administrators and contacts at client organisations;
prospective client contacts and other business contacts;
people who contact CHART for support, privacy requests or general enquiries;
company officers, directors, company secretaries, persons with significant control and other people whose information appears in public or official company records used by CHART;
people associated with public innovation, provider, project or research organisation data, where applicable; and
people whose personal data is entered into CHART by users, for example in organisation-level comments, notes or saved context.

2. Who is responsible for personal data

For the purposes of UK data protection law, the current controller is:

Whitestone Analytics
Operator of CHART
Contact: support@whitestoneanalytics.co.uk

Client organisations are responsible for their own use of CHART outputs and for personal data they choose to enter into CHART, such as comments, notes or business development information. More detail about client responsibilities is set out in CHART's terms of use and related data-use documentation.

3. Personal data CHART uses

3.1 Platform users and client contacts

CHART may process personal data about platform users, client administrators, prospective clients and business contacts, including:

name, role, organisation and business contact details, where provided;
email address;
account role and permission level;
account status, such as active or inactive;
password hash, not plaintext password;
password reset status;
login and account creation timestamps;
authentication and session information;
admin account management actions;
saved filters, saved searches, saved lists or similar preferences;
support requests, privacy enquiries and business communications;
business development and relationship management notes; and
technical, security and operational logs where generated by the platform or hosting environment.

Accounts are currently created by CHART administrators.

Password reset emails and related communications are sent using Microsoft Outlook or related Microsoft services.

3.2 Public-source company and people data

CHART uses public and official datasets about UK companies and related activity. Some of these datasets include personal data.

This may include information about:

company officers, directors and company secretaries;
persons with significant control;
disqualified officers, where available from public sources;
company-related individuals appearing in public filings or official registers; and
individuals associated with public innovation, project, provider or research organisation data, where applicable.

The personal data may include:

names;
roles, appointments and resignation dates;
company relationships;
control or ownership-related information;
nationality, country of residence, occupation or month and year of birth where included in public source data;
service or correspondence addresses where included in public source data;
disqualification-related information where available from public sources; and
source links, timestamps and provenance information.

CHART may retain raw public-source records and payloads from Companies House and similar sources. This means CHART may hold source fields that are not displayed directly in the product.

Public availability does not mean information stops being personal data. CHART treats public-source personal data as personal data where it relates to an identifiable living person.

3.3 Derived analytical indicators

CHART may clean, standardise, link, aggregate and summarise source data to produce analytical outputs. These may include:

company exposure summaries;
current and historic appointment summaries;
governance and control indicators;
company group or entity interpretations;
sector and geography exposure summaries;
innovation or RD&I indicators;
high-growth company exposure indicators;
financial screening indicators;
disqualification-related signals;
matching confidence labels; and
other screening or intelligence indicators.

These outputs are designed to support professional analysis. They should not be treated as definitive legal findings about any person or organisation.

Where CHART links records that may relate to the same officer or person, it primarily uses source identifiers supplied by official data sources. CHART does not currently create officer identity groupings by fuzzy matching names, dates of birth, addresses, occupations or appointment patterns. Some links or indicators may be confidence-based and should be treated as analytical aids rather than definitive identity determinations.

3.4 User comments, notes and organisation data

CHART may allow users to save comments, business development notes, saved lists or other organisation-level information against companies or other records.

These notes may be visible to authorised users within the same client organisation. They are not necessarily private to the individual user who entered them.

Users should not enter unnecessary personal data, special category data, criminal offence data, confidential third-party information, defamatory material or information they are not authorised to use.

3.5 Browser storage and session data

CHART uses essential browser storage, including sessionStorage, to operate the application. This may include:

authentication token;
signed-in user context;
query or cache data;
navigation return context; and
information needed to keep the user signed in and allow the application to function.

CHART does not currently use advertising cookies, marketing cookies, analytics cookies, heatmaps, replay tracking or behavioural advertising technologies.

Further information is provided in CHART's Cookie Policy.

3.6 Map and location-related data

CHART may provide map-based views using MapLibre with map tiles or styles supplied by Azure Maps, TomTom or Ordnance Survey, depending on configuration.

When a map is loaded, the user's browser may request map tiles, styles or related resources from a map provider. This may expose technical data such as:

IP address;
browser and device information;
requested tile or style URL;
approximate map area being viewed; and
date and time of request.

CHART map views may use postcodes, postcode clusters, centroids or other approximate geographic references. Unless expressly stated, map points should not be treated as precise personal residential locations.

4. Where CHART gets data from

CHART uses or may use data from sources such as:

Companies House company data;
Companies House streaming APIs;
Companies House REST API;
Companies House filing history;
Companies House Document API;
company accounts, including iXBRL and XBRL-derived accounts where available;
public company officer and director data;
persons with significant control data;
company charges, insolvency and disqualified officer data where available;
Innovate UK, UKRI or Gateway to Research style project data;
provider, university and research organisation datasets;
HESA spinout datasets;
postcode and geography lookup data;
sector, SIC and taxonomy mappings;
map data or map services from Azure Maps and TomTom; and
information provided directly by users or client organisations.

Source data may be incomplete, delayed, restated, erroneous or unsuitable as the sole basis for decisions. CHART may update records when new source data is received or when refresh processes update CHART's database.

5. Why CHART uses personal data

CHART uses personal data for the following purposes:

creating and managing user accounts;
authenticating users and securing access to the platform;
providing the CHART platform and its analytical features;
saving user preferences, saved filters, saved searches, lists, notes and organisation context;
supporting users and responding to enquiries;
sending password reset and service-related emails;
building, maintaining and improving company, governance, innovation, finance, provider, project and people intelligence;
linking, standardising and summarising public-source records;
creating screening indicators, confidence labels and analytical summaries;
maintaining provenance, auditability, data quality and source history;
detecting misuse, protecting security and enforcing terms;
managing client relationships and prospective client enquiries; and
complying with legal obligations and protecting legal rights.

6. Lawful bases

CHART relies on different lawful bases depending on the purpose.

These may include:

contract, where processing is needed to provide access to CHART or manage a client or user relationship;
legitimate interests, where processing is needed for CHART's professional intelligence platform, security, support, business development, product operation, data quality, provenance or misuse prevention, provided those interests are not overridden by individual rights and interests; and
legal obligation, where processing is necessary to comply with a legal requirement.

CHART's legitimate interests include:

providing professional users with company, governance, innovation, finance and economic intelligence;
making public and official company data easier to search, understand and interpret;
linking, standardising and explaining public records in an analytical format;
maintaining source provenance and data quality;
securing the platform and preventing misuse;
supporting client organisations and users;
managing prospective and existing client relationships; and
protecting CHART's legal and commercial interests.

Where CHART relies on legitimate interests, it considers the nature of the data, the public-source context, the professional platform context, reasonable expectations, the potential impact on individuals and the safeguards used in the product.

7. Who CHART shares personal data with

CHART may share or make personal data available to:

authorised users within the relevant client organisation;
CHART administrators where necessary to operate, secure and support the platform;
Microsoft Azure and related Microsoft services used for hosting, infrastructure, database, logging, email delivery or operational support;
map providers such as Azure Maps or TomTom where map functionality is used; and
professional advisers, regulators, authorities or other parties where necessary for legal, regulatory, security or dispute-resolution purposes.

CHART does not sell user account data to advertisers.

CHART does not currently use advertising cookies or behavioural advertising technologies.

8. International processing

CHART primarily uses Microsoft Azure infrastructure. Some supporting services, logs, frontend hosting, map services, support operations or provider operations may involve locations outside the United Kingdom.

Where personal data is transferred outside the UK, CHART will use appropriate safeguards required by applicable data protection law.

This section should be read subject to CHART's actual hosting, logging, email and map-provider configuration at the time the service is used.

9. How long CHART keeps personal data

CHART keeps personal data only for as long as needed for the purposes described in this Privacy Statement, unless a longer period is required for legal, audit, security or legitimate business reasons.

Current retention approach:

user account records are retained while the account or client relationship is active, then deleted or anonymised within a reasonable period unless needed for legal, audit or security reasons;
password hashes are retained while the account exists or until reset or deletion;
browser session data is retained in the browser until logout, expiry, clearing or replacement;
admin account management actions may be retained for audit and security purposes;
security and operational logs may be retained for operational, troubleshooting, misuse-prevention and security purposes;
support and business communications may be retained while needed to manage the relationship, respond to enquiries and maintain an appropriate record;
saved filters, saved searches, notes and comments may be retained while the relevant account or organisation workspace remains active, unless deleted earlier or otherwise agreed;
public-source company, officer, PSC, disqualified officer, filing, provider, project and geography data may be retained while relevant to CHART's analytical database and product functionality;
historic public-source data may be retained for provenance, auditability, time-series analysis, source reconstruction and data quality purposes;
raw public-source payloads may be retained indefinitely for provenance, auditability, source reconstruction, debugging and data quality purposes; and
derived indicators and analytical summaries may be retained while relevant to product functionality and refreshed or superseded as source data changes.

CHART may review and update this retention approach as the product develops.

10. Security

CHART uses technical and organisational measures designed to protect personal data, including:

authenticated access;
role-based user permissions;
password hashing rather than plaintext password storage;
administrative controls for account creation, activation and deactivation;
password reset controls;
hosted database and infrastructure security controls;
operational logging and monitoring where configured; and
restricted administrative access.

CHART does not currently provide administrator impersonation of user accounts.

No system can be guaranteed completely secure. Users must keep their login details confidential and notify CHART if they believe their account has been compromised.

11. Individual rights

Depending on the circumstances and lawful basis, individuals may have rights under data protection law, including the right to:

request access to their personal data;
request correction of inaccurate personal data;
request erasure of personal data;
request restriction of processing;
object to processing based on legitimate interests;
request data portability where applicable; and
complain to the Information Commissioner's Office.

Some rights are not absolute and may depend on the context, the nature of the data and the lawful basis for processing.

Where personal data comes from a public or official source, CHART may not be able to amend the original source record. In those cases, the individual may need to contact the original source, such as Companies House or another relevant public body. CHART can review how its own platform displays, matches, derives or interprets that source data.

To make a request, contact support@whitestoneanalytics.co.uk.

12. Automated decisions and profiling

CHART provides analytical indicators, matching confidence labels, exposure summaries and screening signals.

CHART does not intend its outputs to be used as the sole basis for decisions that have legal, financial, employment, procurement, eligibility or similarly significant effects on individuals.

Users and client organisations must apply their own judgement, checks and lawful decision-making processes before taking action based on CHART outputs.

13. Changes to this Privacy Statement

CHART may update this Privacy Statement from time to time, including where:

the product changes;
a limited company is created to operate CHART;
new data sources are added;
new client features are introduced;
retention practices change;
subprocessors or hosting arrangements change; and
legal or regulatory requirements change.

The updated version will be made available through the platform or other appropriate channels.

14. Contact

For privacy questions or requests, contact support@whitestoneanalytics.co.uk.

Individuals can also complain to the Information Commissioner's Office if they are unhappy with how their personal data has been handled. The ICO is the UK regulator for data protection.