Legitimate Interest Assessment

Reviewed and approved by Fledged Technologies Ltd ahead of launch.

1. Purpose test — why are we processing

We surface the Companies House public register through better search, filters and alerts so accountants, agencies, brokers and B2B sales teams can find relevant new UK incorporations quickly. Surface 2 additionally routes a subset of newcos to our own brands (Sprintly Designs, WeBuildAnyApp, Lexora) for postal outreach.

2. Necessity test

The public register is freely available but has poor UX for combinable filters and no real-time alerting. Our service delivers both. For Surface 2 postal outreach to a registered office, postal mail is PECR-exempt and requires no contact enrichment — which is precisely why we chose postal as the primary channel and why we do not buy or scrape email addresses.

3. Balancing test

• The data is public and was already provided by the data subject to a public register.
• We minimise personal data exposure: officer detail is per-company in-app only, audit-logged.
• We do not enrich with third-party contact data; we do not sell contact data.
• Database-level role separation enforces the company / personal split.
• We honour suppression requests immediately. Suppressed records are excluded from internal lead-gen at output time.
• Postal outreach uses registered office addresses only, which are corporate by nature; each piece carries an opt-out URL.

4. Controls

• Immutable audit log (Postgres trigger + REVOKE UPDATE/DELETE).
• Two separate Companies House API keys so ingestion and user-initiated lookups cannot starve each other.
• Manual signup approval for the first 100 customers, reviewed weekly.
• Rate-limited public suppression endpoint, no auth required.
• Public sub-processor list with notice of changes.

5. Outcome

Legitimate interest is the lawful basis. Data subject rights are preserved and easy to exercise. Surface 2 outputs are constrained to registered office postal communication with a brand-tied offer.

6. Pre-incorporation signals

Fledged ingests signals that may indicate an upcoming UK company formation ahead of the formal Companies House registration. Sources are:

• Companies House name reservations (public, gov.uk).
• UK Intellectual Property Office trademark and patent filings (public, gov.uk).
• Certificate Transparency logs for newly issued TLS certificates on UK domains (public).
• Local Planning Authority change-of-use applications (public, per-council portals).

Each signal is fingerprinted and matched to an actual incorporation when the company appears on the Companies House register. We do not contact pre- incorporation founders directly; the data is used only to enrich the timeline of an eventually-registered company so customers can see its full lifecycle.

7. Company state monitoring

To replace paid commercial credit data sources, Fledged subscribes to free UK government feeds for company state events: The Gazette (insolvency, strike-off, liquidation), Insolvency Service registers (disqualified directors, bankruptcy, corporate insolvency) and HMRC VAT lookup (registration validity). All data ingested under this section is already public.

8. Sole trader processing (Surface 3)

Where lawful, Fledged surfaces UK sole trader records derived from public licensing registers (Food Standards Agency Food Premises Register, Gas Safe Register, NICEIC, Federation of Master Builders, council licensing). Because sole traders are natural persons, additional controls apply:

• Marketing consent defaults to false; sole trader records are not used for cold outreach by any Surface.
• Records are auto-expired 12 months after last public-source verification.
• Right-to-erasure requests at /legal/suppression are honoured immediately.
• Postal outreach (PECR-exempt) is permitted only with explicit Adam-side approval and only when a separate Article 14 disclosure has been served.

The full transparency notice for sole trader processing is published at /legal/sole-traders.

9. Third-party data partners

Fledged may engage third-party data partners (the "Vendor") to enrich a company record with derived business signals (industry classification, employee count band, revenue bracket, operating status, web presence). The Vendor is contractually a processor under our Data Processing Agreement and is forbidden from supplying contact data (email, phone, personal social media). Vendor's own data-collection activities are conducted by the Vendor as an independent controller in its own right, not on behalf of Fledged; the Vendor indemnifies Fledged against any ICO action arising from its collection methods. We do not sell the enrichment output as raw lists; it is incorporated only into derived in-app insights for our paying customers.