Who we are
This privacy policy explains how Form My Company collects, uses and protects personal data when you use our website, client account and services.
The data controller is IBA Limited, trading as Form My Company (registered in Scotland, company number SC660379), 9a Tinto Place, Edinburgh EH6 5GD, Scotland. Email: info@formmycompany.co.uk. Phone: 0131 322 1309.
We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The data we collect
We collect only what we need to provide our services and meet our legal duties. This may include:
- Contact details — name, email address, phone number and postal address
- Company details — proposed company name, business activity, share structure and registered office
- Details of directors, shareholders, members and people with significant control — full name, date of birth, nationality, country of residence, occupation, residential and service addresses
- Identity and anti-money-laundering (AML) information — copies of passports, ID cards, proof of address, Companies House personal codes and the results of identity checks
- Order and payment information — what you bought, invoices and payment status. Card and bank details are handled by our payment provider, Mollie; we do not see or store your full card details
- Messages — emails, phone notes and messages sent through your client account
- Technical data — IP address, browser type, pages visited and, if you agree, analytics data
If you give us information about other people, such as co-directors or shareholders, you must make sure they know you are sharing it and have seen this policy.
How we use your data and our legal basis
- To provide our services — forming companies, filing with Companies House and HMRC, providing addresses and handling post. Legal basis: performance of a contract.
- To verify identity for Companies House — as an Authorised Corporate Service Provider (ACSP), we verify the identity of directors and people with significant control and report the result to Companies House. Legal basis: legal obligation and performance of a contract.
- To verify identity and prevent financial crime — AML checks, sanctions screening and record keeping under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Legal basis: legal obligation.
- To file information that the law requires to be public — some details of directors, shareholders and PSCs appear on the public Companies House register. Legal basis: legal obligation and performance of a contract.
- To run your client account — sign-in links, order status, documents and messages. Legal basis: performance of a contract.
- To take payments and keep accounting records. Legal basis: performance of a contract and legal obligation.
- To send service reminders — for example, confirmation statement deadlines or address renewals. Legal basis: legitimate interests in helping clients stay compliant.
- To improve our website — using analytics only if you consent. Legal basis: consent.
- To send marketing emails — only if you opt in. You can unsubscribe at any time. Legal basis: consent.
Who we share your data with
We share personal data only where needed:
- Companies House and HMRC — to file applications, returns and registrations
- Identity verification and AML providers — to check identity documents and screen against sanctions lists
- Mollie B.V. — our payment provider, which processes payments as an independent controller under its own privacy policy
- Service providers — hosting, email delivery, cloud storage and IT support, under contracts that require them to protect your data
- Professional partners — such as accountants, notaries or couriers, only when you order a service that needs them
- Regulators and law enforcement — where the law requires us to, including reports under anti-money-laundering law
We do not sell your personal data.
International transfers
Some of our service providers may process data outside the UK. When they do, we make sure the transfer is protected, for example by a UK adequacy regulation or the UK International Data Transfer Agreement or Addendum.
How long we keep your data
- AML and identity records — 5 years from the end of our business relationship with you, or from the date of a one-off transaction, as required by the Money Laundering Regulations 2017. We may keep them longer if the law or a regulator requires it.
- Accounting and invoice records — 6 years from the end of the financial year they relate to.
- Company formation and filing records — for as long as we act for your company, then 6 years.
- Client account messages — for as long as your account is open, then 6 years.
- Marketing preferences — until you unsubscribe or withdraw consent.
- Website analytics — up to 14 months.
After these periods we delete or anonymise the data securely.
How we protect your data
Identity documents and company records are stored in encrypted systems with restricted access. Your client account uses secure, time-limited sign-in links sent to your email address. Please do not send ID documents by ordinary email; upload them through your client account instead.
Cookies
We use essential cookies to make the website and client account work — for example, to keep you signed in, remember your basket and protect forms against misuse. These do not need your consent. One of these remembers the language you chose (or were shown on your first visit), so the site opens in that language next time.
We use analytics cookies only if you agree through our cookie banner. They help us understand how the site is used. You can change your choice at any time using the cookie settings link at the bottom of every page.
Your rights
Under UK data protection law you have the right to:
- Ask for a copy of your personal data
- Ask us to correct inaccurate data
- Ask us to delete your data, where we have no legal reason to keep it
- Ask us to restrict or object to certain uses
- Ask for your data in a portable format
- Withdraw consent at any time, where we rely on consent
Some rights are limited. For example, we cannot delete AML records before the legal retention period ends, and we cannot remove information from the public Companies House register — only Companies House can do that, in limited cases.
To use any of these rights, email info@formmycompany.co.uk. We will reply within one month.
Complaints
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed.