Privacy policy
Last updated 6 September 2026.
This policy explains what personal data FiledOnTime holds, why we hold it, and what you can do about it. It covers both the people who hold accounts with us and the individuals whose details appear in the service because they are on the Companies House register.
1. Who is responsible
RWB Digital, a trading name of Christopher Goodchild, of 35 Farne Way, Royal Wootton Bassett, SN4 8LX is the data controller for personal data about account holders and the people they invite. You can contact us at support@filedontime.co.uk.
Where you use FiledOnTime to hold information about your own clients, such as a client contact you invite to the portal, you are the controller of that information and we act as your processor: we handle it on your instructions, for the purpose of providing the service, and for no purpose of our own.
2. What we hold, and why
| Data | Why | Lawful basis |
|---|---|---|
| Your name, email address, password hash | To create and secure your account | Contract |
| Company numbers and names you add | To read the register and calculate deadlines | Contract |
| Director and PSC names, roles, appointment dates and published identity verification status, read from the Companies House register | To track who still needs to verify their identity | Legitimate interests |
| Email addresses of colleagues and client contacts you invite | To send them an invitation and give them access | Legitimate interests, as your processor |
| A record of reminders sent | To avoid sending the same reminder twice | Contract |
| Push notification subscriptions, where you enable them | To send alerts to your device | Consent, which you give by enabling them |
| Billing details held by Stripe | To take payment | Contract |
About officer and PSC data
Names, roles and partial dates of birth of company officers are published by Companies House on a public register. We read that published information for the companies you add, so that we can tell you which individuals still have an identity verification deadline outstanding. We do not enrich it, sell it, or use it for marketing.
If you are an officer of a company someone is tracking and you want to know what we hold, contact us at support@filedontime.co.uk. Note that the underlying entry on the public register is maintained by Companies House, not by us, and only they can change it.
3. Who we share it with
We use a small number of providers, each handling data only to deliver the service:
- Supabase for the database and authentication.
- Vercel for hosting.
- Amazon Web Services (SES) for sending email.
- Stripe for payments. We never see or store your card details.
- Companies House, which we read from and never send your data to.
Some of these process data outside the UK. Where they do, transfers are covered by the appropriate safeguards, such as the UK International Data Transfer Addendum.
We do not sell personal data, and we do not share it for advertising.
4. How long we keep it
- Account data: while your account is open, and for 30 days after you close it.
- Company and officer data: until you remove the company, or close your account.
- Reminder history: two years, so that we can show you what was sent.
- Billing records: six years, as required for tax purposes.
- Portal access links: until revoked, or until the company is removed.
5. Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data, where we have no continuing reason to keep it;
- restrict or object to how we use it;
- provide it in a portable format.
Email support@filedontime.co.uk and we will respond within one month. If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.
6. Security
Data is encrypted in transit and at rest. Access to each account's data is enforced in the database itself, so one account cannot read another's. Passwords are hashed and never stored in a readable form. Portal links use long random tokens and can be revoked at any time.
7. Changes
We will update this policy as the service changes, and will tell account holders by email where a change materially affects them.