Last updated: 15 October 2026
This page explains how Candor Limited uses personal information: on this website, when you write to Candor or work with it, and when it uses public registers of companies.
Who is responsible
Candor Limited is the data controller for the information described on this page. It is a private limited company registered in England and Wales, company number 17132528, with its registered office at 128 City Road, London EC1V 2NX. It is registered with the Information Commissioner’s Office as a data controller, registration number ZC274279. Anything to do with privacy, including a request to see or delete information held about you, goes to hello@withcandor.dev.
Cookies and analytics
The site sets no cookies. It runs no analytics, no tracking pixels and no third-party scripts. Fonts and images come from this site, not from another host. Nobody is profiled, and there is no advertising.
Hosting
The site is hosted by Cloudflare, Inc., which serves the pages and shields them from attack. To do that it processes the requests a browser makes, including its IP address, and keeps its own short-lived security logs. Candor adds no tracking of its own and keeps no copy of those logs.
The self-assessment questionnaires
The questionnaires on this site run entirely in your browser. Answers stay on your device, and nothing is sent anywhere unless you choose to send it.
If you press send, your answers, the scores worked out from them and anything you type into the contact fields or the note go to Izam Ryan at Candor Limited. That happens either by opening a message in your own email program, or, if the optional storage is switched on, by posting to this site, where the submission is held in a database hosted by Cloudflare in the European Union. Contact details are optional. If you give any, you are asked to tick a consent box first.
No IP address, browser type or other request detail is stored with a submission.
The information is used to read what you sent and to reply. There is no other use. For contact details supplied with a submission the lawful basis is consent, which you can withdraw at any time by emailing hello@withcandor.dev. For replying to correspondence you have started, the lawful basis is legitimate interests: you asked for a reply, and answering you is in both parties’ interests.
Submissions and the correspondence that follows them are kept for 24 months and then deleted. They are deleted sooner if you ask.
Clients, contacts and suppliers
If you work with Candor, are talking to it about work, or supply it, Candor holds your name, role, organisation and contact details, the correspondence between you, and the records of the work. It uses them to run the engagement or the supply, to keep the records the law requires, and to stay in touch about work you have discussed.
The lawful basis is the contract, where you are a party to it. Otherwise it is legitimate interests: running the working relationship between your organisation and Candor. Records the law requires a company to keep are held under that legal obligation.
Correspondence is kept for 24 months after the last contact, unless it forms part of the record of an engagement. Engagement records are kept for as long as the law requires and for as long as a claim about the work could arise, and are then deleted.
Where Candor handles personal data for a client as part of an engagement, the client is the controller, and the client’s own privacy notice applies. Candor acts only on the client’s instructions and under the data terms of the engagement.
Information from public registers
Candor uses the register of people with significant control published by Companies House. From it Candor may hold your name, nationality and country of residence, the postcode of your service address, the size of your holding in a company, and, for some people, your month and year of birth, from which an age group is worked out. Candor does not hold your day of birth or your full address. If Candor contacts you, it also holds the company you are connected with, the contact details it used and a record of the correspondence.
Candor uses this information:
- to produce published figures about companies in a region, which never name individuals;
- to offer the owners and finance leads of companies a free one-page summary of what the public record shows about their company, and to invite a conversation about Candor’s work.
The lawful basis is legitimate interests: Candor’s interest in offering a relevant service to companies and in telling them about its work. Candor weighs that interest against your interests and rights before it uses the information, and you can ask for a copy of that assessment.
If Candor uses this information to contact you, the first message says where the information came from and links to this page.
Lists of people Candor may contact are deleted 90 days after they are made. Correspondence is kept for 24 months after the last contact. If you ask Candor not to contact you, your name, your company and the date and channel of your request stay on a suppression list for as long as Candor contacts companies, so that you are not contacted again.
Who else sees it
Nothing is sold, rented or shared for marketing. Three processors handle information on Candor’s behalf: Google, through Google Workspace, which carries Candor’s email and holds its working documents; Cloudflare, which hosts the site and any stored questionnaire submissions; and Anthropic, which provides the Claude AI models Candor uses in its work. Anyone else sees it only where the law requires it.
Where the information goes
Any stored questionnaire submissions sit in a database in the European Union. Google and Cloudflare are headquartered in the United States and may reach the data from outside the UK under the safeguards in their data processing terms. Candor’s contract for Claude is with Anthropic Ireland, Limited. Anthropic processes data in the United States and other countries, under the UK Addendum to the standard contractual clauses in its data processing terms.
Automated decisions
Candor makes no decision about you by automated means that has a legal or similarly significant effect on you.
Your rights
Under UK GDPR you can ask for a copy of the personal information held about you, have it corrected or erased, have its use restricted, object to its use, ask for it to be sent to you or another organisation, and withdraw consent you have given.
You have an absolute right to object to the use of your information for direct marketing. If you object, Candor stops. You can also object to any other use that relies on legitimate interests.
Email hello@withcandor.dev and a reply will follow within one month.
Complaints
If the response does not satisfy you, you can complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk or on 0303 123 1113.
Changes
Any change to this page is marked by a new date at the top.