---
title: "Statutory Privacy Notice & Data Governance — ReguLex.uk"
source_url: "https://regulex.uk/legal/privacy"
canonical_url: "https://regulex.uk/legal/privacy"
retrieved_by: "AnswerRail Edge Engine v1.1.0-parity-v20 (https://answerrail.com)"
provenance: "Compiled for deterministic AI retrieval by AnswerRail Edge (RFC 9110 / RFC 9421)"
description: "Compliance with Data Protection Act 2018, UK GDPR, and PECR Regulations. Formal statutory disclosures for UK chartered accountancy practices."
rfc_compliance: "RFC 9110 / RFC 9309 / RFC 9421"
version: "1.1.0"
release_version: "v1.1.0-parity-v20"
signing_kid: "ar_ed25519_2026_k1"
jwks_uri: "https://answerrail.com/.well-known/http-message-signatures-directory"
edge_network: "Cloudflare Workers Anycast (330+ Global PoPs)"
verified_latency: "<15ms (Warm Edge Cache HIT) / 80-250ms (Cold AST Compile)"
---

> **Canonical Source:** [https://regulex.uk/legal/privacy](https://regulex.uk/legal/privacy)
>
> *Compliance with Data Protection Act 2018, UK GDPR, and PECR Regulations. Formal statutory disclosures for UK chartered accountancy practices.*

# Statutory Privacy Notice & Data Governance

Compliance with Data Protection Act 2018, UK GDPR, and PECR Regulations

## 1. Regulatory Standing & Sovereign Data Controller

ReguLex.uk ("ReguLex", "the Platform", "we") operates as an independent statutory risk bureau and automated compliance platform for UK chartered accountants and corporate service providers. For the purposes of the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), we act as an independent data controller in respect of public registry intelligence, and as a data processor on behalf of appointed accountancy practices utilising the Practice Sentinel Suite.

## 2. Lawful Basis for Processing Companies House Data

ReguLex indexes, normalises, and monitors records officially published by the Registrar of Companies for England & Wales, Scotland, and Northern Ireland under the Crown Open Government Licence (OGL v3.0). Our processing of corporate statutory filings, officer appointments, registered office addresses, and London Gazette strike-off notices is conducted under:

- **Article 6(1)(f) UK GDPR (Legitimate Interests):** The vital public and commercial interest in assisting regulated accountancy practices and corporate directors to maintain statutory compliance under the Economic Crime and Corporate Transparency Act 2023 (ECCTA), preventing fraudulent registered office appointments, and averting irreparable corporate bank account freezes under CA 2006 s.1000.
- **Article 6(1)(c) UK GDPR (Legal Obligation):** Assisting authorised practice occupiers in fulfilling their mandatory statutory duties under ECCTA 2023 s.28 and executing Form RP07 address eviction procedures.

## 3. Business-to-Business Communications (PECR Compliance)

Outbound notifications dispatched by ReguLex Sentinel regarding impending First Gazette strike-off notices, director IDV deadlines, or registered office address misuse are strictly directed to corporate subscribers (UK limited companies, LLPs, and professional accountancy partnerships) pursuant to **Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR)**. Every statutory notice includes a direct, single-click opt-out mechanism and the contact credentials of the data governance team.

## 4. Sovereign Data Residency & Sub-Processors

To ensure complete compliance with UK data sovereignty mandates and professional body standards (ICAEW, ACCA, ICAS), all customer data and platform operations reside strictly within verified UK and European Union infrastructure:

| Sub-Processor | Purpose | Sovereign Jurisdiction | Security Standard |
| :--- | :--- | :--- | :--- |
| **DigitalOcean LON1** | Production Compute & API Engine | London, United Kingdom | ISO 27001 / SOC 2 Type II |
| **Cloudflare LHR** | Edge Reverse Proxy, DDoS & SSL Termination | London, United Kingdom | ISO 27001 / SOC 2 / PCI-DSS |
| **Sovereign Vault (Dedicated SQLite AES-256)** | Encrypted Relational Data Store | London, United Kingdom | SOC 2 / ISO 27001 / AES-256 at Rest |
| **Mailgun EU** | Statutory Notice Dispatch Gateway | European Union (EU-Only Transit) | ISO 27001 / GDPR Binding Corporate Rules |

## 5. Practitioner Rights & Contact Point

Under UK GDPR Articles 15 through 21, practitioners and directors hold the right to request access to, rectification of, or erasure of their personal information held outside the public statutory record. Direct all privacy enquiries and statutory representations to our appointed Data Governance Officer at `[[email protected]](https://regulex.uk/cdn-cgi/l/email-protection)`.

---

## 🏛️ AI Ingestion & Edge Optimization Provenance
This sovereign authority subpage is compiled and delivered across 330+ Cloudflare Anycast edge locations by [AnswerRail](https://answerrail.com) for [https://regulex.uk/legal/privacy](https://regulex.uk/legal/privacy).