Deadline Diary Privacy Notice
Last updated 8 August 2026 · Version 1.1
This notice explains how we handle personal data in Deadline Diary, our Companies House deadline-monitoring service for accountants. It forms part of the Simplinuity privacy notice. We have written it to be as clear and specific as we can; if anything is unclear, contact us using the details at the end. Deadline Diary is currently free to use.
Deadline Diary has two parts. The watchlist and alerts are only available to signed-in account holders: those compliance and register results are shown inside your logged-in account and never to anonymous visitors. There is also a free public check at https://deadlinediary.co.uk/check/, which anyone can use without an account: you give it company numbers (by pasting them or by uploading a spreadsheet) and it returns the same register information on screen and as a download.
For the free public check we do not ask for, and do not collect, your name, your email or any account. We place no cookie on that page unless you press the button to create an account and bring your checked list with you. If you do, we set one short-lived cookie (dd_carry, 15 minutes) holding only the company numbers you just checked, so the sign-up form can offer to add them for you; it is deleted as soon as the form is accepted, and expires by itself after 15 minutes in any case. Apart from that, the only cookie on that page is your light/dark display preference. The file or list you submit is read in memory to extract the company numbers; the finished results workbook is held in server memory only so that you can download it, for a maximum of 30 minutes, after which it is discarded. We do not write your file to disk, and we do not use any of it to build a profile of you. The one exception is the list-carrying feature described above: if you choose it, the company numbers (and nothing else from your file) are stored against your pending sign-up so that they survive the emailed link, shown to you on your first screen for you to add or discard, and deleted as soon as you do either, or after 7 days if you do neither. We hold that list in confidence and use it for nothing else.
The only information we handle before you have an account is the name and work email you give us when you create one.
1. Who we are
The data controller is GMS Suite Ltd, a company registered in England & Wales, which operates Simplinuity and Deadline Diary. Our registered office is recorded on the public register at Companies House.
- Contact for data-protection matters: hello@simplinuity.com
- ICO registration: we are registered with the Information Commissioner's Office under number ZC130423.
- Data Protection Officer: we are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR, and have not done so. Our director is responsible for data protection and is the contact above.
2. What this notice covers, and what it doesn't
Deadline Diary involves three kinds of personal data, and our role differs across them. This notice covers the two where we decide why and how the data is used (we are the "controller"):
- Part A – the information we collect about you, the accountant using the service; and
- Part B – the director and PSC information we read from the public Companies House register to show you a company's compliance status.
It does not govern the client companies you choose to monitor (the company numbers and labels you enter into your watchlists, and the change history we keep to alert you). For those we act only as a processor acting on your instructions – you decide why each company is monitored. How we handle that data is set out in the Data Processing Agreement you accept when you create your account, not in this notice. If you are a client of an accountant who uses Deadline Diary and you want to know how your information is used, please contact that accountant, who is the controller for that data.
3. Part A – Information we collect about you (the accountant)
What we collect
- Your account details: your name, your firm's name, your email address, and your hashed password.
- Your watchlists: the named watchlists you create, the Companies House numbers and labels you add to them, and each watchlist's own alert settings (see below). We mention these here so you know we hold them, but we act as your processor for this data and it is governed by your Data Processing Agreement, not by this notice (see section 2).
- Security and sign-in information: the email address entered at sign-in, your IP address, sign-in success and failure records, and session activity.
- How you use the service: a record of the pages you open in your signed-in account and the actions you take there (for example opening your watchlist, changing your alert settings, or downloading a spreadsheet), with the date and time. We record the name of the page only – never which of your client companies you looked at, and never your IP address or browser for this purpose. This is first-party: it is stored in our own database on our own server, it uses no cookies and no third-party analytics provider, and it is never shared. See section 3, “Why we use it”, for our lawful basis, and section 7 for how long we keep it.
- Page views, counted by our own analytics software: separately from the record above, every page of this site loads a small script that counts the page being opened. The software is Plausible Community Edition, which we run ourselves on our own server at
analytics.simplinuity.com. It is not a third-party service: nothing is sent to Plausible the company, or to any other outside organisation, and there is no transfer outside the UK and EEA. It sets no cookies and cannot follow you between websites. What it stores for each page view is: the page address (the path only – never anything you see after a?), the site you arrived from, your country, and your device type, browser and operating system. It never stores your IP address, and it never records which of your client companies you looked at.
So that we can count visitors rather than just page loads, it turns your IP address and browser into a single number using a key that changes every day, keeps that number, and throws the IP address itself away immediately. Because the key changes daily, the same person visiting on two different days is two unrelated numbers, so it cannot build a picture of you over time. We checked this against our live data: no visitor number appears on more than one day.
Because it sets no cookies and stores nothing that identifies you, it needs no consent under PECR regulation 6, and our lawful basis is legitimate interests (see section 3).
You can switch it off for any browser you use, permanently and without signing in, by opening https://deadlinediary.co.uk/?noanalytics=1 once on that device. We will then stop sending the counting script to that browser altogether. ?noanalytics=0 turns it back on.
- Account-creation information: when you create an account you give us your name and work email. We email you a single-use link to confirm the mailbox is yours – this is how we verify your email address – and when you follow it you set a password and accept our Terms, Data Processing Agreement and this Privacy Notice. We record which versions you accepted and when, and the IP address used, to prevent abuse of the sign-up form.
You choose your alert settings for each watchlist separately: how often that list emails you (daily, weekly or off), which kinds of change it tells you about (annual accounts, the confirmation statement, director and PSC identity verification, company status, and other detail changes), and how many days ahead of each deadline you want to be warned.
Providing your account details is necessary to create and run your account; without them we cannot provide the service (Article 13(2)(e) UK GDPR).
Why we use it, and our lawful basis
Understanding how the service is used. We look at which pages are opened and which features are
used so we can see what is working, find what is confusing or unused, and decide what to build next.
Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): our interest is in running
and improving a service you are using, and we have balanced it against your interests. The record is
limited to the page name, the action and the time; it excludes the identity of the companies on your
watchlists, and it excludes your IP address and browser. It is held only in our own database, is not
combined with anything else, is not used to make any decision about you, and is not shared with or
accessible to any third party. You can object to this processing at any time using the contact
details in section 9, and we will exclude your account from it without affecting your use of the
service in any way.
| What we do | Lawful basis (UK GDPR) |
|---|---|
| Create and run your account, hold and monitor your watchlists, and send you the change digests you set up for each list | Article 6(1)(b) – performance of our contract with you (the terms you accept when you create your account). Where any part of this processing goes beyond what that contract strictly requires, we rely on our legitimate interests (Article 6(1)(f)) in providing the service you asked for, supported by a legitimate interests assessment. |
| Set up your account when you create one, including emailing you a single-use link to confirm your email address before the account is created | Article 6(1)(b) – taking steps at your request before entering into a contract, and then performing it. |
| Keep the service secure – authenticate sign-ins, apply rate limits, detect and investigate abuse, and keep short-lived audit records (sign-in attempts and IP addresses) | Article 6(1)(f) – our legitimate interests in the security of our service and our users' accounts. We have carried out a legitimate interests assessment. Ensuring the security of network and information systems is recognised as a legitimate interest (Recital 49 UK GDPR). |
| Keep a minimal record, after your account is closed, that you accepted our Terms, Data Processing Agreement and Privacy Notice (which versions, and when) | Article 6(1)(f) – our legitimate interests in being able to establish that our terms were agreed, for example to deal with a query, dispute or legal claim. We have carried out a legitimate interests assessment. |
Cookies
Deadline Diary is a signed-in tool and uses only first-party cookies. We set a strictly-necessary session cookie (sid) to keep you signed in – this is exempt from consent under regulation 6(4) of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) because it is essential to a service you have asked for. We also set a strictly-necessary cookie (flash) that carries a confirmation message such as “Saved” across a single page redirect and expires after 30 seconds; it is exempt from consent for the same reason as sid. We set a first-party preference cookie (theme) that remembers your light or dark display choice. Finally, only if you ask for it, we set a first-party preference cookie (noanalytics, kept for two years) recording your choice to be left out of page-view counting; that one is set only when you visit ?noanalytics=1, and never otherwise. We also set a strictly-necessary cookie (dd_carry) on the free check, but only at the moment you press the button to create an account and bring your checked list with you; it holds only those company numbers, lasts 15 minutes, and is deleted as soon as the sign-up form is accepted. It is exempt from consent for the same reason as sid: it exists solely to deliver something you have just asked for. Those five are the only cookies this service sets. We do not use advertising cookies or third-party analytics cookies, and our page-view counting sets no cookie of any kind. If we introduce any non-essential cookies in future (for example if an advertising-supported tier launches), we will ask for your consent first and update this notice.
Automated decisions and special category data
We do not make decisions about you – or about any director or PSC – by solely automated means that produce legal effects or similarly significantly affect you (Articles 22A–22D UK GDPR). None of the processing in this notice involves special category data (Article 9) or criminal-offence data (Article 10).
4. Part B – Director and PSC information from the Companies House register
What we read, and from where
So that we can show you the live statutory-compliance and identity-verification status of your clients' officers, Deadline Diary reads the names of directors and persons with significant control (PSCs), and their identity-verification and filing status, from the public Companies House register – a publicly accessible source that anyone may inspect (Article 14(2)(f) UK GDPR). This supports monitoring of annual accounts, the confirmation statement, and the director and PSC identity-verification requirement introduced by the Economic Crime and Corporate Transparency Act 2023 (ECCTA).
We fetch this information live each time you open a company, and we do not store it. Our systems keep only the company-level facts needed to detect changes (dates and status codes); we never write a director's or PSC's name to our database or into your digest emails. This register data is not stored by, or disclosed to, our sub-processors or anyone else – it is fetched live and shown only to you as the signed-in accountant (Article 14(1)(e) UK GDPR).
Our lawful basis
Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR) – our interest, and our customers' interest, in monitoring the public compliance status of companies our customers are professionally entitled to monitor. We consider the privacy impact to be limited: the data is already on a mandatory public register, we limit ourselves to name and status, we fetch it live and never store, enrich, combine or profile it, and the individual filed the information themselves. We have weighed our and our customers' interests against the interests, rights and freedoms of the directors and PSCs concerned, and consider that our legitimate interests are not overridden. We have documented this in a legitimate interests assessment and, because the service makes compliance-related representations, in a data protection impact assessment.
We do not collect disqualified-director, insolvency-prosecution or other criminal-offence records about these individuals; the register fields we use are limited to name and verification or filing status, so no special category data (Article 9) or criminal-offence data (Article 10) is involved.
Why you may be reading this rather than receiving a notice directly
We do not contact each director or PSC individually to give them this information. By design we hold no contact details for them and store nothing about them, the number of individuals is very large and constantly changing, and contacting each one would involve a disproportionate effort. We therefore rely on the exemption in Article 14(5)(e) UK GDPR (the "impossible or disproportionate effort" exemption, as amended by the Data (Use and Access) Act 2025 and in force from 5 February 2026).
In assessing disproportionate effort we have taken into account the factors set out in Article 14(6) UK GDPR: the number of data subjects (very large and constantly changing), the age of the data (current register data that the individuals themselves filed), and the safeguards we apply (live-only retrieval, no storage, name and status only). Because we rely on this exemption, Article 14(7) UK GDPR requires us to take appropriate measures to protect data subjects' rights, freedoms and legitimate interests, including by making this privacy information publicly available. We do so by publishing it here, on our public privacy page, at all times – before and independently of any individual fetch. This also satisfies the timing requirement in Article 14(3): the information is published continuously and is available to any director or PSC at any time.
If you are a director or PSC and you want to exercise your rights in relation to this processing, please contact us using the details in section 9. Because we hold only your name and status, fetched live and never stored, we may need to ask you to identify the company concerned so that we can respond.
5. Who we share your data with
We do not sell your personal data. We use a small number of trusted providers ("sub-processors") to run the service, each under a written contract (Article 28 UK GDPR) that requires them to protect your data and use it only on our instructions:
| Provider | What they do for us | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting and infrastructure | Germany (EU) |
| Google (Google Workspace) | Sending your account and alert emails | EU / United States |
| Backblaze (B2) | Encrypted off-site backups only – we encrypt the data on our own servers first, so Backblaze holds only unreadable ciphertext | United States |
We may also disclose personal data where the law requires it (for example, to comply with a court order or a request from a regulator).
6. Sending data outside the UK
Some of our providers may process data outside the UK. Where they do, the transfer is made under Chapter V UK GDPR (as amended by the Data (Use and Access) Act 2025, in force from 5 February 2026):
- Hetzner hosts your data in the EU (Germany), which is covered by UK adequacy regulations, so no additional transfer safeguard is needed.
- Google may process email data in the United States. Where it does, the transfer relies on the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework) where the provider is certified under it, and/or on the ICO's International Data Transfer Agreement / UK Addendum (an Article 46 transfer mechanism).
- Backblaze stores backups in the United States, but we encrypt them on our own servers first, so no readable personal data reaches it; where a transfer mechanism applies, we rely on the IDTA / UK Addendum and/or the UK–US Data Bridge.
You can ask us for more detail about the safeguards that apply to any particular transfer, and how to obtain a copy of them, using the contact details below (Article 13(1)(f) / 14(1)(f) UK GDPR).
7. How long we keep data
Usage records (which pages you opened, and when) are deleted automatically 180 days after they are recorded.
Page-view counts held in our own analytics software are kept for 24 months and then deleted automatically. These are counts of pages, not records about you: they contain no IP address, no cookie and nothing that identifies you or your account, which is why they are kept longer than the usage records above.
We keep personal data only for as long as we need it (Article 5(1)(e) UK GDPR), and delete it on the following basis:
| What | How long we keep it |
|---|---|
| Your account record – name, firm, email, hashed password | For as long as your account is open; deleted when your account is closed (by you in Settings, or by us) |
| Your watchlists – the named lists, company numbers, labels and per-list alert settings | While you are monitoring the companies; deleted immediately when you remove them, and when your account is closed. A company you remove may still be named in the alert history below, in the text of emails we already sent you, until that record ages out |
| Company change-history snapshots (dates and status codes only – no personal names) | Kept with the watchlist entry and deleted at the same time |
| A minimal record that you accepted our Terms, Data Processing Agreement and Privacy Notice (which versions, and when) | Kept after your account closes for as long as a related legal claim could be brought (in England & Wales, generally up to six years) |
| Sign-in sessions | Expire 30 days after sign-in; expired sessions are deleted automatically on the daily maintenance run |
| Sign-in security records – the email entered and the IP address | 90 days |
| Sign-up and email-verification links | Deleted 30 days after they expire |
| A list of company numbers you chose to carry over from the free check | Held against your pending sign-up; deleted as soon as you add or discard it on your first screen, and in any case after 7 days |
| Sign-up and password-reset request records – the work email you enter, any name or firm you give, and the IP address (kept to prevent abuse of the forms) | 180 days |
| Abandoned sign-ups – where you started creating an account but never set a password | Deleted after a short grace period |
| Records of a change digest we were unable to deliver (your email and the change details) | 180 days |
| Your alert history – a record of each daily check of each watchlist, including the days we checked and deliberately sent you nothing, and the exact text of any alert email we did send (which names the companies on your list) | 180 days |
| Director and PSC information from the register (Part B) | Not kept – read live each time and never written to our systems |
Our database is backed up nightly to an off-site provider in encrypted form – we encrypt it on our own servers before it leaves them, so the provider holds only unreadable ciphertext, and access to backups is restricted. When you delete data, or close your account, we remove it from our live systems straight away. If we ever restore from a backup, we re-apply any deletions made since that backup was taken, so deleted data is not brought back into the live service.
8. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and get a copy;
- ask us to rectify data that is inaccurate or incomplete;
- ask us to erase your data;
- ask us to restrict how we use your data;
- object to processing we carry out on the basis of our legitimate interests (Article 6(1)(f)) – including the security processing in Part A and the register processing in Part B; and
- ask us to port the account data you gave us to another provider, where that right applies (it applies to data we process by automated means on the basis of Article 6(1)(b) or your consent).
You can exercise several of these rights yourself, at any time, from within the product: in Settings you can export all your account data as a JSON file, and delete your account, which erases the data we hold about you (we keep only the minimal terms-acceptance record described in section 7). You can also reset your own password from the sign-in page.
We do not rely on your consent for any of the processing described in this notice, so there is nothing for you to withdraw – the relevant control is your right to object to our legitimate-interests processing.
To exercise any right, or if you would prefer us to act for you, email hello@simplinuity.com. We will respond within one month (Article 12(3) UK GDPR); if a request is complex we may extend this by up to two further months and will tell you if we do. Exercising your rights is free, though we may charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive (Article 12(5)). Directors and PSCs: because we hold only your name and status, fetched live and never stored, we may ask you to identify the company concerned so we can locate the relevant fetch.
If you enter data about your own clients into your watchlists, those clients should direct their rights requests to you as the controller of that data (see section 2); we will help you respond.
9. How to contact us, and how to complain
For any question about this notice or your data, contact hello@simplinuity.com.
If you are unhappy with how we have handled your personal data, you have the right to complain to us first, and we will look into it. You also have the right to complain to the Information Commissioner's Office (ICO) (Article 77 UK GDPR; sections 165–166 Data Protection Act 2018):
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · https://ico.org.uk/make-a-complaint/
10. Changes to this notice
We may update this notice from time to time. When we make a material change we will update the version number and date above and, where appropriate, email account holders. Please check this page for the current version.