Bank Analysis — Privacy Notice

1. Who is responsible for your data

The controller is Insolvency Direct Ltd (Saxon House, Saxon Way, Cheltenham GL52 6QX; ICO registration Z3533328). Following any appointment, the Insolvency Practitioner appointed as Liquidator is also a controller. For any data-protection query, or to exercise your rights, contact us at info@insolvencydirect.co.uk or on 01242 576555.

2. What this notice covers

It covers the Bank Analysis — an antecedent-transaction review of a company's bank data carried out before any formal insolvency appointment, usually at the request of the company's accountant, to help assess the company's financial position and any personal financial implications for directors and shareholders.

3. What personal data we process, and where it comes from

• •The company's bank-account transaction data (dates, amounts, counterparties, references), which may contain personal data.
• •Identity and contact details of directors, officers, shareholders and connected parties, and Companies House data.
• •Findings we derive about the conduct of the company's directors, which may include information relating to alleged unlawful acts (Article 10 data).

The bank data reaches us either through Armalytix, an FCA-regulated open-banking provider, or from statements provided via your accountant. Open Banking access is read-only, is authorised by a director of the company through the bank's own authentication, and operates within the smart data framework that the Data (Use and Access) Act 2025 places on a statutory footing.

4. Why we process it, and our lawful basis

We process this data to assess the company's financial position, identify antecedent transactions (such as overdrawn director loan accounts, unlawful dividends, preferences, transactions at undervalue and misfeasance), and support the advice given to the company's director(s).

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)) — the interests of Insolvency Direct, the company's creditors, its directors and the referring accountant in a rapid, accurate assessment before any decision. Where the findings involve data about alleged unlawful acts, we rely on the condition in Schedule 1, Part 2, Paragraph 10 of the Data Protection Act 2018 (preventing or detecting unlawful acts), governed by an Appropriate Policy Document.

5. Automated analysis using AI

To review the transaction data accurately and efficiently we use a secure automated analysis system provided by Anthropic. Anthropic acts only as our processor, under written terms that require it to process the data solely on our instructions and not to use it to train any AI models. The analysis is always reviewed by our staff and the Insolvency Practitioner before it is relied upon — no decision producing legal or similarly significant effects is made solely by automated means.

The Data (Use and Access) Act 2025 rewrites the rules on automated decision-making (new Articles 22A to 22D of the UK GDPR). We do not rely on the wider latitude it allows: a person reviews every finding, you will always be told that AI was used in preparing the analysis, and you may at any time ask us to explain a finding, make representations about it and have it reconsidered by a member of our staff or the Insolvency Practitioner.

6. Who we share it with

Anthropic and Armalytix (as our processors), the Insolvency Practitioner who reviews the analysis, and the referring accountant (to whom the findings are provided so they can advise you). We do not sell personal data.

7. Transfers outside the UK

Anthropic processes data in the United States. That transfer is protected by the UK International Data Transfer Addendum (IDTA) to the EU Standard Contractual Clauses, together with technical and organisational safeguards, so your data continues to be protected to the UK standard. We keep that assessment under review against the data protection test introduced by the Data (Use and Access) Act 2025.

8. How long we keep it

• •Raw transaction data is securely purged 30–90 days after the analysis is completed and verified.
• •Derived findings are kept for 1 year after the liquidation is completed, or for 6 years if the company does not enter liquidation, then securely destroyed or anonymised.

9. Your rights

You have the right to access your personal data, and to seek its rectification, erasure or restriction, and to object to our processing (because we rely on legitimate interests). To exercise any right, contact us using the details in section 1.

If you ask for a copy of your data we will carry out a reasonable and proportionate search and respond within one month. Where we need to ask you to clarify what you want, the Data (Use and Access) Act 2025 allows that period to pause until you reply; we will tell you if that happens.

10. Complaints

If you are unhappy with how we have handled your personal data, please complain to us first using the details in section 1. In line with the complaints procedure the Data (Use and Access) Act 2025 requires of every controller, we will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), which the 2025 Act renames the Information Commission.

11. The Data (Use and Access) Act 2025

The 2025 Act amends the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations rather than replacing them. Its provisions are being brought into force in stages. Where a provision is not yet in force, we apply the standard in this notice anyway, so that nothing about how we handle your data depends on the commencement date. The parts that touch the Bank Analysis are: the automated decision-making safeguards (section 5), the data protection test for international transfers (section 7), the rules on responding to access requests (section 9), the statutory complaints procedure (section 10), and the smart data framework for Open Banking (section 3).