Privacy Notice

Last updated: August 2026

1. Introduction

This privacy notice explains how Branch² ("we", "us", "our") processes personal data in connection with our market intelligence service. This notice applies to officers and persons with significant control (PSC) data sourced from Companies House (CH) and displayed in the Atri platform.

2. Data Controller

Branch² is the data controller for personal data processing under UK-GDPR. Atri is the product operated by Branch².

3. Personal Data We Process

We process the following personal data sourced from Companies House:

• Officer names, roles, and appointment dates
• Persons with significant control (PSC) names and control details
• For PSCs only: the partial date of birth (month and year — Companies House does not publish the day), nationality, and country of residence
• Resigned/appointed dates and position histories

We keep the three PSC fields above for specific, limited reasons. Companies House publishes no identifier that links a PSC across companies, so the partial date of birth is what allows us to tell apart two different people who share a name — without it we would risk attributing one person's control of a company to someone else. Nationality and country of residence are used to assess sanctions and politically-exposed-person risk. We do not hold these fields for officers.

We do not store correspondence or residential addresses, day of birth, occupation, or the full text of PSC statements, in compliance with data minimisation principles.

4. Source of Data

Personal data in the platform comes from two sources.

Public registers. The officer and person-with-significant-control data described in section 3 is sourced from Companies House, a UK public register. That data is publicly available and published under the Open Government Licence v3.0.

Account holders. If you hold an account with us, we also process personal data about you: the email address you register with, the preferences and settings you choose, the companies and suppliers you add to your watchlist, the business details you enter, records of your subscription, and records generated by your use of the service — such as the analyses you run and the notifications we send you.

5. Purpose of Processing

We process this data for the following purposes:

• Providing market intelligence and corporate analysis
• Entity resolution and relationship identification
• Enabling users to understand corporate governance and control structures

6. Lawful Basis for Processing

We process personal data on the basis of our Legitimate Interests under UK GDPR Article 6(1)(f). We have conducted a Legitimate Interests Assessment (LIA) which concluded that:

• Our interest in providing market intelligence is legitimate and clearly articulated
• The processing is necessary for that interest and could not reasonably be achieved by less privacy-intrusive means
• The individuals whose data we process are officers and PSCs of registered companies — roles that carry public accountability expectations
• Processing publicly-filed Companies House data in an intelligence context is reasonably expected and proportionate

Under UK GDPR Article 21, you have the right to object to processing based on legitimate interests at any time. To exercise this right, email us at support@branch2.com — we will consider your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

Our full Legitimate Interests Assessment isavailable on request. We will respond within 5 business days.

7. Data Retention

We keep an officer or PSC record for as long as it is still in use, and no longer. A record is deleted automatically once both of the following are true: no refresh from Companies House has re-observed that person for 90 days, and no user of the platform is monitoring them. When a person record is deleted, the entries linking them to companies are deleted with it. Records are refreshed from Companies House while in use, so what we show reflects the current public register.

This is separate from, and does not delay, your right to erasure: if you ask us to remove your data we act on that request directly rather than waiting for the retention period, and we do not re-create a record we have been asked to erase. Resigned officers and former PSCs are retained on the same basis as current ones — a past directorship or past control of a company remains part of the public record.

8. Data Transfers

Personal data is stored and processed on managed database infrastructure operated by Supabase in the Asia Pacific (Seoul) region of South Korea. Application servers are operated by Railway. This means personal data is transferred outside the United Kingdom.

[TODO — UK counsel to complete] International transfer mechanism: Identify and state the lawful basis relied on for transferring personal data from the UK to South Korea (adequacy regulations, the International Data Transfer Agreement, or the Addendum to the EU Standard Contractual Clauses), and confirm whether a transfer risk assessment is required. Name each processor and its processing location.

9. Your Rights

Under UK-GDPR, you have the right to:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Data Portability: Receive the data you gave us in a structured, commonly used, machine-readable format
• Right to Erasure: Request deletion of your data in certain circumstances
• Right to Object: Object to our processing of your data, particularly on legitimate interests grounds
• Right to Rectification: Request correction of inaccurate data (though CH data accuracy is verified at source)

Access and portability are self-serve. If you have an account, open Settings → Account → Download my data and you will get a JSON file of every row we hold against your account, immediately and without asking us. The file states whether it is complete.

For erasure, objection and rectification, and for any request about a person who does not hold an account, email us at the address below — those still need a person to review them.

10. Data Subject Access Requests (DSAR)

If you hold an account, a copy of your data is available immediately under Settings → Account → Download my data — you do not need to write to us for it. For erasure, objection or rectification, or if you do not hold an account, send a request to:

We will acknowledge your request within 5 working days and respond within 30 calendar days of receipt.

11. Complaints

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have breached your rights under UK-GDPR:

13. United States — state privacy laws

Branch² is operated from the United Kingdom and is not actively marketed to US residents. We provide the following disclosures on a best-effort basis for visitors located in California (CCPA / CPRA) and, by extension, residents of other US states with comparable privacy laws (VCDPA, CPA, CTDPA, UCPA and newer state acts). We will revisit and finalise this wording with counsel before any formal US launch.

• Categories of personal information collected (CCPA §1798.110). In the last 12 months we have collected the following categories of personal information about visitors and account holders: identifiers (e.g. name, email address, IP address), commercial information (subscription / billing records), internet or other electronic network activity information (e.g. pages viewed, interactions with the platform), and inferences drawn from the above to provide and improve the service. We also process information about company officers and persons with significant control sourced from public registers such as Companies House — see sections 4 and 5 above.
• Sale or sharing of personal information. We do not sell personal information for money, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the CCPA / CPRA. We have not sold or shared personal information in the preceding 12 months and have no plans to do so.
• Do Not Sell / Do Not Share opt-out. Because we do not sell or share personal information, no opt-out is required. If this changes in the future we will provide a "Do Not Sell or Share My Personal Information" link and will honour Global Privacy Control (GPC) browser signals as an opt-out request. In the meantime, you may email support@branch2.com to record a standing opt-out preference on your account.
• Sensitive personal information. We do not knowingly collect sensitive personal information as defined by CCPA §1798.140(ae) (e.g. precise geolocation, government identifiers, racial or ethnic origin, religious beliefs, health or biometric data, contents of private communications). Account credentials we hold are used solely to authenticate you and provide the service, and are not used to infer characteristics about you. You therefore do not need to exercise the right to limit use of sensitive personal information.
• Your consumer rights and how to exercise them. Subject to verification and any exemptions permitted by law, California residents (and residents of other US states with comparable laws) have the following rights:

• Right to Know — request the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete — request deletion of personal information we have collected from you, subject to statutory exemptions (e.g. completing a transaction, security, legal compliance).
• Right to Correct — request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of the sale or sharing of personal information — as noted above, we do not engage in either activity.
• Right to Non-Discrimination — we will not deny goods or services, charge different prices, or provide a different level of service because you exercised a privacy right.

To exercise any of these rights, email support@branch2.com from the address associated with your account, or include enough information for us to reasonably verify your identity (typically name, email, and any account identifier). We will acknowledge requests within 10 business days and respond substantively within 45 days, extendable by a further 45 days where reasonably necessary, as permitted by the CCPA. You may also designate an authorised agent to make a request on your behalf; we will require written authorisation and may verify directly with you.

14. Changes to This Notice

We may update this privacy notice from time to time to reflect changes in our processing or legal requirements. We will notify you of any material changes by updating the "Last updated" date above.

Questions?

Attribution: Contains public sector information licensed under the Open Government Licence v3.0.