Last updated: 17 October 2026
Basics is a trading name of SGAA Limited, a company registered in England and Wales (company number 16871943). Our registered office is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. When we say “we”, “us”, or “our” in this policy, we mean SGAA Limited.
This policy covers both our website (get-basics.com) and the Basics product, the dashboard you sign into to manage your UK limited company’s formation, filings, and compliance.
SGAA Limited is the data controller for personal data processed under this policy. If you have questions, contact us at contact@get-basics.com.
We organise data by category. For each one, the table below sets out what it is, where it comes from, why we use it, and our lawful basis under UK GDPR.
| Category | What | Source | Why | Lawful basis |
|---|---|---|---|---|
| Account data | Name, email address, hashed password, account preferences, and any two-factor authentication secrets you enrol. | You, when you sign up. | To create and secure your account, authenticate you, and send service-related messages. | Performance of our contract with you (Art. 6(1)(b)). |
| Company data | Company number, registered office, officer and PSC details, share structure, SIC codes, and related records. | You directly, plus public-register data fetched from Companies House to keep your dashboard in sync. | To operate the dashboard, pre-populate filings, and track your compliance obligations. | Performance of our contract with you. |
| Filings data | The information you submit through Basics to Companies House or HMRC, for example the IN01 incorporation form, CS01, annual accounts, or CT600. | You. We assemble and transmit on your behalf; by using Basics to file, you authorise us to act as your filing agent. | To submit your filings to the correct authority and keep a record of what was filed, as required by UK company law. | Performance of contract (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c)). |
| Identity verification data | The verification outcome and a reference to it, plus access to the original ID document images, biometric selfie, and liveness data held on our identity-verification provider’s platform. From a passed verification we also take the verified name, date of birth, nationality and home address and keep them on the record of the person who was verified. We hold this data in our capacity as an Authorised Corporate Service Provider (ACSP). | You, submitted to our identity-verification provider during the verification flow. | To meet our obligations as an Authorised Corporate Service Provider under the UK’s Economic Crime and Corporate Transparency Act 2023 and the Money Laundering Regulations 2017, which require us to verify the identity of directors and PSCs before filing on their behalf. We then use the verified name, date of birth, nationality and home address to complete the statutory particulars in the filings you have been named in: the IN01 incorporation form today, and the director details on an AP01 appointment or a CS01 confirmation statement. A verified person’s details stay on the account of the founder who invited them and are reused, without a fresh verification, when the same person is named in another formation on that account. | Your explicit consent to processing of special-category biometric data during the check at our identity-verification provider (Art. 9(2)(a)). For the verified particulars: compliance with a legal obligation under ECCTA 2023 and MLR 2017 (Art. 6(1)(c)), and performance of our contract with the founder to form and file for the company (Art. 6(1)(b)). |
| Payment data | A payment-processor customer identifier, the amount and date of each payment, the last four digits of your card, and the payment status. We don’t receive or store your full card number, expiry, or CVC. | Our payment processor’s hosted checkout. Card details are captured by the payment processor directly. | To process payments, issue refunds, and keep financial records. | Performance of our contract with you and compliance with our own tax-record obligations. |
| Technical data | IP address, device and browser information, pages visited, and timestamped request logs, including authentication events and significant actions in the dashboard. | Collected automatically when you use the website or product. | To keep the service secure, diagnose problems, and maintain an authentic record of actions taken. | Our legitimate interest in operating a secure and reliable service (Art. 6(1)(f)). |
| Communications | Emails you send us, in-product messages, and support correspondence. | You. | To respond to your questions and keep a record for continuity. | Performance of contract and our legitimate interest in providing support. |
| Messaging data (SMS and WhatsApp) | A mobile number you link to your account or give us for a service, the mobile numbers of directors and shareholders you ask us to invite, the delivery status of each message, and the content of messages exchanged with us about your formation or filing (for example a reply or a button you tap to confirm a step). Message content is never used to verify identity; that stays with our identity-verification provider. | You. Directors’ and shareholders’ numbers come from the person who adds them to a formation. | To send you updates about something you are doing with us (a payment received, a director verified, a filing accepted), to let you progress a formation from WhatsApp, and to deliver identity-verification invites to the people you have named. | Performance of our contract with you (Art. 6(1)(b)). For directors and shareholders we message on a founder’s behalf, our legitimate interest in completing the formation they have been named in (Art. 6(1)(f)). These are service messages, not marketing, under the Privacy and Electronic Communications Regulations (PECR). |
Messages by SMS and WhatsApp. We only message you about something you are doing with us. We don’t send marketing by SMS or WhatsApp unless you have separately opted in, and you can withdraw that at any time. To stop messages, reply STOP to any SMS, or reply STOP or block our number on WhatsApp; we then use email for anything you still need to hear about. WhatsApp messages are encrypted in transit between you and the messaging platform; the WhatsApp Business Platform is operated by Meta, so WhatsApp’s own privacy policy also applies to your use of the app.
Where we collect personal data to meet the Money Laundering Regulations 2017, we process it only for the purposes of preventing money laundering, terrorist financing or proliferation financing, or as otherwise permitted under regulation 41(3) of those Regulations. That permission covers the processing described above to form and file for the company.
We only share data with service providers we need to run the service. Each one is contractually bound to process data on our instructions and to meet UK GDPR standards. We share data with the following categories of recipient:
We don’t sell your personal data to anyone, for any purpose.
Some of our service providers may be based outside the UK or EEA, or route traffic through infrastructure outside it, including network and security providers, payment processors, identity-verification providers, and messaging providers (Twilio processes messages in the United States). In those cases, your personal data may be transferred outside the UK or EEA to countries including the United States.
Where personal data is transferred outside the UK or EEA, the transfer is covered by the UK’s International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs), together with any additional safeguards the provider operates.
We keep personal data only as long as we need it. Our current retention floors, by category, are:
Where the law requires us to keep records for longer (HMRC, Companies House, anti-money-laundering), statutory retention overrides the floors above.
We apply appropriate technical and organisational security measures. For the detail, see our Security page.
Under UK GDPR, you have the right to:
To exercise any of these rights, email contact@get-basics.com or use the tools in your dashboard. We’ll respond within one month.
The Basics website does not use advertising or cross-site tracking cookies.
We use a privacy-first, cookieless analytics service provided by our network-security provider to understand how the site is used, for example pages viewed, country, and referrer. It doesn’t set cookies, doesn’t use persistent identifiers, and doesn’t track you across other sites. Only aggregated, pseudonymous data is retained.
Our network-security provider also automatically sets a small number of strictly necessary cookies for bot protection and challenge verification. These cookies are required for site security, aren’t used for analytics or advertising, and you can’t opt out of them without breaking site security.
If you think we’ve mishandled your personal data, please contact us first at contact@get-basics.com. We take complaints seriously and will investigate. From June 2026, under the UK Data (Use and Access) Act 2025, controllers are required to provide a clear internal complaints process, this is ours.
If we don’t resolve your concern, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.