Privacy and security summary for university procurement and IT teams

The short version

• No student accounts, no sign-up, no student names or emails.
• Request logs only: IP address, user agent, referrer and the page or query requested.
• We act as controller for those logs; no processing on behalf of the university is required.
• Hosting on a dedicated cloud server in the EU (Hetzner Online).
• The data we serve is public Companies House data, so a breach would expose no confidential data.
• No ISO 27001 or Cyber Essentials certification yet. Cyber Essentials is planned for 2027 Q1.

Personal data

Licensed access works by IP address from your campus ranges and your EZproxy server (see access setup). Because of that, we do not create student accounts and do not need any student personal data from the university.

We log each request with:

• IP address
• User agent
• Referrer
• Page or query requested

We use these logs for usage statistics, abuse prevention and the monthly institutional usage report. Requests that come through EZproxy arrive from the proxy's address, so for off-campus use we normally see your proxy server rather than the individual user's own connection.

The monthly usage report for the library contains only counts: searches, company views, history views, dataset previews, exports, rows exported and API calls. It contains no IP addresses and no individual queries. It is delivered as a web page and CSV behind a secret link. It is institutional usage reporting and is not COUNTER-certified.

Controller position and DPA

We are the controller for our request logs. The university does not instruct us to process personal data on its behalf, so there is no processor relationship and a data processing agreement is normally not needed. If your institution's policy requires a DPA for every supplier, we will sign the university's DPA.

The company data itself (company names, figures, registered office town and postcode) comes from the public Companies House register under the Open Government Licence.

Sub-processors

Campus licences are invoiced against a purchase order, so a licensed university does not pass any data to Stripe.

Security measures

• HTTPS only. The site and API do not serve plain HTTP content.
• API keys stored as SHA-256 hashes. We do not keep the plain key after issuing it.
• Admin access by SSH key only. No password logins to the server.
• Daily database rebuild from public sources. The database is regenerated from Companies House files, so its contents can always be restored from the original public data.
• Backups before every deployment. The database is backed up before each release.
• Public data. The service holds no confidential university data and no student records.

Certifications

We do not hold ISO 27001 or Cyber Essentials certification. Cyber Essentials is planned for 2027 Q1. We are happy to complete your supplier security questionnaire and will answer it with the facts on this page.

Service continuity

If the service ever closes, we give 90 days notice, a full export of the institution's saved datasets and a final data snapshot. The source data is under the Open Government Licence and can be re-used.

Contact

Data protection and security questions: info@globalmindsetmarketing.co.uk. Global Mindset Marketing Limited, company 15738438, Bartle House, 9 Oxford Court, Manchester M2 3WQ.

FAQ

Does UK Company Data collect student personal data?

No student accounts are created and no student data is needed from the university. We log requests (IP address, user agent, referrer, page or query) for usage statistics, abuse prevention and the institutional report.

Do we need a data processing agreement?

Normally not, because we act as controller for our own logs and do not process personal data on the university's behalf. We will sign the university's DPA if its policy requires one.

Where is the data hosted?

On a dedicated cloud server with Hetzner Online in the EU. DNS is through Cloudflare.

Is UK Company Data Cyber Essentials certified?

Not yet. Cyber Essentials is planned for 2027 Q1. We do not hold ISO 27001.

Is the usage report COUNTER-compliant?

No. It is an institutional usage report with counts of searches, views, exports and API calls, not COUNTER-certified.

Sources: Companies House register and accounts data (Open Government Licence v3.0), legislation.gov.uk and GOV.UK guidance where linked. This page is general information, not legal, tax or credit advice. Spotted an error? Email info@globalmindsetmarketing.co.uk.