Presence only — this register reflects what public authorities have reported under their legal duty to publish (Subsidy Control Act 2022, s.33) to the UK subsidy transparency register, not everything they've done. The register is statutorily incomplete: authorities can take up to a year to report, and very small awards may never appear, so absence of an entry here is not evidence nothing happened.
Customer privacy notice
This notice explains how we process your personal data as a subscriber. It is provided under Article 13 of the UK GDPR, because the data is collected directly from you. It is separate from the beneficiary privacy notice, which concerns people named in the register.
1. Who we are
45Black Limited (company number 16860363), 20 Wenlock Road, London, England, N1 7GU, is the controller for the personal data described here. Contact: [email protected].
2. What we collect, why, and on what basis
| Data | Why | Lawful basis |
|---|---|---|
| Email address | Sign-in (magic link), service messages, alert delivery | Contract — Art 6(1)(b); we cannot provide the service without it |
| Saved filters and watch criteria | To run the monitoring you are paying for | Contract |
| Search history — getting you back to recent work | Returning you to a search you ran recently, and letting you turn one into a saved filter | Legitimate interests — Art 6(1)(f). Kept 90 days; you can clear it at any time |
| Search history — diagnosing faults | Reproducing and fixing a fault you report | Contract — Art 6(1)(b). Fixing a fault is integral to providing the service with reasonable care and skill |
| Search history — improving the product | Understanding which searches are slow, fruitless or error-prone, so we can make them better | Legitimate interests — Art 6(1)(f). Done on aggregated data wherever it answers the question |
| Notification log (what was sent, when, delivery outcome) | Proving an alert was sent — the evidentiary point of the product | Contract, and legitimate interests in being able to evidence delivery |
| Billing details | Taking payment | Contract. Handled by Stripe; no card data reaches this service |
| IP address and request metadata | Security and abuse prevention, via Cloudflare | Legitimate interests |
We do not profile you, make automated decisions about you, or use your data to train anything.
One automated decision does occur and you are entitled to know about it: your account is created automatically once payment is confirmed, without a human reviewing your application. If access is refused or later withdrawn you may contest that decision and ask a person to review it — write to the address in §1.
3. Who we share it with
DigitalOcean (hosting, London), Cloudflare (network), Stripe (payments), Postmark (email delivery). We use no analytics, no advertising services, and no third-party JavaScript; every page is served from our own infrastructure.
We do not sell your data. We do not share it with the Department for Business and Trade or with any other subscriber.
4. Where it is held
The database, search index and backups are in London (DigitalOcean lon1). Backups are encrypted. Email delivery routes via Postmark in the United States. That transfer is covered by Postmark's certification under the UK Extension to the EU-US Data Privacy Framework, with the UK International Data Transfer Addendum as a contractual fallback.
5. How long we keep it
Alert and delivery records: 2,192 days. The record of what we told you, and when, is proof that the service did what it promised. A dispute about a missed or late alert would run to the ordinary six-year limitation period under the Limitation Act 1980, so a shorter period would destroy our own defence — and yours.
Search history: 90 days — and sooner if you clear it. Your searches show which subsidies, beneficiaries and granting authorities you are looking into — which, for a firm, comes close to revealing the matter and the client. Holding that indefinitely would not be a fair balance however securely it was stored, so we keep only what covers taking you back to recent work. You can clear your history yourself at any time. Anything still held when you close your account is deleted 2 months after closure.
Everything else about a closed account: 1 year after closure. After that the account's remaining data is deleted — users, API keys, saved filters, invites, delivery records, alert settings — and the account record itself is reduced to an anonymous tombstone, kept only because the alert records above still reference it, then removed with the last of them.
6. Your rights
Access, rectification, erasure, restriction, portability, and objection — exercise any of them by writing to the address in §1. We will respond within one month.
Where we rely on legitimate interests you may object, and we will stop unless we can show compelling grounds that override your interests.
You may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would rather you came to us first, but that is your right and it is not conditional on doing so.
7. Changes
We will post changes here and, where they are significant, email you before they take effect.