Privacy notice
How BandCheck collects, stores, uses and protects your personal data under UK GDPR.
Last updated: June 2026
Who we are
The data controller is Ricekernel Ltd (New Zealand), trading as BandCheck. Contact: [email protected]. We apply UK GDPR standards to the personal data of UK users. Registered office details available on request.
What we collect
| Data | Source | Lawful basis |
|---|---|---|
| Postcode + house number | You enter | Article 6(1)(b) — performance of contract |
| Email (if provided) | You enter | Article 6(1)(b) |
| Name + contact address (if you buy a package) | You enter | Article 6(1)(b) |
| Move-in date (if you provide one) | You enter | Article 6(1)(b) |
| Payment data — Stripe Checkout | Stripe Checkout | Article 6(1)(b); Stripe is a separate processor |
Who we share data with
- Valuation Office (part of HMRC) / your local Scottish Assessor — we generate documents you choose to send. We do not transmit on your behalf without your action.
- Resend — transactional email provider for reminders. EU (Ireland) hosted.
- Stripe — payment processing. PCI-DSS compliant.
- Cloudflare R2 — encrypted object storage for generated PDFs (EU / Western Europe region). Signed URLs expire within 1 hour.
How long we keep data
Appeal records: 6 years, the standard contract limitation period in England and Wales. Email-only sign-ups (no purchase): 12 months.
Your rights
- Access — get a copy of all data we hold about you within 30 days
- Rectification — correct inaccurate data
- Erasure — request deletion (we retain anonymised audit logs where legally required)
- Portability — export in machine-readable format
- Object — to processing based on legitimate interest
Email [email protected] to exercise any of these. If we don't respond satisfactorily, you can complain to the ICO.
International transfers
Your data is processed by Ricekernel Ltd in New Zealand. New Zealand holds UK adequacy regulations status, meaning personal data may be transferred from the UK to New Zealand without additional safeguards. Our processors (Stripe, Resend, Cloudflare R2) may process payment and email metadata in the EU and US under their standard contractual clauses; encryption at rest and data minimisation apply throughout.
Cookies
See our Cookie policy for the specifics.