Privacy Policy

Enter Banner Content Here

Privacy Policy for All Websites

Small Firms Services Ltd
Trading as The Apostille Service

1. Introduction
1.1 We are dedicated to protecting the privacy of our website visitors and service users.
1.2 This policy applies when we act as a data controller for the personal data of our website visitors and service users.
1.3 By using our website and agreeing to this policy, you consent to the use of cookies in line with the terms outlined in this policy.
1.4 In this policy, “we”, “us”, and “our” refer to Small Firms Services Ltd, trading as The Apostille Service. For more details about us, please refer to Section 12.

2. How We Use Your Personal Data
2.1 In this Section, we outline:
(a) The general categories of personal data we may process;
(b) For personal data we did not collect directly from you, the source and specific categories of that data;
(c) The purposes for which we may process personal data; and
(d) The legal bases for processing this data.

2.2 We may process data regarding your use of our website (“usage data”). This data can include your IP address, location, browser type and version, operating system, referral source, duration of visit, pages viewed, and your navigation on the site, as well as data on the timing, frequency, and pattern of your visits. This usage data may be processed to analyze how the website is used. The legal basis for this processing is our legitimate interests in monitoring and improving the website and services.

2.3 We may process your account data (“account data”), which may include your name and email address. The source of this data is you. If you are submitting data on behalf of someone else, such as a business partner, family member, or as an accountant representing a client, you must have their consent. This account data may be processed to operate our website, provide services, secure the website and services, maintain backups, and communicate with you. The legal basis for processing is our legitimate interests, specifically the performance of a contract with you and/or taking steps at your request to enter into a contract for services or products from us.

2.4 We may process your personal data provided during the use of our services (“service data”). This service data may include names, addresses, dates of birth, nationality, and any other information necessary to fulfill the requested service or which would otherwise make it impossible to provide the service. The source of this data is you. If you are providing data on behalf of another individual, such as a business partner, family member, or as an accountant acting on behalf of a client, you must have the consent of that person. The service data may be processed for purposes such as operating our website, providing our services, ensuring the security of our website and services, maintaining backups of our databases, and communicating with you. The legal basis for processing this data is our legitimate interests, namely the performance of a contract between you and us, or taking steps at your request to enter into such a contract to incorporate a business or purchase a service or product from us.

2.5 We may process information contained in any enquiry you submit to us regarding goods and/or services (“enquiry data”). This enquiry data may be processed for the purposes of offering, marketing, and selling relevant goods and/or services to you. The legal basis for this processing is your request for information or services made through your enquiry.

2.6 We may process information related to transactions, including the purchase of goods and services that you enter into with us and/or through our website (“transaction data”). The transaction data may include your contact details, card details, and transaction details. This data may be processed for the purpose of supplying the purchased goods and services and maintaining accurate records of those transactions. The legal basis for this processing is the performance of a contract between you and us, or taking steps at your request to enter into such a contract, and our legitimate interests, namely the performance of the contract between you and us or taking steps at your request to enter into a contract to incorporate a business or purchase a service or product from us.

2.7 We may process information that you provide to us for the purpose of subscribing to our email and SMS notifications (“notification data”). The notification data may be processed for the purpose of sending you relevant notifications about service status and contract updates or changes. The legal basis for this processing is the performance of a contract between you and us, or taking steps at your request to enter into such a contract, or to amend or renew a contract when it comes to an end.

2.8 We may process information that you provide to us for the purpose of subscribing to our email newsletters (“newsletter data”). The newsletter data may be processed for the purpose of sending you the relevant newsletters. The legal basis for processing this data for newsletters is your consent.

2.9 We may process information contained in or relating to any communication that you send to us (“correspondence data”). The correspondence data may include the content of the communication as well as metadata associated with the communication. Our website may generate metadata associated with communications made using the website contact forms. The correspondence data may be processed for the purposes of communicating with you and keeping records of these communications. The legal basis for this processing is our legitimate interests, namely the proper administration of our website and business and communications with users.

2.10 We may process any of your personal identity data as outlined in this policy for the purpose of identifying you as a user of our services (“identity data”). Where necessary to comply with Money Laundering Regulations, we will request and store data that verifies your identity. The legal basis for this processing is our legitimate interests, specifically our obligation to comply with Money Laundering Regulations.

2.11 We may process any of your personal data outlined in this policy for the purpose of verifying documents for you as a user of our services (“verification data”). If necessary, for document verification with the issuing authority, we may request and store data that confirms the legitimacy of the document. The legal basis for this processing is our legitimate interests, namely the performance of a contract between you and us, or taking steps at your request to enter into such a contract to verify the legitimacy of a document and/or legalize it.

2.12 We may process any of your personal data identified in this policy when necessary for the establishment, exercise, or defense of legal claims, whether in court proceedings, administrative procedures, or out-of-court procedures. The legal basis for this processing is our legitimate interests, specifically the protection and assertion of our legal rights, your legal rights, and the legal rights of others.

2.13 We may process any of your personal data identified in this policy when necessary for obtaining or maintaining insurance coverage, managing risks, or obtaining professional advice. The legal basis for this processing is our legitimate interests, namely the proper protection of our business against risks.

2.14 In addition to the specific purposes for which we process your personal data as described in this Section 2, we may also process your personal data where such processing is necessary for compliance with a legal obligation to which we are subject or to protect your vital interests or the vital interests of another individual.

2.15 Please do not provide us with any personal data of others without their consent.


3. Providing Your Personal Data to Others

3.1 We may disclose your personal data to any member of our group of companies (which includes our subsidiaries, our ultimate holding company, and all its subsidiaries) to the extent that it is reasonably necessary for the purposes and legal bases set out in this policy.

3.2 We may disclose your personal data to our insurers and/or professional advisors to the extent that it is reasonably necessary for the purposes of obtaining or maintaining insurance coverage, managing risks, obtaining professional advice, or establishing, exercising, or defending legal claims, whether in court proceedings or out-of-court administrative procedures.

3.3 We may disclose your personal data to our suppliers or subcontractors as needed.

3.3 (a) To facilitate the incorporation of a business through our service, we will pass your transaction data and service data to Companies House. This will not include any card payment details.

(b) If we refer you to another third-party service, we will share your transaction data with that service. This will not include any card payment details. Since we offer multiple referrals, please contact us to obtain the contact details for a specific referral or to inquire about which referrals you have requested.

(c) If we provide goods or services from another third-party supplier, we will pass your transaction data to that supplier. This will not include any card payment details. As we offer a variety of goods and services, please contact us to get the contact details for a specific third-party supplier or to learn which third party supplied the goods or services requested by you.

3.4 We may disclose your personal data and any documents you have provided to us to:

(a) Third-party verification services, such as credit reference agencies, identity checking services, or qualification verification services. This applies only if we need to verify your identity or provide a document legalization service.

(b) The person or organization that issued the document to you. This applies only if we need to verify your identity or provide a document legalization service.

(c) Embassies, chambers of commerce, or third parties processing documents with embassies on our behalf. This applies only if we are providing a document legalization service.

(d) Authorities such as the Police, Trading Standards, HM Revenue and Customs, and other official organizations that are authorized to access our records and can provide proof of their identity to us.

3.5 Financial transactions related to our website and services may be processed by our payment service providers, SagePay and First Data Merchant Services. We will share transaction data with our payment service providers only to the extent necessary for processing your payments, issuing refunds, and handling any complaints or queries related to such payments and refunds.

3.6 We may disclose the data detailed in Section 2 to one or more selected third-party suppliers of goods and services listed on our website. This is for the purpose of enabling them to contact you with offers, marketing, and sales of relevant goods and/or services. Each third party will act as a data controller for the enquiry data we provide to them. When contacting you, each third party will make its privacy policy available to you, which will govern their use of your personal data.

3.7 In addition to the specific instances of personal data disclosure outlined in this Section 3, we may disclose your personal data where such disclosure is required for compliance with a legal obligation we are subject to, or to protect your vital interests or those of another individual. We may also disclose your personal data when necessary for the establishment, exercise, or defense of legal claims, whether in court proceedings or administrative or out-of-court procedures.

4. International Transfers of Your Personal Data

4.1 You acknowledge that personal data you submit for publication through our website or services may be accessible worldwide via the internet. We cannot prevent others from using (or misusing) such publicly available personal data.

5. Retention and Deletion of Personal Data

5.1 This Section 5 outlines our data retention policies and procedures, which are designed to ensure compliance with our legal obligations regarding the retention and deletion of personal data.

5.2 Personal data that we process for any purpose will not be kept for longer than necessary to fulfill that purpose.

5.3 We will retain your personal data for a minimum period of: (a) six years from the end of the last company financial year in which we received your last payment for a contract to incorporate a business or purchase a service or product from us, or (b) five years from the date a business relationship ends, if we provide a service that forms a business relationship under Money Laundering Regulations, if this period is longer than the minimum period specified in (a).

5.4 In some cases, it may not be possible to specify in advance the retention periods for your personal data. In these instances, we will determine the retention period based on UK government guidance and legislation.

5.5 Notwithstanding other provisions in this Section 5, we may retain your personal data if such retention is necessary for compliance with a legal obligation we are subject to, or to protect your vital interests or the vital interests of another individual.

6. Amendments

6.1 We may update this policy periodically by publishing a new version on our website.

6.2 You should review this page occasionally to ensure you are satisfied with any changes to this policy.

6.3 We may notify you of changes to this policy via email or through a private message on our website.

7. Your Rights

7.1 This Section 7 outlines the rights you have under data protection law. Some of these rights are complex, and we have only provided a summary of them here. To fully understand your rights, you should refer to the relevant laws and guidance from regulatory authorities.

7.2 Your primary rights under data protection law include:

(a) the right to access; (b) the right to rectification; (c) the right to erasure; (d) the right to restrict processing; (e) the right to object to processing; (f) the right to data portability; (g) the right to lodge a complaint with a supervisory authority; and (h) the right to withdraw consent.

7.3 You have the right to confirm whether we are processing your personal data and, if we are, to access it along with additional information. This additional information includes details about the purpose of processing, the categories of personal data involved, and the recipients of your data. If the rights and freedoms of others are not affected, we will provide you with a copy of your personal data. The first copy will be free, but additional copies may incur a reasonable fee.

7.4 You have the right to request the correction of any inaccurate personal data and, if necessary, to have any incomplete data completed, taking into account the purposes of the processing.

7.5 In certain circumstances, you have the right to have your personal data erased without undue delay. Such circumstances include when the data is no longer necessary for the purposes it was collected, you withdraw consent for consent-based processing, you object to processing based on applicable data protection laws, the processing is for direct marketing, or the data has been unlawfully processed. However, there are exceptions to the right to erasure, such as when processing is necessary for freedom of expression, compliance with legal obligations, or the establishment, exercise, or defense of legal claims.

7.6 In some circumstances, you have the right to restrict the processing of your personal data. These include situations where you contest the accuracy of the data, the processing is unlawful but you oppose erasure, we no longer need the data but you require it for the establishment, exercise, or defense of legal claims, or you have objected to processing pending verification. If processing is restricted, we may still store your personal data but will only process it further with your consent, for legal claims, to protect the rights of others, or for important public interests.

7.7 You have the right to object to the processing of your personal data on grounds related to your particular situation, provided the legal basis for the processing is public interest, official authority, or legitimate interests pursued by us or a third party. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds for continuing the processing, which override your rights, or the processing is necessary for legal claims.

7.8 You have the right to object to our processing of your personal data for direct marketing purposes, including profiling for marketing. If you object, we will stop processing your data for these purposes.

7.9 You have the right to object to the processing of your personal data for scientific, historical research, or statistical purposes, unless processing is necessary for a task carried out in the public interest.

7.10 If the legal basis for processing your data is consent or necessity for the performance of a contract, and the processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format. This right does not apply if it would negatively affect the rights and freedoms of others.

7.11 If you believe our processing of your personal data infringes data protection laws, you have the right to file a complaint with the relevant supervisory authority. You can do this in the EU member state of your residence, your place of work, or the location of the alleged infringement.

7.12 If the legal basis for processing your data is consent, you can withdraw your consent at any time. This will not affect the lawfulness of processing before the withdrawal.

7.13 You can exercise any of your rights concerning your personal data by sending a written notice or an email, in addition to other methods outlined in this Section 7.

8. About Cookies

8.1 A cookie is a small file containing a unique identifier (a string of letters and numbers) sent by a web server to your browser, which is then stored by the browser. This identifier is sent back to the server whenever the browser requests a page.

8.2 Cookies can be classified as either “persistent” or “session” cookies. A persistent cookie is stored by the browser and remains valid until its specified expiration date, unless deleted by the user before that date. In contrast, a session cookie expires once the user session ends, which typically occurs when the browser is closed.

8.3 While cookies do not usually contain personal information, any personal data we collect about you may be associated with the information stored in or obtained from cookies.

9. Cookies We Use

9.1 We may use cookies for the following purposes:

  • (a) Authentication – to identify you when you visit and navigate our website.
  • (b) Status – to check whether you are logged into our website.
  • (c) Personalisation – to store information about your preferences and tailor the website to your needs.
  • (d) Security – to enhance the security of user accounts, prevent fraudulent login attempts, and protect our website and services.
  • (e) Advertising – to display relevant advertisements to you.
  • (f) Analysis – to analyse website usage and performance.
  • (g) Cookie Consent – to store your cookie preferences.

10. Cookies Used by Our Service Providers

10.1 Our service providers may use cookies that are stored on your device when you visit our website.

10.2 We use Google Analytics to assess how our website is used. Google Analytics collects data through cookies, which is then used to generate reports on website performance. For more details, you can review Google’s privacy policy here: https://www.google.com/policies/privacy/

11. Managing Cookies

11.1 Most browsers allow you to block or delete cookies. The methods vary by browser and version, but up-to-date information on how to manage cookies can be found at the following links:

11.2 Blocking all cookies may negatively impact the functionality of many websites.

11.3 If you choose to block cookies, some features on our website may not be available.

12. Our Details

12.1 This website is owned and operated by Small Firms Services Ltd.

12.2 We also operate under the names SFS, Simple Formations, and The Apostille Service.

12.3 We are registered in England and Wales under company number 3658573, with our registered office at Union House, 111 New Union Street, Coventry, CV1 2NT, United Kingdom.

12.4 Our primary business address is Union House, 111 New Union Street, Coventry, CV1 2NT, United Kingdom.

12.5 You can contact us by:

  • (a) Post: at the address provided above.
  • (b) Phone: using the contact number listed on our website.
  • (c) Email: through the address provided on our website.

13. Data Protection Officer

13.1 Our Data Protection Officer can be contacted by addressing any correspondence to “Data Protection Officer” using the contact details provided in Section 12.