Privacy Policy

This policy explains how AWRSCheck (“the Service”) collects, uses, and protects personal data. We are committed to processing personal data lawfully under the UK GDPR and the EU GDPR.

Who we are

The Service is operated by Kitti Papp, a sole proprietorship (egyéni vállalkozó) registered in Hungary, who is the data controller responsible for your personal data.

• Controller: Kitti Papp
• Registered address: Balassi Balint utca 2, Sárospatak, 3950, Hungary
• Tax number: 92197055-1-25
• Contact: hello@awrscheck.co.uk

What we collect

Depending on how you use the Service, we may collect:

• Account data — your name, business name, email address, and password (stored in hashed form).
• Supplier data you enter — the supplier names and AWRS reference numbers (URNs) you add to check. This is generally business information, but may relate to individuals such as sole traders.
• Verification records — the results, timestamps, and PDF records generated when you check a URN against HMRC’s public register.
• Billing data — subscription and payment records. Card details are collected and processed directly by our payment processor (Stripe); we do not store your full card number.
• Usage and analytics data — limited, privacy-friendly analytics about how the Service is used (see “Cookies and analytics” below).
• Communications — any information you include when you contact us by email.

How we use your data and our legal basis

• To create and operate your account, run checks, and store your records — performance of a contract.
• To process payments and manage subscriptions — performance of a contract.
• To send service emails, including confirmations and status-change alerts — performance of a contract.
• To maintain, secure, and improve the Service, and understand how it is used — our legitimate interests in running and improving a reliable service.
• To meet legal, accounting, and tax obligations — compliance with a legal obligation.

Cookies and analytics

We use PostHog for privacy-friendly analytics. We do not track your IP address, do not use persistent tracking cookies, and do not build advertising profiles. Analytics data is stored in memory only and is used to understand how visitors interact with the Service so we can improve it.

We use a single browser local-storage item to remember your cookie preference and theme choice. We do not use third-party advertising or tracking cookies. If you decline analytics via the cookie banner, we opt you out of analytics capture.

Who we share it with

We do not sell your personal data. We share it only with the service providers (sub-processors) that help us run the Service, and only as needed for the purposes above:

• Stripe — Payment processing and subscription billing.
• Resend — Sending account and status-change emails.
• Vercel — Website and application hosting.
• Supabase — Account and application database hosting.
• Amazon Web Services (AWS) — Encrypted storage of verification records.
• PostHog — Privacy-friendly product and website analytics.

We may also disclose data where required by law, to protect our legal rights, or in connection with a business transfer.

International transfers

Some of our providers are located in, or transfer data to, countries outside the UK and European Economic Area (including the United States). Where this happens, we rely on appropriate safeguards — such as UK/EU adequacy decisions or Standard Contractual Clauses (and the UK International Data Transfer Addendum) — to ensure your data receives an equivalent level of protection.

How long we keep it

We keep account data for as long as your account is active. Verification records are retained to support your record-keeping — by default for up to 6 years, reflecting the HMRC record-keeping period — including after cancellation, unless you ask us to delete them earlier. Billing records are kept for as long as required by law. When data is no longer needed, we delete or anonymise it.

Your rights

Under the UK and EU GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data erased in certain circumstances
• Restrict or object to how we process your data
• Receive your data in a portable format
• Withdraw consent where processing is based on consent

To exercise any of these rights, email hello@awrscheck.co.uk. You also have the right to complain to a data protection authority. As we are established in Hungary, the lead authority is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH); if you are in the UK, you may also complain to the Information Commissioner’s Office (ICO).

Security

We apply reasonable technical and organisational measures to protect personal data, including encryption of stored verification records. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated. Material changes will be reflected here.

Contact

For any privacy-related questions or requests, email hello@awrscheck.co.uk.

AWRSCheck is not affiliated with or endorsed by HMRC.