Skip to content
rightly rated
Free check
Draft. ABT Ventures LTD’s ICO registration number and VAT number are still to be added to these pages. Everything else here is the version that applies.

Privacy Policy

Last updated: 12 October 2026

This policy explains how ABT Ventures LTD (company 12437106, registered office 19 Colne Road, Trawden, Colne, BB8 8NX), trading as Rightly Rated, uses personal data. We are the controller. ICO registration number: [ICO registration number to be added]. Contact for privacy questions: support@rightlyrated.uk, or write to us at the address above.

1. Whose data we handle

  • People who visit our website or run a free check.
  • Customers who buy a pack, and people who create an account.
  • People who contact us.
  • Business contacts at limited companies and LLPs we email about our services (see section 5, "Business outreach").

2. What we collect and why

What Why Lawful basis How long
Free check: the property you look up, your check options and result, and a one-way hash of your IP address To run the check and prevent abuse Legitimate interests (providing the service you asked for; security) 90 days
Purchase: email address, the property, details you choose to add (your interest in the property, rent, notes, process dates), order and payment status from Stripe To create and deliver your pack, show your case page, send receipts Contract Case data: 12 months after your Challenge concludes or you ask us to delete it, whichever is sooner (subject to the line below)
Comparable preview: the property, your confirmation that you are its ratepayer or owner or act for them (the exact wording), the time, and a one-way hash of your IP address To show you a comparable from the Valuation Office data only where its licence allows (business rates purposes), and to show we did that Legitimate interests (complying with the data licence) 12 months
"Email me my result": your email, the property, the exact consent wording you ticked, the time, the page, and a one-way hash of your IP address To email your result and deadline reminders for that property, after you confirm your address Consent (withdraw any time with the unsubscribe link) Until you unsubscribe, or 24 months after your last confirmed sign-up; after unsubscribing we keep only your email on our do-not-contact list
Page-version testing: which version of a page you saw and whether you then ran a check, keyed by a one-way hash of your IP address and browser type. No cookie is set To learn which wording helps people most Legitimate interests 90 days
Order and invoice records Tax and accounting Legal obligation 6 years after the end of the financial year
Account: email address and sign-in records To let you sign in and see your cases Contract Until you close your account, then 30 days
Reminders: the deadlines you tell us and your email To send the reminders you asked for Contract (you can turn them off) As case data
Draft statement: the facts you give us are processed by an AI model hosted by Cloudflare to draft wording for you to check and edit To prepare your pack Contract As case data
Support emails To answer you Legitimate interests 2 years after the conversation ends
Security logs (IP address, user agent, request logs at our host) To keep the service secure Legitimate interests Up to 30 days, or as our host retains them
Business outreach: see section 5 Marketing our services to companies Legitimate interests See section 5

We do not sell personal data. We do not use it for profiling or advertising. We do not make decisions about you that have legal or similarly significant effects by solely automated means. The AI drafting produces a draft for you to edit. It does not decide anything.

Payment card details are collected and processed by Stripe. We never see or store your full card number.

Valuation Office data: our checks use the Valuation Office's published rating list. We drop the occupier-name field and do not use personal data from the list.

3. Marketing to customers

We send customers marketing emails only if they opt in. Every marketing email has an unsubscribe link. Service emails (receipts, your case link, reminders you asked for) are not marketing.

4. Who we share it with

We use these service providers (processors), which act on our instructions:

  • Cloudflare, Inc.: website hosting, database, AI drafting, security.
  • Supabase, Inc.: sign-in (email codes and links).
  • Resend (or our current transactional email provider): sending emails.
  • Our email and office software provider: our support mailbox.
  • Stripe Payments Europe / Stripe, Inc.: payments. Stripe is also an independent controller for its own fraud-prevention and legal duties. See stripe.com/privacy.

We may also share data:

  • with our accountant and professional advisers
  • with HMRC or other authorities where the law requires
  • with a buyer if our business is sold

International transfers: some of these providers process data in the United States or elsewhere outside the UK. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge for certified companies) or the ICO's International Data Transfer Agreement or Addendum.

5. Business outreach (B2B email)

  • What we do: we email limited companies and LLPs in England and Wales that occupy business premises, to tell them about our free business rates check and our packs. We do not email sole traders, partnerships that are not legal persons, or consumers.
  • Where the data comes from:
    • the public Companies House register (company name, number, address, sector)
    • the Food Standards Agency's public food hygiene data (business name and premises address)
    • the business's own website (its published business email address and, sometimes, the name and role of a published contact)
  • What we hold: company details; a business email address; if published, a contact's name and role; and when we emailed and whether you unsubscribed.
  • Lawful basis: legitimate interests (promoting our services to businesses likely to benefit). We have carried out a legitimate interests assessment. You can ask us for a copy.
  • How long: if you don't reply, we delete your details 90 days after our last email. We send at most 3 emails. We keep a record of what we sent for 12 months, as evidence that we followed the rules.
  • Your right to object: you can tell us to stop at any time, by clicking unsubscribe, replying "stop" or emailing us. We will stop straight away. We then keep only your email address, the company number and the date on a suppression list, so we never contact you again. That is the only reason we keep it.

6. Your rights

You have the right to:

  • access your personal data
  • have it corrected
  • have it erased
  • restrict its use
  • data portability
  • object to our use of it. Your right to object to direct marketing is absolute.

To use any of these rights, email support@rightlyrated.uk. We reply within one month. There is normally no charge. You can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113. We'd appreciate the chance to put things right first.

7. Security

We use encryption in transit, signed session cookies, access controls, and providers with recognised security certifications. Payment data is handled by Stripe. No method is perfectly secure. If a breach is likely to put your rights at high risk, we will tell you.

8. Children

Our service is for businesses and is not aimed at children.

9. Changes

We will post any changes here and update the date at the top. If a change is significant, we will tell customers by email.

Also see: Terms of Sale · Privacy Policy · Cookie Notice · Data Notice