Privacy

OpenCommons is a family of sites that republish UK public registers. This one page covers all of them: what personal data they publish and collect, why, and what you can do about it.

The sites are opencharities.uk, opencompanies.uk, openinterests.uk, openlegislation.uk, openpostcodes.uk and openproperties.uk, with this site, opencommons.uk, and the map tile service maptiles.opencommons.uk.

• Who we are
• Your rights
• OpenCompanies
• OpenCharities
• OpenInterests
• OpenProperties
• OpenLegislation
• OpenPostcodes
• What we collect when you visit
• AI assistants and the APIs
• Map tiles
• Where data is processed
• How long we keep it

Who we are

Your rights

You can object

If you are named on one of these sites, you have the right to object to us publishing information about you. Email privacy@opencommons.uk with the address of the page and why it concerns you. There is no automatic opt-out: we weigh your circumstances against the public interest in the register, and tell you what we decide within a month. If it is about your safety, say so, and we will take the page down while we look at it.

Your other rights

Under UK data protection law (the UK GDPR) you can also ask for a copy of the personal data we hold about you, and ask us to correct it, delete it or restrict how we use it. We reply within a month.

Each site republishes an official register, and that register is the authoritative record. A correction made there reaches our copy when we next refresh the data, so it is usually quickest to correct the source as well. Each site’s section below says where.

Complaints

If you are unhappy with how we have handled your data, email us. We will acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner’s Office.

The people on the sites

Our lawful basis for publishing register data is legitimate interests: making public registers easier to search, compare and connect, so anyone can see who runs, owns, funds or is paid by the organisations in them. That transparency is why the registers are public in the first place. We publish only what the source registers have already made public, and we don’t add personal data from anywhere else.

Pages about people on these sites are open to search engines and listed in the sites’ sitemaps, so they can appear in search results. When we remove a page, search engines can take a while to drop it.

OpenCompanies

opencompanies.uk republishes the Companies House register: companies, the people who run them and the people who control them. For company officers (directors, secretaries and LLP members) and people with significant control (PSCs), it publishes what Companies House publishes:

• their name;
• their month and year of birth;
• their nationality, country of residence and occupation;
• the companies they are or were involved in, their role, and the dates they were appointed, resigned, notified or ceased;
• for PSCs, the nature of their control, such as how many of the shares they hold;
• whether their identity has been verified with Companies House;
• any director disqualification.

It also holds the correspondence address each officer and PSC gave Companies House, and uses it to show which people and companies share an address.

Where it comes from

All of it comes from Companies House: its bulk data products, its streaming service and its public API. The law requires most of it to be on the public register.

What it never holds

• Day of birth. Companies House publishes only the month and year. Where a source does include a full date of birth (disqualification records, and some bulk officer records), we keep the month and year and drop the day.
• Home addresses. Companies House keeps home (usual residential) addresses on a restricted register that it does not publish, so we never receive them. If someone gave their home as their correspondence address, though, Companies House publishes it, and so do we.

Who is who

We only treat two records as the same person when a Companies House identifier says they are. Records that merely share a name and month and year of birth are shown as “possibly the same person”, never merged, unless someone has checked them by hand.

Keeping up with Companies House

• When Companies House updates a record, for example with a new correspondence address, our copy changes too, usually within a day.
• We keep history. Resigned appointments, ceased PSCs and dissolved companies stay on the site, with their end dates.
• When Companies House deletes a record from its register, usually because it was filed in error, we take our copy off the site too, usually within a day. That covers companies removed from the register, appointments, people with significant control and disqualifications. If you find a record here that Companies House has deleted or suppressed, tell us and we will take it down.
• Filed accounts documents are not stored. When you open one, our server fetches it from Companies House at that moment, so your browser never contacts Companies House. Cloudflare may cache the document for a while.
• If a record about you is wrong, correct it with Companies House, and our copy will follow. Companies House is also who to ask about removing your home address, day of birth or signature from older filings.

Other ways the same data is published

Every company and person page is also available as JSON and Markdown and through the MCP server, and the officer and PSC records also go into public bulk files, rebuilt weekly. Removing a record removes it from the pages, the JSON, the Markdown and the MCP server together (cached copies can take a few hours to expire), and from the bulk files when they are next rebuilt. The sitemaps list every company and every person with two or more appointments.

OpenCharities

opencharities.uk republishes the UK’s three official charity registers, from the Charity Commission for England and Wales, the Scottish Charity Regulator (OSCR) and the Charity Commission for Northern Ireland. Most of it is about organisations, but some of it is about people:

• Trustees. For England and Wales, each trustee’s name, whether they chair the charity, whether they are an individual or an organisation, and the date they were appointed, from the Charity Commission’s register extract. For Northern Ireland, trustee names from the Charity Commission for Northern Ireland’s public charity pages. We don’t hold trustee names for Scottish charities.
• Trustee pages. Each trustee name has its own page listing the charities it appears on. The page is built from the name alone, so where two people share a name, their roles appear together.
• Charity contact details. The address, phone number, email address and website each regulator publishes for a charity. For Scottish charities the address is the one OSCR publishes as the principal office or trustees’ address.
• Filed documents. Copies of the accounts and annual reports charities file with the regulators, and their text, which you can search. These are the charities’ own documents and can name trustees, staff and other people.
• Charity websites. The text of pages on each charity’s own website, and a screenshot of its home page (see below).

The registers we use don’t give trustees’ dates of birth, and we don’t hold an address for each trustee. Charity pages, trustee pages and documents are listed in the sitemap.

Keeping up with the registers

• If something about you is wrong, ask the regulator to correct it, and the correction will reach the site when we next refresh the data.
• Trustee lists are replaced in full each time we refresh from the registers, so when a regulator removes a trustee, they disappear from the site at the next refresh.
• Charities removed from a register are kept and marked as removed.
• Copies of filed documents are not removed automatically if a regulator later withdraws one. If a document should come down, tell us.

If you run a charity’s website

Each charity’s register entry can include its website. We visit those websites to make their text searchable.

• Our crawler identifies itself with the user agent Mozilla/5.0 (compatible; OpenCharities/1.0; +https://opencharities.uk).
• It follows your robots.txt. It matches rules for OpenCharities or *, honours Disallow, and honours a Crawl-delay of up to 5 seconds. It waits at least half a second between requests to the same site.
• It reads up to 150 pages in all, fewer for smaller charities, starting with your home page and then following your sitemap or the links on your site. It stays on your site, doesn’t run JavaScript, and keeps only the text of web pages, not images or files.
• We keep each page’s address, title and visible text. Each new crawl replaces the last.

To stop the crawler, add this to your robots.txt. The text we hold from your site is removed the next time we crawl it.

User-agent: OpenCharities
Disallow: /

Screenshots. We also show a small screenshot of each charity’s home page. It is taken through Cloudflare’s Browser Rendering service, so the visit comes from Cloudflare rather than from our crawler, and it does not check robots.txt. We store a 600-pixel-wide image and show it on the charity’s page. To have a screenshot removed, get in touch.

Site icons. To show your site’s icon, our server asks Google’s favicon service for it by your domain name, and stores the icon.

Asking about a charity with AI

Each charity has an Ask page where you can type a question about it. Your question is sent, with that charity’s public data, to Google’s Gemini service, which may also search the web to answer it. We keep a record of each question: the question, the answer, when it was asked and your IP address. These records are not yet deleted automatically. Please don’t put personal information in a question.

OpenInterests

openinterests.uk republishes two public registers about money in UK politics. Both name people.

• MPs and peers. Current and former members of both Houses, from the UK Parliament Members API: name, House, party, constituency, whether they still sit and when they left, and their official portrait. Portraits are copied from Parliament and served from our own storage.
• Financial interests. What MPs declare in the Register of Members’ Financial Interests, from Parliament’s Interests API. A declaration is shown as Parliament publishes it, and may name whoever paid or gave a benefit, including a private individual.
• Donations. Donations reported to the Electoral Commission, from 2001 to now: the donor’s name and status, the recipient, the amount, the type and the dates. This includes donations from individuals. The Commission publishes a postcode and company number for organisations that give, but not for individuals, so we hold neither for an individual donor.

A donation to a political party can reveal someone’s political views, which the law treats as more sensitive. We publish only what the Electoral Commission already publishes, and add nothing to it about the people named. The site exists for transparency and to support journalism and research.

Matching records to people

• MPs and peers are matched by Parliament’s own member id.
• Individual donors are matched by name alone, because the Electoral Commission gives a new donor id for almost every donation. Two different people with the same name can end up on one page. A donor page is not proof that the donations are all from one person.
• Organisations are matched by name, sometimes by close spelling, and a donor organisation is linked to OpenCompanies only by the company number the Electoral Commission publishes for it.

If we have linked you to records that aren’t yours, tell us and we’ll fix it.

Keeping up with the source

MPs’ and peers’ details and financial interests are corrected by UK Parliament (interests are the responsibility of the Parliamentary Commissioner for Standards), and donations by the Electoral Commission. When a record changes at the source, the next refresh updates it here. The import does not yet remove a record that has been deleted from the source register, so if something has been taken down or withdrawn there, tell us and we will remove it.

OpenProperties

openproperties.uk publishes every sale in HM Land Registry’s Price Paid Data, from 1995 to the latest monthly release: the address, the price, the date, the type of property, whether it was new, and its tenure. The data does not name buyers or sellers. But an address and what was paid for it can still be about a person, so we treat it as personal data.

• What we add. Nothing about people. We group sales at the same address into one property, and show addresses in title case. The location on a property page is the centre of its postcode, from Ordnance Survey’s Code-Point Open, not the position of the building. HM Land Registry also publishes UPRN and INSPIRE look-up files for recent sales. We store them, but no page, API or tool shows them.
• Where it appears. Every property and sale with an address has its own page, the same data as JSON, and the MCP server.
• Corrections. If a sale is wrong, ask HM Land Registry to correct it. Each month we apply its update file. When it changes a sale, we change it here, and if the address changes, the old link redirects to the new one. When it deletes a sale, we delete it from our database, and a property with no sales left is removed in the same monthly run.
• Removing something here does not change HM Land Registry’s own record, which stays published by them.

OpenLegislation

openlegislation.uk republishes UK legislation from legislation.gov.uk. Legislation sometimes names people, such as the minister who signed a statutory instrument. We only republish what The National Archives has already published.

OpenPostcodes

openpostcodes.uk holds no names, addresses or house numbers. It publishes every live UK postcode, with the Channel Islands and the Isle of Man, and the areas, codes and statistics that go with it, from the ONS Postcode Directory and the other open datasets on its Sources page. Its nearest stations, GPs, schools and other places are organisations and public facilities, not people.

What we collect when you visit

Cookies and your browser

• No site sets cookies for visitors, and none stores anything in your browser’s local storage. Your browser may keep copies of files in its normal cache.
• The OpenCharities Ask page sets one cookie, csrftoken, which protects its form from forgery and holds nothing about you.
• The staff admin on OpenCharities, OpenCompanies, OpenInterests, OpenLegislation and OpenProperties sets session and security cookies for the people who run the sites, only when they sign in.

Analytics

Every site except the map tile service counts visits with fivebar (fiveb.ar), a cookieless analytics service that is also run by Jason Cartwright. It sets no cookies.

Your browser loads a script from fiveb.ar. For each page it sends the page address, the page you came from, your window width and whether a script is driving your browser. As you leave, it sends how long the page was on screen, how far down you read and how quickly it loaded. It also sends clicks on links to other sites and file downloads. fivebar keeps only counts, by site and by day. It uses your IP address and browser details to tell visitors apart for one day, through a one-way code that it deletes after 30 hours, and does not keep them. It does not let us see who you are, or follow you from one day to the next. Its counts are stored in Germany.

The JSON, Markdown and API formats load no analytics. A content blocker that blocks fiveb.ar stops it altogether, and the sites work the same without it.

Searches

No site stores what you search for. Your search words go into the page address (for example /search?q=tesco), so they reach Cloudflare, the logs described below and fivebar, as any page address does.

Logs

• OpenCharities, OpenCompanies, OpenInterests, OpenLegislation and OpenProperties. The application does not log the pages you view, your IP address or what you search for. Their MCP servers log one line per request, described below.
• OpenPostcodes and the map tile service run on Cloudflare Workers, with Cloudflare’s Workers Logs turned on. For each request they record the method and address (which, on OpenPostcodes, includes the postcode looked up), the request headers, such as your browser’s user agent and the page you came from, and details Cloudflare adds, such as your approximate location. They can include your IP address. They are used only to find faults and keep the services running, and Cloudflare deletes them after at most 7 days. The postcodes you look up are not stored anywhere else.
• opencommons.uk is a set of static files with no server code of its own, so nothing in it writes logs.
• Cloudflare sits in front of every site and handles every request, so it sees your IP address and the page you asked for. It processes them to deliver and protect the sites, under its own privacy policy.

What your browser fetches from elsewhere

• opencommons.uk serves the shared stylesheet, the Inter font, and the map and chart code to every site, under /shared/. These requests carry no analytics. The network bar across the top of each site comes from here too, but the sites’ servers fetch and cache it, so your browser does not request it from here.
• maptiles.opencommons.uk serves map tiles on OpenCompanies, OpenCharities, OpenPostcodes, OpenProperties and the design language page (see Map tiles).
• membersphotos.openinterests.uk serves members’ portraits on OpenInterests, from Cloudflare R2 storage.
• legislation.gov.uk serves the images in some legislation on OpenLegislation.
• On OpenCharities, pointing at or tabbing to a charity’s company number fetches the company’s details from opencompanies.uk.
• fiveb.ar, for the analytics above.

Fonts are never loaded from Google Fonts or a font CDN. Links to other sites are ordinary links: nothing is sent to them unless you follow one.

AI assistants (MCP) and the APIs

OpenCharities, OpenCompanies, OpenLegislation, OpenPostcodes and OpenProperties each run an MCP server for AI assistants, and most sites also serve their data as JSON. None of it needs a key, account or sign-in.

• The MCP servers are stateless: no cookies and no sessions.
• Each MCP request is logged as one line: the method, the tool’s name, how long it took, the outcome, and the name the assistant gives itself. What was asked is never logged: no arguments, search text, postcodes or addresses.
• Each MCP tool call is also counted by fivebar, as a page view is: the tool, the outcome, how long it took, the name the assistant gives itself, and the IP address and browser string the request came from, which fivebar uses to place and tell apart callers without storing them. For an assistant that runs on its maker’s servers, such as Claude, that address is its maker’s, not yours. What was asked is never sent.
• The send_feedback tool lets an assistant send us a short note about the tools, only once you have agreed. We keep the note, its kind, the tool it is about, the assistant’s name and version, and when it was sent, for up to 365 days. A note that contains an email address, an IP address or a web address with a query string is refused. Your IP address is never stored, only a keyed hash of it, used to limit how many notes one address can send. The note itself is never written to a log.

Map tiles

maptiles.opencommons.uk is our map tile proxy. OpenCommons sites, and any other site that chooses to, load their map styles, tiles, icons and fonts from it. Each request is passed on to OpenFreeMap’s public tile service, and the answer is cached and sent back. The maps are built from OpenStreetMap data, and the service publishes nothing about people.

• Only the path and query of the map file, and the request method, are sent to OpenFreeMap. Not your IP address, cookies, browser details or the page you came from: the request to OpenFreeMap is a new one made from Cloudflare’s network.
• Answers are cached on Cloudflare’s network, map styles for an hour and tiles, icons and fonts for a week. The cache holds map files only, nothing about who asked for them.
• It sets no cookies and runs no analytics. Its logs are described above.
• Any website can load maps from it. If you see a map on another site, that site’s own privacy policy covers the rest of what it does.
• Its demo page at maptiles.opencommons.uk loads the MapLibre map library from unpkg.com, so your browser also connects to unpkg when you open it.

Where data is processed

• Hetzner, in Falkenstein, Germany, runs the servers and databases for OpenCharities, OpenCompanies, OpenInterests, OpenLegislation and OpenProperties, managed with Coolify.
• Cloudflare sits in front of every site, and answers each request from a data centre near you, which may be outside the UK. It also hosts opencommons.uk, OpenPostcodes (with its database, cache and logs) and the map tile service, and stores OpenCompanies’ bulk files, OpenCharities’ document copies and screenshots, and OpenInterests’ portraits. OpenCharities’ screenshots are taken with Cloudflare’s Browser Rendering.
• fivebar receives the analytics described above, and stores its counts in Germany.
• Google receives questions asked on OpenCharities’ Ask pages, and requests for charity website icons.
• The source registers (Companies House, the charity regulators, UK Parliament, the Electoral Commission, HM Land Registry, The National Archives and the ONS) are where the data comes from. OpenCompanies fetches filed accounts documents from Companies House when you open one.

Nothing is sold, and nothing is used for advertising.

How long we keep it

• OpenCompanies register data: indefinitely, as a historical record, including resigned officers, ceased PSCs and dissolved companies, unless we remove it after a request. Records Companies House has deleted are taken off the site but kept in our database with the date it deleted them, so we can show what we removed and why, and show a record again if Companies House restores it. Raw copies of Companies House updates are kept for 30 days, except notices that a record was deleted. Downloaded Companies House files are deleted once they are 3 days old.
• OpenCharities register data: for as long as the site runs. Trustee lists follow the register at each refresh, and removed charities stay, marked as removed. Website text is kept until the next crawl replaces it, and document copies and screenshots until replaced or removed on request. Ask records are not yet deleted automatically.
• OpenInterests register data: for as long as it is on the public register, and until we act on a request to remove it.
• OpenProperties sales data: for as long as HM Land Registry publishes it. Changes and deletions are applied each month.
• Workers Logs (OpenPostcodes and the map tile service): up to 7 days.
• MCP feedback notes: up to 365 days.
• Searches: not kept.
• Analytics: counts only, held by fivebar. Its daily visitor code is deleted after 30 hours.

Changes

We update this page when what the sites do with data changes.

Last updated: 10 November 2026