Privacy notice

Last updated: 5 October 2026

Who we are

Patchlight is a trading name of Hu Concepts Ltd ("Patchlight", "we"), the data controller for the personal data described in this notice. We produce Patchlight Signals: a monthly research feed for commercial finance brokers that reads the public Companies House register for owner-managed companies across the counties we cover, identifies the ones whose filings indicate a likely need for finance (a charge coming to term, short-term borrowing with an exit due, a working-capital position, a strong year), and lists them with the filing behind each row and, where we hold them, the business contact details of the company's decision-maker.

Our registration with the Information Commissioner's Office is pending. This notice will be updated with the registration number and our registered address when they are confirmed.

If you are an officer or owner of a company in the public record

If a company you are connected with trades in a county we cover, this section explains what we hold about you, where it came from, why, who sees it, and your rights. It is our notice under Article 14 UK GDPR: because the information comes from public sources rather than from you, and the number of people concerned makes individual notification disproportionate, we inform you through this notice and by making it easy to object.

What we process

Information published on the Companies House register about companies and the people connected with them: company name, number, registered and trading address, filed accounts, charges registered and satisfied and the lender named on them, confirmation statements, the names of directors and persons with significant control, their roles and appointment dates. From that we derive analysis about the company: bands for size, net assets and estimated revenue, and workings such as a forecast maturity date for a facility or a working-capital position. Where a company publishes a website, we may read the business information it makes public there.

Business contact details for a company's decision-makers: work email address, business telephone number and the address of a public professional profile (for example LinkedIn). These come from the company's own website and from email-finding services that index public web sources, and are checked for deliverability before we use them.

We do not process residential addresses that are protected on the register, dates of birth or ages, or special category data. Owner ages appear in nothing we deliver.

Where it came from

The Companies House public register, published under the Companies Act 2006 for anyone to inspect; the company's own public website; and email-finding services that index public web sources. We do not buy marketing lists, and we do not read anyone's private accounts, inboxes or messages.

Why, and our lawful basis

To help commercial finance brokers identify businesses that may need finance and make a relevant, one-to-one business approach at the moment it is likely to matter. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): the broker's interest in finding businesses that need what they arrange, the business owner's interest in hearing from a broker when a facility is coming to term or funding is needed, and our interest in running the service. We have carried out and documented a legitimate interests assessment, including the balancing test against your interests, and will provide it on request.

Who we share it with

Commercial finance brokers who subscribe to Patchlight Signals, under a licence that limits use to their own business approaches and prohibits resale or redistribution. Each subscriber is responsible for its own communications with you and its own privacy notice applies to those. Our service runs on licensed software hosted in the UK or EU. We do not sell personal data to anyone else.

How long we keep it

While the company remains within a county we cover and the information remains current on the public register. If you object, we keep the minimum needed to make sure you are left out of every future report, and nothing else.

How to be removed

Email scott@patchlight.co.uk with the company name or number. We will remove the company and its people from every future report and confirm to you that we have done so. No form, no account, no reason required.

If you use this website

• One functional cookie, no third-party analytics. The public pages set no cookies and run no third-party tracking. Your private fifty page (addresses beginning /fifty/) sets a single cookie so that it can count and remember which contacts you opened; it holds nothing but those row numbers, is strictly necessary for the page to work, and expires after ninety days. Private sample pages we prepare for individual firms (addresses beginning /for/) record their own visits, first-party only, so that we know the page reached the firm it was made for and which rows were opened: the time of the visit, roughly how long the page was open, which lists and contacts were opened, the kind of device and browser, the approximate location the connection reports, and the connecting address reduced to a keyed hash so that return visits can be recognised without the address itself being kept. Nothing is stored on your device. Fonts are loaded from Google Fonts, which means your browser requests the font files from Google's servers; Google's privacy policy applies to that request.
• The free trial form. If you submit it, we collect your firm name, your name and your work email address. We use them to open a seven-day free trial of the Signals platform for your firm, to email you about that login, and to reply to you. Our lawful bases are your request (steps prior to a contract) and our legitimate interest in responding to you and in keeping free trials to one per firm.
• The earlier "get your fifty" form. If you submitted it before 5 October 2026, we hold your firm name, your name, your work email address, your telephone number if you gave it, and your answers to five questions about the finance you arrange, used to build the sample you asked for and to reply to you, on the same lawful bases.
• Delivery. Your submission is delivered to our mailbox by an email delivery provider and a short confirmation is sent to the address you gave. Submissions are not stored on this website.
• Retention. We keep form submissions for as long as the conversation you started is live. Ask us to delete them at any time and we will.

If you are a firm that subscribes to Patchlight Signals

We hold the contact details of the people at your firm we deal with, your hotlist answers, the agreement between us, payment records held by our payment provider, and a record of which reports were sent to you and how the private pages we prepare for you were used. We hold these to provide the service, to build your reports, and to keep a record of what was delivered. Our lawful basis is the performance of our contract with your firm.

Your rights

• Object at any time. You have the right to object to processing based on legitimate interests. Email us and say so. We will stop, confirm that we have stopped, and make sure you are left out of every future report.
• Access, correction, erasure and restriction. Ask and we will respond within one month.
• Complain. You can complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we have handled your data. We would appreciate the chance to deal with your concern first.