Privacy policy

Who is responsible

Data Torturing Solutions Ltd (DTS) operates OSIC and is the data controller for everything described on this page. Questions, objections and removal requests all go to abuse@datatorturingsolutions.co.uk; we reply within one month. If you'd rather write on paper, email us and we'll give you a postal address.

What this dataset actually is

Almost everything on this site is not personal data. A FTSE 100 constituent is a legal person, and facts about its domains, subdomains, hosting provider, DNS configuration, TLS certificates and public GitHub repositories don't identify any living individual — they describe infrastructure a public company has chosen to expose to the public internet. That's the one exception below aside, the whole corpus sits outside data protection law rather than relying on an exemption within it.

The one thing here that is personal data

Companies House's public register of Persons with Significant Control (PSC) — major shareholders and those with board-level control — names living individuals: name, nationality, month and year of birth (never the day, the same limit Companies House's own public data observes), and the nature of their control. We load this from Companies House's own free bulk data products, unchanged. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): the same public transparency purpose the register itself exists for. We don't extract names from anywhere else — page text from a crawled site is never parsed for names, and GitHub commit or contributor data is never collected, only organisation- and repository-level facts.

How the rest is collected

Every fact here comes from a source the company itself made public, read the way any browser, mail server or DNS resolver already would: Certificate Transparency logs (public by design, since every certificate authority is required to log issuance), a same-origin, robots.txt-respecting crawl of each company's own site reading only titles and link structure, DNS records (MX, SPF, DMARC, nameservers), RDAP domain registration data, and a routing-registry lookup for hosting attribution. Subdomains discovered this way are also checked directly — a single request to see whether the address resolves and what, if anything, answers — the same exchange a browser makes when a link is clicked, not a scan for weaknesses. See how the passive method works and the full legitimate interests and data protection impact assessment for this corpus.

What this doesn't do

No port scanning, no vulnerability probing, no fetching anything behind authentication. No aggregating personal data beyond what the PSC register already discloses, and no cross-referencing it against anything else. We don't sell this data as leads, market anything to anyone named on this site, or make automated decisions about any person or company. If that ever changes, this page changes first.

Cookies and tracking

None. This site sets no cookies, runs no analytics, and loads nothing from a third-party domain. The light/dark theme choice is written to your browser's local storage only, never transmitted anywhere — we have no way to see which theme you use.

Your rights

If you're named in the PSC data described above, you can:

Object

Ask us to stop processing your data. Because we rely on legitimate interests, we have to honour this unless we can show compelling grounds that override it.

Access

Ask for a copy of what we hold about you.

Rectify

Ask us to correct an error. If the error is in Companies House's own published register, it needs correcting at source too — we'll tell you if that's the case.

Erase

Ask us to remove your record. Where we agree, we add it to the platform's suppression list so it doesn't reappear on the next data refresh.

Restrict

Ask us to pause processing while a dispute is looked into.

Complain

Take it to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or 0303 123 1113 — without needing to come to us first.

A different corpus, a different page

OSIC separately holds notices published in The Gazette (deceased estates / probate notices), which is a different product surface with its own controller notice at osic.datatorturingsolutions.co.uk/privacy/public-notices. The two corpora are never joined, and this page does not cover that one.

Changes

If we start collecting a new category of personal data or use this dataset for a new purpose, this page is updated before we do it, and we review it at least once a year.