Folio publishes the public record and keeps your investigative work private. This notice sets out both sides in plain English, and meets what UK GDPR requires us to tell you.
This is the privacy notice of Folio UK ("Folio", "we"), issued under Articles 13 and 14 of the UK GDPR. It explains what personal data we process, why we are allowed to, where it comes from, how long we keep it and what you can do about it. It is maintained by the Folio team and describes current practice during public beta. It is not an independent certification or audit.
Last updated: 4 August 2026.
The controller for personal data processed through this service is Folio UK.
Privacy enquiries: michael.flanagan@foliorecord.co.uk. Full operator details are on the Contact page.
Folio processes personal data in two distinct ways, and the rules differ for each.
Every record is imported from a named publisher and links back to it. Our sources include UK Parliament (Hansard, the Members' Names Information Service, divisions, bills, committees and the registers of interests), GOV.UK departmental transparency releases, Companies House, Contracts Finder and Find a Tender, the Electoral Commission, the Charity Commission for England and Wales and OSCR, the Financial Conduct Authority register, HM Land Registry, insolvency and judgment records, and individual local authorities for planning, spending, councillors, wards and meetings.
We add no commentary, inference, scoring or accusation of our own. Where a publisher's record is incomplete or wrong, Folio reflects that rather than filling the gap.
For public record data we rely on legitimate interests (UK GDPR Art. 6(1)(f)). The interest is scrutiny of public power and public spending: making already-published official records searchable and connectable for journalists, researchers, civil society and the public. We have carried out a legitimate interests assessment. In short: the data is already public, it concerns people acting in a public or professional capacity rather than a private one, we reproduce it faithfully with provenance rather than reinterpreting it, and we do not use it for advertising, profiling, credit or employment decisions.
For account data we rely on contract (Art. 6(1)(b)) to provide the service you asked for, and legitimate interests (Art. 6(1)(f)) to keep the service secure and working.
Some public record data reveals political opinions or affiliation — how a member voted, which party received a donation, which party a councillor represents. That is special category data under Article 9.
Where we process it, we rely on Article 9(2)(e): the data has been manifestly made public by the data subject. Standing for election, taking a party whip, voting in a recorded division and making a reportable political donation are all deliberate public acts by the individual concerned, published by the relevant public body as a matter of law.
Where a claim under Art. 9(2)(e) would not hold, we rely on the special purposes (journalism) provisions in Article 85 UK GDPR and Schedule 2 Part 5 of the Data Protection Act 2018, on the basis that publication of the public record is being carried out with a view to journalistic and academic scrutiny of public affairs and is in the public interest. Where that exemption applies, some rights below are necessarily limited.
We do not process health data, genetic or biometric data, sex life or sexual orientation data, or criminal offence data about private individuals, except where it appears in a published judgment, insolvency register or regulatory decision that a public body has released.
Folio does not make automated decisions producing legal or similarly significant effects about anyone, and it does not profile individuals. Linking between records is deterministic: two records are joined only where an official identifier matches — a Companies House number, a Parliament member ID, a charity number, an Electoral Commission reference. Similar names, fuzzy matching and statistical similarity never create a link on their own.
We do not sell personal data and we do not share it with advertisers or data brokers. We use processors to run the service: a cloud database, authentication and hosting provider, and, if you contact us, an email provider. They act on our instructions under written terms.
Public record data is, by definition, publicly visible on this site — that is the purpose of the service. Your account data and your investigation content are not public unless you deliberately share them.
Our infrastructure providers may process data outside the UK. Where that happens we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses. If you want the current list of processors and their locations, ask us at michael.flanagan@foliorecord.co.uk.
Public record data is retained for as long as the publisher continues to publish it and it remains relevant to the historical public record. Where a publisher withdraws or supersedes a record, our re-import reflects that.
Account data is retained while your account is open, and for a short period afterwards to handle disputes and meet legal obligations. Delete an investigation and it is removed from your workspace. Ask us to close your account and we will delete it and its workspace data.
Server and security logs are kept for a limited period for operational and security purposes.
Under UK GDPR you have the right to be informed; of access; to rectification; to erasure; to restrict processing; to data portability; and to object to processing based on legitimate interests, including an absolute right to object to direct marketing. You can exercise any of these at michael.flanagan@foliorecord.co.uk and we will respond within one month.
Two honest limits. First, where the special purposes (journalism) exemption applies to material held for publication, some of these rights are restricted by law — we will tell you if we rely on that and why. Second, the authoritative fix for a wrong public record is with the publisher: we re-import from them, so a correction at source flows through to Folio. Where Folio itself has misrepresented a record, we will correct it.
Folio sets only cookies and local storage that are strictly necessary: keeping you signed in and remembering interface preferences such as theme. Under PECR, strictly necessary storage does not require consent, which is why you see no cookie banner. We run no advertising trackers and we do not sell data. If we later add non-essential analytics, we will ask for your consent first and update this notice.
Account-scoped data is protected in the database with row-level security, so a signed-in user can read and write only their own rows. Administrative operations run server-side behind a secret and are never exposed to the browser. Traffic is served over TLS.
If you believe you have found a security issue, report it privately to michael.flanagan@foliorecord.co.uk before disclosing it publicly, and give us a reasonable window to fix it.
If you are unhappy with how we have handled your personal data, tell us at michael.flanagan@foliorecord.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, without contacting us first.
We will update this page when our processing changes and revise the date at the top. During public beta, expect it to change as features land.