How licensing your company's records works

This is our standard process. Every company is different, and your signed agreement with us sets out exactly what happens for yours.

You ask. Get a free estimate or email us. You tell us which systems you use, how many years of records you hold and roughly how many staff you have. You don't send us any records.
We run checks. Before anything is signed, we check that the person signing can sign for the company (a director, or the insolvency practitioner for a company in insolvency). We also look for insolvency notices in the Gazette, and screen the company against the UK, US, EU and UN sanctions lists.
We agree terms in writing. We act for your company under a signed agreement. Our fee is 12% of what you receive (8% above £1m; £2,500 minimum on deals of £20,000 or more), and nothing unless a deal closes. How and when it's paid is set out in our agreement. See pricing →
We map what's in and what stays out. Together we list your systems and the years to include, and agree what always stays out. That includes:
- special category and criminal-offence data;
- children's data;
- HR, payroll, disciplinary, trade union and grievance material;
- legally privileged material;
- anything confidential to your customers;
- private messages;
- work your company doesn't own.
Your team cleans the data, in your systems. Your IT team, or a specialist you appoint, runs our cleaning method inside your own systems.
- Names, email addresses and other personal details are replaced with consistent codes, so the records still make sense.
- The key that links codes to people stays with you.
- We guide the work; your records don't come to us.
The output is tested and recorded. A sample of the cleaned copy is checked for anything that could identify someone, using the ICO's "motivated intruder" approach, and anything that fails goes back a step. You keep a written record: a data protection impact assessment and a record of the cleaning. Because a key exists, the cleaned copy is usually still personal data, and the licence protects it as personal data.
Buyers compete. With your permission for each one, we show an unnamed profile of your records to buyers we've vetted, after each signs a confidentiality agreement. If a buyer wants to evaluate a cleaned sample, the sample goes from you straight to that buyer, under written terms that ban training on it and require it to be deleted afterwards. You see every offer side by side.
You choose, and your company signs the licence. You choose the buyer and approve every term. We negotiate for you; the licence is between your company and the buyer. These are the terms we push for:
- non-exclusive by default;
- a set period;
- a ban on resale and re-identification;
- deletion at the end.
The cleaned copy goes straight to the buyer. It's sent from your systems to the buyer by encrypted transfer. Your original records stay where they are.
The licence sets the price and when it's paid. Our fee is set out in our agreement, and only applies if a deal closes.
At the end of the licence. The buyer deletes the data and gives you a signed deletion certificate. Before you sign, you'll have chosen what happens to any models trained on it.

Closing or insolvent company? The same steps apply, with the insolvency practitioner signing for the company. Insolvency practitioners →

Words on this page are explained below.

Key terms explained

Some of these words have precise legal meanings. Here's what we mean by them.

Personal data: Information about a living person who can be identified from it, directly or indirectly, including by combining it with other information.
Pseudonymised data: Data where names and other identifiers are replaced with codes, but a key or other information could link them back. Pseudonymised data is still personal data.
Anonymous data: Data from which nobody can reasonably be identified, taking account of all the means reasonably likely to be used. Data protection law doesn't apply to truly anonymous data. It's a high bar for free text such as email and chat, so we don't describe the data we help license as anonymous.
De-identified: The word we use for the cleaning in step 5: personal details removed or replaced, then tested. De-identified data is usually still personal data, and the licence treats it that way.
Motivated intruder test: A test from ICO guidance: could a reasonably competent person with no inside knowledge, using public sources such as the internet, identify someone from the data?
Data protection impact assessment (DPIA): A written assessment of the risks to people before processing that's likely to be high risk, and of how those risks are reduced.
Controller and processor: The controller decides why and how personal data is used; a processor acts on its instructions. Your company is the controller of its own records.
Lawful basis: The legal reason for using personal data. For cleaning and licensing records it's usually legitimate interests, supported by a written balancing test.
Transfer safeguards: If personal data goes to a buyer outside the UK, the law requires a safeguard, such as the UK–US data bridge (for certified US organisations) or an international data transfer agreement.
Licence: Permission to use data for agreed purposes, for an agreed period. Your company keeps ownership: nothing is sold outright.
Non-exclusive: Your company can license the same data to other buyers too.
Confidentiality agreement (NDA): A contract in which a buyer agrees to keep what it's shown confidential and to use it only to decide whether to make an offer.
Warranty: A promise in a contract that something is true, for example that your company has the right to license the data.
Indemnity: A promise to cover the other side's losses if something specific goes wrong. The terms we push for include an indemnity from the buyer if it misuses the data, and no uncapped indemnity from you.
Chain of title: Evidence that your company owns, or may license, what it licenses. Work by employees usually belongs to the employer; work by contractors usually only if it was assigned in writing.
Office-holder: The insolvency practitioner appointed to a company in insolvency, who signs for the company.
Deletion certificate: The buyer's signed confirmation that it has deleted the data at the end of the licence.