Privacy Policy

Data Controller: We Form Online Ltd (Company Registration No. 10852152, ICO Registration No. ZB162162).

Governing laws: UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, and EU General Data Protection Regulation (EU GDPR).

Data protection contact: info@weformonline.com or by post to: Data Protection Manager, We Form Online Ltd, Kings Court, London Road, Stevenage, United Kingdom, SG1 2NG.

We Form Online Ltd (“We Form Online”, “our”, “us”, “we”) has ownership of this website and its various functions, and trades as We Form Online. For the necessary grounds of the Data Protection Act 2018 and UK GDPR, the information controller is We Form Online Ltd.

At We Form Online, we strongly value your confidentiality. In order to safeguard your privacy and explain how your personal information is used, our comprehensive Privacy Policy sets out the various parameters of how we gather, save, utilise, hand over, and reveal your information when you use WeFormOnline.com (the “Website” or “Site”). Please read this Privacy Policy carefully to understand your rights.

1. We do not knowingly collect information that relates to children and our website is only intended for 18 and above years old visitors.
2. This Privacy Policy complements the other notices (including our Terms and Conditions) and was not created to supersede them.
3. We are the information controller and accountable for your personal information.
4. We Form Online has appointed a Data Protection Manager (DPM). If you have any queries about this Privacy Policy, or any wishes to exercise your information protection rights, please contact our DPM in writing by email to info@weformonline.com or by post to the registered office address above.
5. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO) at www.ico.org.uk. We would, however, like the opportunity to deal with your concerns before you contact the ICO so we encourage you to contact us first and we will look to resolve the matter. If you live in the EU or EEA, you can also complain to the data protection authority in your country.
6. Our website may have links to third-party websites, plug-ins and apps. By connecting or clicking on these links please be aware that you may be allowing third parties to share or gather your personal information. We do not have any control over these third-party websites, plugins or apps and we will not be held responsible for their privacy policies. Please make sure to read their privacy policies to recognise what personal information they collect about you and the way in which this information is used.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

1. Identity Data: includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth, gender, nationality, passport copy, national identity card copy, proof of identity photo, and ultimate beneficial ownership declarations.
2. Contact Data: includes billing address, residential address, business address, email address and telephone numbers.
3. Financial Data: includes payment card details (processed via secure PCI-compliant gateways) and bank account details.
4. Transaction Data: includes details about payments to and from you and other details of products and services you have purchased from us.
5. Technical Data: includes internet protocol (IP) address, your login data, browser and operating system, device type, approximate location (city level) and network provider.
6. Profile Data: includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
7. Usage Data: includes information about how you use our website, products and services.
8. Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.
9. Biometric Data: the selfie and face scan our identity verification partner Didit takes to check that you are present (liveness) and that you match the photo in your ID document. We keep the images and the result with your verification record.
10. Screening Data: the results of checking you against sanctions and politically exposed persons (PEP) lists, and your own declaration of whether you are a PEP. A sanctions or watchlist match can reveal information about criminal offences.

We also collect, use, and share aggregated information. However, if we combine aggregated information with your personal information so that it can directly or indirectly identify you, we treat this as your personal information. We collect, store, and analyse customer's information, transaction data, and other relevant data to identify potential risks. The purpose of this processing is to prevent Money Laundering, Terrorism Financing and Proliferation Financing in accordance with relevant UK rules and regulations.

We gather personal information via the following methods:

1. Direct Communications: You may provide personal information when you complete online orders, apply for products or services, subscribe to our services, create a user account, or contact us by letter, telephone or email.
2. Automated Technologies: When you browse or interact with this website, cookies that the site needs to work are always used, and our server keeps a record of each time you arrive unless you chose Reject all (in some places only an anonymous one until you accept, see Visit statistics below). We also record your visits with cookies and related technologies: your IP address, approximate location, device and browser, how you reached our website, the pages you view and session replays of your visits, and we link them to your account or enquiry. In Switzerland, Mexico and most US states this runs from your first arrival until you choose Reject all; everywhere else, only after you accept (see Visit statistics and Analytics in our Cookie Policy).
3. Publicly Available Information: We may collect personal information from public registers such as Companies House and the company registry of the jurisdiction you choose, and from sanctions and politically exposed persons (PEP) lists.
4. Third Parties: We receive personal information from our identity verification and screening provider (Didit), our payment provider (Stripe), the advertising networks you reach us through (Google, Microsoft and Reddit, with your consent), and our partner agents, registries and Financial Partners about the progress of your order.

We use your personal data only for the purposes below, each with its lawful basis under the UK GDPR and the EU GDPR:

1. Forming and running your company: filing with registries, working with partner agents, introductions to banks and payment partners, taking payment and keeping your account. Basis: performing our contract with you (Article 6(1)(b)).
2. Checks the law requires: verifying your identity, the source of funds and wealth, screening against sanctions and PEP lists, and keeping these records. Basis: our legal obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the law of the jurisdiction you choose (Article 6(1)(c)).
3. Security, fraud and service messages: keeping our systems and your account secure, preventing fraud, handling payment disputes, and emails about your order and account. Basis: our legitimate interests in running a safe and reliable service (Article 6(1)(f)).
4. How you found us: when you send an enquiry, create an account or start an order, we keep with it how you reached our website: the campaign tags in the link, the page you arrived on, the website that sent you (the site, not the page), and which kind of ad you clicked (not the click identifier). Basis: our legitimate interest in knowing which of our marketing brings customers (Article 6(1)(f)). If you are in one of the places listed under Visit statistics below and have not accepted analytics, we keep only what you typed with an enquiry or order. When you create an account and your browser did not send this, we take it from our server's record of your arrival that day (see Visit statistics in our Cookie Policy), unless you chose Reject all or you are in one of those places. It is kept as long as the enquiry, account or order.
5. Visit statistics: counting visits to our website, and a record of each time you arrive on it from outside: your IP address, approximate location and network provider, device, browser and operating system, the page you arrived on, the website that sent you (the site, not the page), any campaign tags in the link and which kind of ad you clicked (not the click identifier). Basis: our legitimate interest in knowing how the website is used and who our marketing brings to it (Article 6(1)(f)). In the European Economic Area (EU outermost regions included), the UK, Jersey, Guernsey, the Isle of Man and Gibraltar, Quebec (and Canada when we cannot tell the province), Brazil, Turkey, the United Arab Emirates, Colombia, Peru, Argentina and Chile, and wherever we cannot tell where you are, this record is anonymous until you accept analytics: it keeps your country, but not your IP address, city or network provider (only whether it is a data centre), and no code that links one arrival to another. While analytics run (see below), we link this record to your account or enquiry. You can object, free of charge, at any time (see section 10 and our Cookie Policy).
6. Analytics and session replays: the visitor identifier, the pages you view and replays of your visits, linked to your account or enquiry. Basis: our legitimate interest in knowing how the website is used, fixing problems and helping you with your enquiry or order (Article 6(1)(f)). You can object, free of charge, at any time: choose Reject all and we stop recording from then on (see section 10 and our Cookie Policy). Outside Switzerland, Mexico and most US states, these run only with your consent (Article 6(1)(a)); see section 1 of our Cookie Policy.
7. Advertising measurement: the Google, Microsoft and Reddit advertising tags. Basis: your consent (Article 6(1)(a), and regulation 6 of the Privacy and Electronic Communications Regulations 2003 for the cookies). You can withdraw it at any time in Cookie settings.
8. Biometric and screening data: the face scan is special category data, and a sanctions match can be criminal offence data. We use them only to verify who you are and to prevent money laundering, terrorist financing and fraud, for reasons of substantial public interest (Article 9(2)(g) and Article 10, with the conditions in Schedule 1 to the Data Protection Act 2018 on preventing or detecting unlawful acts and on regulatory requirements).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our identity verification partner checks your ID and face scan automatically and may ask you to try again, but whether we accept or decline your order is always decided by a member of our team.

To deliver international company formation and corporate services, We Form Online must share and transfer relevant personal and corporate data to vetted third parties:

1. Local Partner Agents and Registered Office Providers: For incorporations outside our direct office locations, identity and UBO data are transferred to local partner agents, registered office providers, and corporate service agents in the target jurisdiction (the UK, Delaware and other US states, the UAE, Estonia, Bulgaria, St. Lucia, the Marshall Islands, Seychelles, Hong Kong and Costa Rica) solely to execute statutory filings.
2. Banking, Financial Institution and Payment Partners: When you request a business account introduction, payment gateway solution, or corporate card setup, you authorize We Form Online to forward your identity, proof of address, and corporate profile to independent licensed partner banks, EMIs, and payment institutions (“Financial Partners”) for pre-approval and account opening.
3. Official Government Registries: Data is submitted directly to official corporate registries (such as Companies House, Inland Revenue, and state registry offices) as mandated by corporate law.
4. Independent Professional CPAs: Where bookkeeping or tax preparation services are ordered, data is shared with independent licensed CPA partners acting on your behalf.

We also use service providers that process data for us under contract and only on our instructions:

1. Hetzner Online (Germany): hosts our website, database and backups.
2. Scaleway (France): keeps encrypted copies of our backups.
3. Cloudflare (United States): delivers our website securely, tells us which country a visit comes from and runs the captcha on our contact form.
4. Stripe (United States and Ireland): takes card payments.
5. Resend (United States): sends our emails.
6. Didit (Spain): identity verification, the liveness and face match check, and sanctions and PEP screening. Your data is stored in Ireland.
7. Google (United States): address suggestions and checks in our forms (Google Maps Platform), and Google Ads if you accept marketing cookies.
8. Microsoft (United States): Microsoft Advertising, if you accept marketing cookies.
9. Reddit (United States): Reddit Ads, if you accept marketing cookies.
10. OpenAI and Anthropic (United States): write the replies of the assistant on our website and of Co-Pilot in your dashboard, and power the tools our staff use to search our records and draft replies.

Our staff get alerts in Telegram (British Virgin Islands) about new applications, payments, enquiries assigned to them, documents you upload and emails you send us. An alert can include your name, email address, company name, the country you asked about, how you found us, your application or invoice reference, the amount you paid and the invoice description, the name of a document, the subject of your email and notes our staff write about your case.

We find the approximate location of an IP address in a database on our own servers (MaxMind GeoLite2); the address is not sent to MaxMind.

Messages you type into the assistant on our website are sent to an AI service provider (OpenAI or Anthropic) to write the reply. We do not keep the chat on our servers; your browser keeps it until you close the tab and does not restore it after 2 hours without a message. Please do not share passport numbers or other sensitive details in the chat.

In your dashboard, Co-Pilot conversations, your ratings and the business profile you give it (goals, markets, banking needs, budget) are stored with your account so the assistant can help you, are sent to OpenAI or Anthropic to write replies, and may be read by our staff to improve answers. We delete them 12 months after your last message or when you close your account.

When sharing your data with Partner Agents, registries, Financial Partners or the service providers we work with under contract (section 6) located outside the UK or EEA, we ensure your data is protected by ensuring at least one of the following safety mechanisms is in place:

1. Transfers to countries deemed to provide an adequate level of protection for personal data by competent authorities.
2. Specific contracts approved by competent regulators which give personal data the same protection it has in the UK or EEA.
3. Where transfer is strictly necessary for the performance of a contract between you and We Form Online to execute your international incorporation order.

Our service providers Google, Microsoft, Reddit, OpenAI, Anthropic, Stripe, Resend and Cloudflare may process data in the United States. We rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.

Transfers to partner agents, registered office providers and registries in the country where you form your company, and to the Financial Partners you ask us to introduce you to, are necessary to perform our contract with you (Article 49(1)(b)). Without them we cannot form your company or make the introduction.

We Form Online is dedicated to protecting and securing your personal data. We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. We Form Online personnel, agents, contractors and other third parties will only be allowed access to your personal information if they require access in order to perform their core business function, and they are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We Form Online will only store your personal information for as long as necessary to fulfil the purposes we collected it for, including fulfilling our legal, accounting, tax or reporting requirements. In particular:

1. Identity verification and screening records: five (5) years after our business relationship ends, as the Money Laundering Regulations require (seven (7) years for Seychelles companies).
2. Accounting and transaction records (including contact, financial and transaction information): six (6) years after our business relationship ends, as tax law requires.
3. Visit records (each arrival our server records and, while analytics run, the pages viewed and events): 13 months. The IP address stored with them: 90 days after we collect it.
4. Session replays: 30 days. A replay we mark to look into a problem is kept up to 20 more days, never more than 50 days after the visit.
5. Visitor identifier: up to one year in your browser. Our record of a visitor not seen for 13 months is deleted, unless it is linked to an enquiry or order.
6. Records of your cookie choices: 12 months.
7. Enquiries (your name, contact details, message and how you found us): kept until you ask us to delete them.
8. Co-Pilot conversations and business profile: 12 months after your last message, or until you close your account.
9. Visit totals: kept, as they do not relate to any person.

Under data protection laws, you have rights in relation to your personal data:

• Request Access to your personal data (Data Subject Access Request).
• Request Correction of the personal data that we hold about you.
• Request Erasure of your personal data, subject to legal retention duties.
• Object to Processing of your personal data where we rely on legitimate interests, such as keeping how you found us. We then stop, unless we have compelling legitimate grounds that override your interests or need the data for legal claims.
• Request Restriction of processing of your personal data.
• Request Transfer of your personal data (Data Portability).
• Right to Withdraw Consent where processing is based on consent.

Your right to object to direct marketing: you can object to direct marketing at any time and we will stop. Use the unsubscribe link in any marketing email or write to info@weformonline.com.

Your right to object to Visit statistics, analytics and session replays: choose Reject all in Cookie settings (the button at the bottom left of every page of our website, or the item in your dashboard menu). We then stop counting and recording your visits from then on. What we recorded before is kept and deleted as described in our Cookie Policy.

Switzerland: your right to object is Reject all. Mexico: we use tracking technologies from your arrival, and Reject all disables them.

California residents: under the CCPA you have the right to know, delete and correct the personal information we hold about you and to opt out of its sale or sharing. WeForm does not sell personal information. To opt out of sharing for advertising, choose Reject all or turn Marketing off in Cookie settings.

If your browser sends a Global Privacy Control signal from the United States, we treat it as your request to opt out of sale and sharing: while your browser sends it, our advertising tags do not load, our server tells no advertising platform about your visit and we do not keep the ad click identifier, whatever you chose in Cookie settings.

If you wish to exercise any of these rights, please contact our DPM at info@weformonline.com.