Privacy Policy

Who we are

Handshakr is operated by Cardiff Giant Ventures Limited, a company registered in England and Wales with company number 12322092, which is the data controller for the personal data described here. Our address is at the foot of this page.

Company records built from public sources

This is the most important thing to understand about how Handshakr holds data, so it comes first rather than last.

Most company records on Handshakr were not created by the company they describe. They are built from public sources, including Companies House, public code and package registries, and public company directories. We do this to build a directory that is useful before anyone has signed up to it.

Most of that information is about companies rather than about people, and information about a company is not personal data. Some of it can relate to an identifiable person, for example where a company is a sole trader, where a registered company name contains a person's name, or where a public code repository identifies its author. Where that is the case, our lawful basis is legitimate interests: operating a business directory that companies can find themselves in, correct and control. We have considered the effect on the people concerned. In October 2026 we removed every record sourced from public code and package registries, around 1,200 of them, because those were the records most likely to describe a person's work rather than a company, and because a repository is not a business anyone can buy from. The directory now holds businesses only. Every remaining unclaimed record is labelled as unclaimed, can be corrected or removed on request, and from the moment a company claims its listing it controls whether that listing is readable by buying agents at all.

If a record relates to you or your company, you can, without holding an account:

• Ask us to correct it

• Ask us to remove it

• Ask us what we hold and where it came from

Email hello@handshakr.com. Every record carries the source it was ingested from, so we can tell you where a given field came from.

Information you give us

• Account information: email address, display name, and the organisation you belong to

• Company and profile content you choose to publish

• Claims you make, and the evidence you attach to them

• Messages and enquiries exchanged inside an engagement

• Communication preferences

Information we collect automatically

• How you use the platform: pages viewed, searches run, features used

• Reads of a public company profile, including reads made by software, recorded in an audit log

• Technical information such as IP address and browser user agent, used for security and rate limiting

How we use it

• To operate the platform and the directory

• To produce shortlists against a buyer's stated requirements

• To verify a claim where you have asked us to

• To support you, and to tell you about your account

• To detect and prevent fraud and abuse

• To meet our legal obligations

We do not use your content to make decisions about you by automated means that produce legal or similarly significant effects.

What is public, and what is not

• Published company profiles, their published products and their public claims are public, and are readable by anyone, including software

• Evidence documents are never published. They are stored privately and released only inside an engagement the supplier has accepted

• A buyer's requirements are private to that buyer and their organisation. A supplier cannot see what a buyer is looking for, or that they looked, unless the buyer opens an engagement

• Messages inside an engagement are visible only to the parties to it

Sharing

We do not sell personal data.

We share data with service providers who help us operate: hosting and database infrastructure, email delivery, and payment processing. They act on our instructions. We do not store or process payment card details ourselves.

We share data where we are required to by law, and where necessary to establish or defend legal claims or to prevent fraud.

Where data is held

Our database and application infrastructure are hosted in the European Union. Where a service provider processes data outside the UK or EEA, we rely on appropriate safeguards, including the UK International Data Transfer Addendum or Standard Contractual Clauses.

How long we keep it

• Account data: while your account is open, and for up to twelve months after it closes

• Company profile content: while published. On account closure you may ask for a claimed profile to be unclaimed and reverted to a directory listing rather than deleted

• Audit logs: retained, and not editable or deletable, because an audit log that can be altered is not an audit log. They record the action, not the content

• Withdrawn claims: retained in the supplier's own history, because a buyer who relied on a claim is entitled to see that it was withdrawn

Security

Access is enforced independently at the database, the API and the client, so that a single failure in one does not expose data protected by another. Row-level security is on by default and denies access where no policy allows it. Passwords and API tokens are stored hashed. We run automated security checks on every database change. There is more detail at handshakr.com/security.

Your rights

Under UK and EU data protection law you have the right to access your personal data, to have inaccuracies corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it.

To exercise any of these, email hello@handshakr.com. We respond within thirty days. You do not need a Handshakr account to make a request about a record that describes you.

If you are not satisfied with our response, you may complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use cookies for authentication, security and analytics. See our Cookie Policy.

Changes

We may update this policy. Where a change materially affects your rights, we will give notice before it takes effect. The date at the foot of this page is the date of the current version.

Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@handshakr.com.

Company Information:

Cardiff Giant Ventures Limited

Registered in England and Wales, company number 12322092

Unit 12 Green Park

Coed Cae Lane Industrial Estate

Pontyclun

CF72 9GP

Last updated: October 2026