Privacy Notice

Last updated: June 2026

This notice explains how Kestrel ("we", "us") collects, uses, and stores personal data when you use our service. We take your privacy seriously and only process data where we have a lawful basis to do so.

Who we are

Kestrel is a financial intelligence service that monitors the FCA Register for senior management changes at firms you choose to track. We are based in the United Kingdom. You can contact us at [email protected].

Data we collect about you

• Account data: your email address and a hashed version of your password, collected when your account is created.
• Watchlist data: the FCA-registered firms you choose to monitor.
• Usage data: basic service activity such as when you log in or access the platform.

FCA Register data we process

To deliver the service, we query and temporarily store data from the publicly available FCA Financial Services Register, including:

• Names and Individual Reference Numbers (IRNs) of regulated individuals at firms you watch
• Their regulatory roles and effective dates
• Join and departure events we detect by comparing register snapshots over time

This data originates from the FCA's public register and relates to individuals in their professional capacity as regulated persons. Our lawful basis for processing this data is legitimate interests — specifically, the legitimate interest of financial professionals in monitoring regulatory appointments and departures at firms they follow.

How we use your data

• To provide and operate the Kestrel service
• To send you alerts about FCA Register changes at firms you watch
• To maintain your account and watchlist preferences

We do not sell your data, share it with third parties for marketing purposes, or use it for automated decision-making.

How long we keep data

• Account data: retained for as long as your account is active, and deleted within 30 days of a deletion request.
• FCA Register snapshots (fca_individuals): replaced on every poll — no historical snapshots are retained.
• FCA change records (fca_changes): retained for 24 months, then deleted.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to processing based on legitimate interests

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

Security

Passwords are stored as hashed values and never in plain text. Access to our systems is restricted and we use encrypted connections (HTTPS) throughout.

Cookies

We use a single, strictly necessary cookie to maintain your login session. This cookie is set when you log in and expires when you log out or close your browser. We do not use tracking, analytics, or advertising cookies.

Because this cookie is essential to the service functioning, it does not require your consent under PECR. You can block cookies in your browser settings, but the service will not work without the session cookie.

Changes to this notice

We may update this notice from time to time. Material changes will be communicated to active users by email.

Contact

For any privacy-related questions, contact us at [email protected].