Legal
Privacy notice
Last updated: 28 October 2026
This notice explains how we collect and use personal data when you visit this website, open an account, order a service, or are named in an order as a director, secretary, shareholder, member or beneficial owner of an Irish company. It also explains your rights under the General Data Protection Regulation (GDPR) and the Data Protection Acts 1988 to 2018.
1. Who we are
Abbformation is the controller of your personal data. In this notice, "we" means the company that runs it.
2. The data we collect
| Category | Examples |
|---|---|
| Identity | Name, former names, date of birth, nationality, occupation, signature |
| Identity numbers | PPSN or Identified Person Number (IPN), needed by the CRO on Form A1 and some later forms |
| Contact | Email, phone, residential and postal address |
| Company roles | Director, secretary, shareholder and beneficial owner details, shareholdings and appointment dates |
| Due diligence | Copies of identity documents, proof of address, information about the business and source of funds, sanctions and politically exposed person (PEP) screening results |
| Order and account | Sign-in details, orders, answers you give us for a service, documents we prepare, messages and complaints |
| Payment | Payment status, billing details, and the type and last digits of your card. Stripe holds your full card details, not us |
| Post | Details of official post we receive for your company and scans of it, if you use our registered office |
| Website use | IP address, browser and device, pages visited, and cookie choices. See our cookie policy |
Most of this comes from you. We also get data from the person placing an order when they name you, from the CRO and other public registers, from Stripe about your payment, and from sanctions and PEP screening sources. If you give us data about someone else, you must have their permission and show them this notice.
Criminal offence data. Sanctions and PEP screening can reveal information about offences. We process it only to meet our duties under the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 and as the Data Protection Act 2018 allows.
3. Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Open your account, take your order and provide our services | Contract |
| Prepare and file documents with the CRO and the Register of Beneficial Ownership | Legal obligation (Companies Act 2014 and beneficial ownership regulations) and contract |
| Identify customers, directors and beneficial owners, monitor the relationship, keep records and report suspicious activity | Legal obligation (Criminal Justice (Money Laundering and Terrorist Financing) Act 2010) |
| Act as registered office, secretary or nominee director, and arrange a Section 137 bond with an insurer | Contract and legal obligation |
| Take payment, refund you and prevent payment fraud | Contract; legitimate interests (preventing fraud) |
| Send service emails, such as order updates, CRO queries and annual return and RBO reminders | Contract |
| Keep accounting and tax records | Legal obligation (tax law) |
| Handle questions and complaints | Contract; legitimate interests |
| Let staff sign in to your account to help you, with a recorded reason and a 30-minute limit | Legitimate interests (resolving your query) |
| Keep our website secure, including bot checks on forms and access logs | Legitimate interests (security); legal obligation (data security) |
| Keep a record of your cookie choices | Legal obligation (proving consent) |
| Measure how the website is used | Consent, only if you allow analytics cookies |
| Establish or defend legal claims | Legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights; ask us for details. Data collected only for anti-money laundering purposes is not used for anything else unless the law allows it.
We do not send marketing emails unless you have opted in, and every marketing email lets you opt out.
If you do not give us data we need to meet a legal duty or perform our contract, we may not be able to provide the service. We do not make decisions about you based solely on automated processing.
4. The public register
The CRO register is public. When we file for a company, details such as the company's name and registered office, and its directors' and secretary's names, addresses and other details required by the forms, generally become available to anyone, subject to any protection Irish law allows. PPSNs and IPNs are not shown publicly. Information usually remains on the register after the company is dissolved, and we cannot remove it.
The Register of Beneficial Ownership is not open to the general public; access is limited to the authorities, designated persons and people with a legitimate interest, as the law sets out.
5. Who we share your data with
- The CRO, to file documents, and the Register of Beneficial Ownership and Revenue, where you order those services;
- our anti-money laundering supervisor, when it inspects our records, and An Garda Síochána (Financial Intelligence Unit) and the Revenue Commissioners, where the law requires us to report;
- the insurer that provides a Section 137 bond, if you order one;
- Stripe, our payment provider, which is a separate controller for some payment and fraud prevention purposes;
- Amazon Web Services, which stores our documents (Amazon S3) and sends our emails (Amazon SES) from its data centres in Ireland;
- our website hosting provider, which hosts the website and database;
- Cloudflare (Turnstile) or Google (reCAPTCHA), whichever we have switched on, to tell people from bots on our forms;
- Google (Google Analytics), only if analytics is switched on and you allow it;
- professional advisers, such as lawyers, accountants and insurers, and a buyer of our business, under a duty of confidentiality.
Our service providers act on our instructions under written contracts and must keep your data secure. We do not sell your personal data.
6. International transfers
Your documents and emails stay in the EU, in AWS data centres in Ireland. Stripe, Cloudflare and Google may process some data in the United States. Where they do, we rely on the EU-US Data Privacy Framework for certified recipients, or on the European Commission's standard contractual clauses with extra safeguards where needed. If any of our operations or staff are in the United Kingdom, we rely on the European Commission's adequacy decision for the UK. Ask us for a copy of the safeguards.
7. How long we keep your data
| Data | How long |
|---|---|
| Due diligence records (identity documents, dates of birth, checks, and records of transactions) | 5 years after our relationship with you ends (the later of your last paid order and the end of the service) or the transaction is completed, as the 2010 Act requires, then deleted, unless the authorities direct us to keep them longer |
| Sensitive answers given for a service, such as dates of birth, PPSNs and identity documents uploaded with a request | PPSNs are deleted 30 days after the service is completed or cancelled. Dates of birth and identity documents are due diligence records: from then on they are kept encrypted, only authorised staff can see them, and they are deleted as the row above says. Other answers stay as the record of what we did |
| Personal details used only to make a later filing that do not go on the public register | Removed once the CRO has registered the filing and it is recorded on your company, or the filing is cancelled. A masked summary stays with your order |
| Details of the people in a company formed through us, including PPSNs or IPNs (stored encrypted) | For as long as you have an account with us and we manage the company, then up to 6 years |
| Orders, invoices, credit notes and payment records | 6 years after the end of the tax year they relate to |
| Scanned post | For the length of the registered office service, then deleted, unless we need it to resolve a dispute |
| Enquiries from people who do not become customers | 2 years after the last contact |
| Staff support access logs and security logs | For as long as we keep your account records |
| Cookie consent records | For as long as we may need to prove your choice, and no longer than 6 years |
We may keep data longer if the law requires it or for a legal claim or investigation.
8. How we protect your data
We use encrypted connections, encrypted storage of identity numbers, dates of birth and residential addresses, private document storage that is never publicly accessible, access controls, two-factor sign-in for staff and masking of sensitive details on screen. Identity numbers are never printed in full. Only staff who need your data to do their job can see it. If a breach is likely to put your rights at risk, we will tell the Data Protection Commission within 72 hours, and tell you without undue delay where the risk is high.
9. Your rights
You have the right to access your data, to have it corrected, to have it erased, to restrict or object to our use of it (including at any time to direct marketing), to data portability, and to withdraw consent at any time where we rely on consent.
Some rights are limited by law. For example, we cannot erase records we must keep under the 2010 Act, we cannot remove information from the CRO register, and the law may prevent us from telling you about an anti-money laundering report.
To use a right, contact us using the details in section 1. We may need to confirm your identity. We reply within one month, which we can extend by two further months for complex or numerous requests, telling you why. There is no charge in most cases.
10. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the Data Protection Commission at dataprotection.ie, or to the data protection authority in the EU country where you live or work.
11. Cookies
Our cookie policy explains which cookies we use and how to change your choices.
12. Children
Our services are for adults. You must be 18 or over to open an account. If an order names someone under 18, for example as a shareholder, we use their data only to provide the service and meet our legal duties.
13. Changes to this notice
We may update this notice. We will post the latest version here and change the date at the top, and tell you by email about any significant change that affects you.