Public Records Notice

This service is operated by Stonewake, Inhaber: Luca Diaz Hilterscheid, Märkische Heide 5, 14532 Kleinmachnow, Deutschland ("we"), and is research software for banks. Part of what it does is mirror official company registers and official gazettes: the public record of companies, who directs them, who owns them, and what official publications say about them. It also holds the official sanctions lists named below and compares the people the registers name with the people on those lists, so that a bank can review a possible match.

Public registers publish a limited set of personal data about people acting in a business capacity. Because we collect this data from the registers and not from the people it concerns, Art. 14 GDPR obliges us to inform those people. Informing every named person individually would be impossible and disproportionate for register-scale data (Art. 14(5)(b) GDPR); this permanently published notice is the compensating measure the law provides for. It states, specifically and completely: what we process, from which named sources, why, for how long, who receives it, and your rights.

We do not build consumer profiles. We do not score, rate, or rank any person's creditworthiness, reliability or risk. Our software shows banks what the public register itself states, with a citation to the register entry for every fact.

Stonewake, Inhaber: Luca Diaz Hilterscheid, Märkische Heide 5, 14532 Kleinmachnow, Deutschland.
Privacy contact: contact@stonewake.ai.

For this processing, the register-publicity graph, we are the controller. Where a bank separately instructs research on a named person (its own customer due diligence), that bank is the controller and we act as its processor; see our Privacy Policy, section 5.

We process only what the source register or gazette itself publishes:

• The name of the person as stated in the register
• The register role, verbatim (for example "Geschäftsführer", "director", "person with significant control")
• The company the role relates to, and the dates the register states
• For UK beneficial-owner entries (persons with significant control and the Register of Overseas Entities): the partial date of birth (month and year) that Companies House itself publishes, used solely to tell people with the same name apart
• For Norwegian shareholder entries: the birth year and the postal code and place that the Skatteetaten shareholder register itself publishes, used solely to tell people with the same name apart
• For Estonian entries: the date of birth and, for beneficial owners, the country of residence that the register's open-data files themselves publish, and the register's own hashed personal code (the personal code itself is never published and never held), used solely to tell people with the same name apart
• For Latvian beneficial-owner entries: the partial date of birth (month and year), the nationality, and the masked personal code exactly as the register publishes them, used solely to tell people with the same name apart; the masked code is never unmasked and never converted into a date
• For Slovak entries: the date of birth, the nationality, the address, and the register's own statement whether the beneficial owner is a public official, exactly as the register publishes them inside the cited register record; the address is never used to identify or match a person
• Beneficial-ownership facts as the register states them: in the register's own control bands where the register states bands, or as the register's own share counts and the percentage they arithmetically state, never as invented figures
• Insolvency and enforcement publications naming a person in a commercial capacity, only while the source itself publishes them
• For people on the official sanctions lists named below: the names and aliases, the list's reference, the date of listing and the sanctions programmes the list states. The date of birth and the nationality a list states are used only to rule out a namesake and are never shown. We hold the whole entry a list publishes on a listed person, which can include identity documents, addresses, contact lines and the stated reasons. Of it, banks are shown only the names and aliases, the list's reference, the date of listing, the sanctions programmes and the link to the official entry
• For organisations, vessels and aircraft on those lists: every field the list publishes on the entry, verbatim, which can name a person, for example in a statement of reasons, as an owner or in a contact line

We never collect addresses or dates of birth beyond what the register itself publishes, or any data from credit agencies or data brokers, and from social networks only the posts that name a person a bank watches. Register entries under a register's own protection regime (for example UK "super-secure" persons) are skipped entirely, never reconstructed.

Data protection authorities rightly reject blanket references to "public sources". These are the registers and gazettes our software processes today:

• Äriregister (avaandmed.ariregister.rik.ee): the open-data files of the Estonian e-Business Register, the shareholder file (osanikud, direct shareholders of record) and the beneficial-owner file (tegelikud kasusaajad), published daily by the Estonian Centre of Registers and Information Systems (RIK)
• BORME (boe.es): the Boletín Oficial del Registro Mercantil, the official gazette of the Spanish commercial register, via the open-data channel of the Agencia Estatal Boletín Oficial del Estado; sole-shareholder declarations (declaración de unipersonalidad) naming a natural person as sole shareholder
• Bundesnetzagentur (bundesnetzagentur.de): the Federal Network Agency's published award lists of the auctions under the Renewable Energy Sources Act (EEG), with the bidder of each award by name, among them sole traders and other natural persons, the award, its capacity and the municipality and postcode it names
• Bundesnetzagentur Kraftwerksliste (bundesnetzagentur.de): the German Federal Network Agency's list of power plants in Germany, with the operator of each plant as the agency publishes it; an operator whose name does not end in a statutory legal form (a farm or a sole trader, for example) may be a natural person, and such a row is held apart from every company record
• Companies House (find-and-update.company-information.service.gov.uk): the UK company register, including officer appointments, the register of persons with significant control (PSC), and filed accounts
• EU State aid Transparency Award Module, Kohesio and Financial Transparency System (webgate.ec.europa.eu, cohesiondata.ec.europa.eu, ec.europa.eu): the individual State aid awards German authorities granted, the beneficiaries of EU cohesion policy projects and the recipients of EU budget funds, as the European Commission publishes them; natural persons and sole traders who received an award appear there by name and are kept apart from every company record
• GLEIF (gleif.org): the Global Legal Entity Identifier Foundation's public LEI data, including entity relationship records
• Handelsregister (handelsregister.de): the German commercial register, via on-demand register extracts
• Insolvenzbekanntmachungen (insolvenzbekanntmachungen.de): the German official insolvency publications portal
• Investor Relations (the issuers' own websites), the investor relations pages of companies in the DAX, MDAX and SDAX indices, read for the notices capital markets law requires (Articles 17 and 19 of Regulation (EU) No 596/2014 and sections 33 and 40 of the German Securities Trading Act); of the managers and natural persons holding voting rights those notices name, we keep the name and role only, apart from the company's record
• Latvijas Republikas Uzņēmumu reģistrs (ur.gov.lv, via data.gov.lv): the Latvian Register of Enterprises' statutory beneficial-owner data (patiesie labuma guvēji), the register's own daily open-data file
• Oficiul Național al Registrului Comerțului (onrc.ro, via data.gov.ro), the open-data company files of the Romanian National Trade Register Office, with the legal representatives of companies by name and role only; the dates and places of birth in those files are never read
• Register of Overseas Entities (find-and-update.company-information.service.gov.uk): the UK register of overseas entities holding UK property, via a frozen 2025 snapshot of the Open Ownership BODS UK dataset (bods-data.openownership.org), used only for beneficial-owner relationships the register has since ended; current entries come from Companies House directly
• Register partnerov verejného sektora (rpvs.gov.sk): the Slovak register of public-sector partners kept by the Ministry of Justice of the Slovak Republic, with its gatekeeper-verified beneficial owners (konečný užívateľ výhod); it covers only entities contracting with the Slovak public sector
• Skatteetaten Aksjonærregisteret (skatteetaten.no): the Norwegian Tax Administration's shareholder register, yearly extracts of company shareholder books provided on request under Norway's freedom of information regime
• Swiss Official Gazette of Commerce (SOGC) (shab.ch), the official Swiss gazette for commercial register entries, bankruptcies and other company notices, published by the State Secretariat for Economic Affairs (SECO)
• thru.de (thru.de): the German Environment Agency's (Umweltbundesamt) Pollutant Release and Transfer Register (PRTR) and its list of installations under the Industrial Emissions Directive (IED), with the operator of each facility as the agency publishes it; an operator whose name does not end in a statutory legal form may be a natural person, and such a row is held apart from every company record

The official sanctions lists we hold and compare:

• EU Financial Sanctions Files (webgate.ec.europa.eu): the consolidated list of persons, groups and entities subject to EU financial sanctions, published by the European Commission
• UK Sanctions List (sanctionslist.fcdo.gov.uk): the list of designations under UK sanctions regulations, published by the Foreign, Commonwealth and Development Office
• OFAC Specially Designated Nationals and Blocked Persons List and the OFAC Consolidated Sanctions List (sanctionslistservice.ofac.treas.gov): the two lists of the Office of Foreign Assets Control of the US Department of the Treasury
• Swiss sanctions list (sesam.search.admin.ch): the list of persons, companies and organisations subject to Swiss sanctions measures, published by the State Secretariat for Economic Affairs (SECO)
• UN Security Council Consolidated List (scsanctions.un.org): the list of all individuals and entities subject to measures imposed by the United Nations Security Council, published by the United Nations

When a new source goes live in the product, this notice is updated to name it before its data is displayed to customers.

Legal basis: Art. 6(1)(f) GDPR, legitimate interest. The interests pursued:

• Register publicity is the point of these registers. Commercial registers and official gazettes publish these facts by statutory mandate precisely so that third parties can rely on them; legal certainty and the transparency of commerce depend on that publicity. The Court of Justice of the EU confirmed this function of company-register person data in C-398/15 (Manni).
• Banks are legally required to know who they deal with. Regulated banks must identify who directs and who beneficially owns their counterparties (customer due diligence under the German GwG and the EU anti-money-laundering framework). Our users are these obliged entities, acting in that capacity. For beneficial-ownership data, EU law expressly preserves access for obliged entities performing due diligence (C-37/20).
• Banks must not deal with sanctioned people. Funds and economic resources must not be made available to a person on a sanctions list (for example Art. 2 of Regulation (EU) No 269/2014), so banks check the people who direct and own their counterparties against the official lists. We compare the people the registers link to the companies on a bank's book with the people on the lists, by name and by the list's own aliases. Every result is a review candidate for the bank's analyst, never a match by itself, and it sets no score.
• Our own interest is to provide that lawful lookup with citations instead of screenshots: every fact traceable to its register entry.

Where a bank instructs a check on a specific person, that bank is the controller of its instruction, must record its purpose, and we act on documented instruction only. That bank reads the result in the dashboard and, where person data is switched on for it, through our API and our MCP server, as findings with their sources and without any score, rating or ranking.

• Register role and ownership facts: as long as the source register publishes them, subject to your objection (below). Facts a register supersedes are marked historical, as registers themselves do; they are not silently deleted, because the historical record is what due diligence verifies against.
• Insolvency publications naming a person: at most 180 days, which keeps every copy inside the source register's own six-month deletion clock (Section 3 InsBekV). The purge is enforced by code, runs daily, and its counts are audited. Private copies must not outlive the register; we agree, and we built the deletion in.
• Sanctions list entries: as long as the list carries them. When a person leaves a list, the entry, its earlier versions, its name keys and every review decision on it are deleted in the same update.
• Public funding awards naming a natural person or a sole trader: held as the source published them, with no automatic deletion clock, shown only inside workspaces the person data gate admits and never linked to a company. An objection hides them for every user of our software.
• Power plant and emissions register rows whose operator may be a natural person (Bundesnetzagentur Kraftwerksliste, the thru.de PRTR and IED list): held exactly as the source states them, and only for as long as the current edition of the source states them (each new edition replaces them), shown only inside workspaces the person data gate admits and never linked to a company. An objection erases them, and they are never written again.
• Persons named in capital market notices of listed issuers: at most 1825 days from the date the notice states, which never exceeds the five years for which Article 17(1) of Regulation (EU) No 596/2014 obliges an issuer to keep on its website the inside information it must disclose. The purge is enforced by code before every read of the issuers' pages and daily, and its counts are audited.
• Debt-register entries (Section 882b ff. ZPO): our software never queries the Schuldnerverzeichnis itself; access is statutorily gated (Section 882f ZPO) and no automated retrieval exists. Where a bank has performed such a lookup itself at the official portal, it can record the outcome in the product for its own due-diligence file; that record is the bank's, purpose-bound, visible to that bank only, and purged after at most 1095 days (inside the statutory three-year clock of Section 882e ZPO). For this recording the bank is the controller (see "Who is responsible" above).

Recipients are our customer banks and comparable regulated financial institutions, under contract, for know your customer, sanctions and credit due diligence on organisations and the people who direct and own them. They receive the data inside our closed, authenticated product: in the dashboard, in the company reports it prints, through our API and through our MCP server. Through the API and the MCP server a bank can pass the data to its own software, including AI agents it operates, under its own responsibility and for the same due diligence. The sandbox of our public API and our public pages show no person. We do not republish register data on the open web, we operate no public people-search, and we never sell personal data. The technical service providers that host our infrastructure are listed in the Privacy Policy, section 7.

Register data originates from EU and EEA (including Norwegian), UK, and Swiss registers. It is stored in the product database on our own infrastructure in Finland (European Union) and processed on EU infrastructure; the full transfer picture, including the technical processors, is in the Privacy Policy, sections 7 and 8.

• No scores. We compute no creditworthiness score, risk score, rating, ranking, traffic light, or probability value of any natural person's creditworthiness, reliability or risk, anywhere, not in the database, not in the interface and not in reports. Where a bank watches a person, we show that bank the tone of the news and the posts that name the person, as context beside the articles and posts themselves. That tone is never a score of the person, never an input to a score, and never computed for a sole trader. This is enforced by automated checks in our build pipeline. The German credit bureau rules (Section 31 BDSG) and the EU case law on scoring (C-634/21) draw a line we deliberately stay far behind.
• No predictions. A register fact is displayed as a cited fact or not at all; it is never presented as a prediction about a person.
• No automated decisions. Nothing in the product decides anything about a person (Art. 22 GDPR). Banks are contractually prohibited from using our output as the sole basis for automated decisions about natural persons.
• No enrichment. No data from social networks, credit agencies, or data brokers is merged into register facts. Same-name persons are never merged into one record without a register-published anchor; when in doubt, we keep records separate.

Registers remain the authoritative record. Every fact in Stonewake carries a citation naming its register, the register identifier, the retrieval date, and a link to the register entry, so that any fact can be verified at the source. Correcting an incorrect register entry is only possible at the register itself; we mirror corrections when the register publishes them, and on request (see rights below).

You have the rights of Art. 15 to 21 GDPR against us for this processing: access, rectification, erasure, restriction, and objection.

Objections (Art. 21 GDPR). Write to contact@stonewake.ai. We decide within one month of receipt. Following German case law, we distinguish two situations, and we state our policy plainly:

• Entries whose publication purpose has lapsed: for example an old insolvency publication past the register's own deletion clock, or a role at a company that was dissolved long ago. Display suppression is granted readily, without you having to prove particular harm.
• Facts a register currently mandates and publishes: for example a current directorship. Register publicity generally prevails; we review each case individually, weigh documented particular circumstances, answer with reasons, and point to the register as the venue for correcting the underlying entry.

A granted suppression takes effect for all users of our software at once, across every customer.

Complaints. You have the right to complain to a data protection supervisory authority, in particular in the member state of your residence or workplace. The authority responsible for us is the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg), Stahnsdorfer Damm 77, 14532 Kleinmachnow, lda.brandenburg.de.

When a new register source goes live, or retention or recipients change, this notice is updated first and the version and effective date above change. The current version is always at this address.