Policy
Privacy Notice
This notice describes the personal information we process about the representatives of organisations who use this site, why we process it, who receives it and how long we keep it. We collect only high-level organisational information and never ask for datasets.
By Business Data Licensing editorial teamUpdated 13 October 2026
Controller
The controller is [Registered company name] Ltd, registered in England and Wales under company number [00000000], whose registered office is [Registered office address]. ICO registration reference: [ICO registration reference]. Queries and rights requests should be sent to [privacy contact email].
Information we collect
When an assessment is requested
- Organisation: name, website, country, sector, approximate headcount and period of operation.
- High-level record information: whether documented processes exist, the principal language and the kinds of record held.
- Governance answers: whether contracts have been reviewed, whether personal data is known to be present, who must approve the enquiry, and any optional note you add.
- The outcome of our screening against published criteria, and a reference number.
- Representative: name, job title, business email address, and confirmation of authority to make the enquiry.
- Governance confirmations: that the representative understands no data is to be submitted and consents to introduction to a named buyer.
- Administrative records: the version of this notice shown, the time of submission, the originating website and page, and campaign parameters in the referring link.
When you correspond with us
The contents of your message and our reply, with your contact details.
Technical information
Hosting and security providers process technical data such as IP address and browser type to deliver the site and defend it against abuse. When a form is submitted we store a one-way hash of the IP address, not the address itself, to limit spam and repeated submissions. We do not currently use analytics or advertising technologies. See our Cookie Policy.
Purposes and lawful bases
| Purpose | Lawful basis | Comment |
|---|---|---|
| Assessing a request against buyers' published criteria and responding | Legitimate interests | Operating a free assessment service and answering those who request it. |
| Introducing the organisation to a named buyer and disclosing the representative's details | Consent | Given expressly at the time, after we have identified the buyer. May be withdrawn, without affecting disclosure already made. |
| Recording introductions and any referral compensation | Legal obligation; legitimate interests | Accounting and tax duties, and evidence of who made an introduction. |
| Securing the site and preventing abuse | Legitimate interests | |
| Optional updates by email, where requested | Consent | Separate from the assessment and withdrawable at any time. |
| Handling complaints and legal claims | Legitimate interests; legal obligation |
We take no decisions producing legal or similarly significant effects by solely automated means. Our screening against published criteria is advisory and is reviewed by a person.
Recipients
- A named buyer, only where consent has been given. We disclose the details needed for an introduction (typically the representative's name, title and business email, and the organisation's name) and what has been stated to us.
- Processors acting on our instructions, including providers of hosting, databases, email delivery and security.
- Professional advisers, including lawyers, accountants and insurers.
- Public authorities, where required or permitted by law.
We do not sell personal information and do not disclose it for cross-context behavioural advertising. Once an organisation applies to a buyer through its own channel, that buyer controls what it receives and its own privacy notice applies. For general expectations on information gathered to generate leads, see the ICO's guidance.
International transfers
Some buyers are located outside the UK, including in the United States. We identify the buyer and its location when we seek consent to an introduction. Where personal information is transferred outside the UK we rely on an appropriate mechanism or exception recognised by UK law, as described in the ICO's international transfers guide. Certain service providers may also process information outside the UK on similar footing.
Retention
| Category | Period |
|---|---|
| Assessment requests not leading to an introduction | 12 months from last contact, then deletion or anonymisation |
| Introduction and compensation records | As required for accounting, tax and the resolution of attribution disputes, typically up to six years |
| Marketing preferences | Until consent is withdrawn; a minimal suppression record is retained to honour opt-outs |
| Correspondence | Up to 24 months after the matter is closed |
| Security logs and anti-spam records (hashed) | Typically up to 90 days |
Longer periods may apply where the law requires or where information is needed to establish, exercise or defend legal claims.
Individual rights
Individuals may have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Requests should be sent to [privacy contact email]; we may need to verify identity and aim to respond within one month. A complaint may be made to the Information Commissioner's Office at ico.org.uk. We would welcome the opportunity to address your concern first.
General
- Audience. The site is directed at organisations and is not intended for persons under 18.
- Security. We apply access controls, encryption in transit and need-to-know restrictions on enquiry data.
- Location. The site is operated from the United Kingdom, and information is processed under UK law.
- Changes. This notice will be updated when our practices change, with the revision date shown above.