Data protection

1. Applicable framework

Our approach addresses the UK GDPR, the Data Protection Act 2018, applicable UK electronic communications rules, and the EU GDPR or other local privacy rules where they apply to a particular activity. The obligations depend on the purpose, information, people and countries involved. A business-to-business service or public registry source does not create a blanket exemption.

This page explains our approach. It is not a certification, a guarantee that every customer use is lawful or a replacement for the relevant contract, notice or documented compliance assessment.

2. Controller and processor roles

3. Lawful use and transparency

Legitimate interests can be an appropriate basis for proportionate business-information processing only after necessity and balancing have been considered. Additional requirements apply to special-category data, criminal-offence information, direct marketing and automated decisions about people.

People must receive the privacy information required by law. Indirect collection requires its own timing and exception assessment. Customers must give their own notices and cannot rely solely on our website notice for their independent processing.

4. Rights and data quality

The privacy request page supports access, correction, deletion, restriction, objection, marketing suppression and relevant sale/sharing opt-outs. People do not need an account, a paid subscription or a company phone number to use it. Verification is proportionate to the request.

We distinguish a historical record from a current professional contact, and a source fact from an inference or assessment. A disputed match needs investigation; a missing record does not prove the absence of a relationship or risk.

5. Website safeguards

This website uses HTTPS in production, server-side input validation, request size limits, abuse controls and restricted storage. Public users cannot access the stored request queues. Sales enquiries are forwarded server-to-server, and privacy requests use a separate restricted queue. Optional analytics and marketing attribution are disabled until the corresponding choices are made.

Service-specific security requirements, hosting locations, incident processes, availability and evidence should be agreed during procurement. This page does not promise a particular certification scope, penetration-test result, insurance level or data residency arrangement.

6. Enterprise agreements and transfers

For an enterprise assessment, request the relevant data scope and sources, processing roles, security documentation, retention arrangements, service-provider information, transfer safeguards and contractual documents. Our standard data processing addendum applies only where expressly incorporated and completed for the processing concerned.

Restricted transfers, including relevant overseas support access, need an applicable legal mechanism and assessment. A controller-to-controller data licence and a processor agreement serve different purposes and should not be treated as interchangeable.

7. Contact

For procurement questions, contact our team. For a personal record or rights request, use the privacy request page. Read the website privacy notice and business data privacy notice for the information relevant to you.