Business data privacy notice

1. Scope and controller

This notice concerns personal information about people in our company-information products, including directors, officers, disclosed shareholders, beneficial owners and business contacts. It complements the website privacy notice. Global Data Intelligence Limited, company number 09410808, at Artisans’ House, 7 Queensbridge, Northampton, Northamptonshire, NN4 7BF, United Kingdom, is the controller for the business-information purposes it determines. Customers normally act as separate controllers for their own use.

A legal company’s own financial statements may concern a corporate entity, while a director’s name, sole trader record, appointment, shareholding or contact information can be personal data. Public availability does not remove privacy rights.

2. Information categories and sources

• Names, professional roles, appointments and resignation history, and links to companies.
• Disclosed shareholdings, voting or control interests and ownership relationships.
• Relevant identifying details published in official records, such as a service address or a disclosed birth month/year, where lawful and available.
• Professional contact information, company, role and career information where included in the purchased dataset.
• Relevant publicly available filings, legal or insolvency records, dates, source references and information used to resolve a record match.

Sources can include official company and beneficial ownership registers, government publications, public courts and insolvency records, company disclosures and websites, relevant public professional information and licensed data partners. Our Data describes source categories and country references. Source coverage and disclosure rules vary; ask us about the source, date or matching context of a specific record.

3. Purposes and legal basis

We collect, organise, match, update and license business information to support identification of legal entities, ownership analysis, due diligence, company research, credit and supplier risk assessment, record enrichment and relevant business connections within the licensed scope.

For ordinary personal data, our usual basis is legitimate interests in reliable business information, commercial transparency, fraud prevention and enabling proportionate business research, balanced against the person’s rights and reasonable expectations. A contractual relationship with a customer is not, by itself, a lawful basis for processing every person named in a dataset. Legal obligations apply where a specific law requires a particular activity.

Sensitive personal data and criminal-offence information require additional legal conditions and safeguards; legitimate interests alone is insufficient. An ordinary product licence does not authorise customers to collect or infer such information or use data for prohibited individual eligibility decisions.

4. Transparency and information from other sources

Applicable law may require us to provide privacy information when personal data is collected indirectly, generally within one month or sooner at the first communication or disclosure. The lawful timing and any exception depend on the circumstances. A public webpage is not automatically a substitute for giving the required information to the individual.

Any reliance on an exception, such as disproportionate effort, must be assessed and documented for the relevant processing and accompanied by appropriate safeguards. This notice does not assert that one blanket exception applies to everyone in the database.

5. Recipients and customer responsibilities

Licensed customers receive relevant information through reports, platform access, APIs, MCP integrations or agreed data feeds. They include organisations conducting business research, compliance, procurement, commercial risk or other permitted business activities. Authorised service providers and support operations may handle data for collection, hosting, matching, delivery, security or correction.

Customers must establish their own lawful basis, give required notices, respect objections and restrictions, secure the data and comply with local marketing rules. Receiving a business email address is not blanket permission to send electronic marketing. Redistribution and model training require both the contractual licence and any separate legal permission required for personal data.

6. Accuracy, retention and historical records

Registry and corporate records reflect filings and events at particular times. Matching and transcription can be wrong. A record may need correction, a source update or explanatory context. Tell us which person, company, country and record are affected and what appears incorrect.

Business-contact records are subject to the existing business-contact retention approach of a maximum of three years since the last update. Historical company filings, appointments, ownership events and legally relevant records can have a separate continuing transparency or legal purpose. For those records, retention is assessed by purpose, accuracy, legal duties and the person’s rights, rather than treating every historical fact as a current contact detail.

Information that is no longer necessary should be deleted or anonymised. Minimal objection and suppression information may be retained to prevent inappropriate reintroduction. Ask the Privacy Team for the criteria applicable to your record.

7. International access

Company information is used internationally. Authorised operations and recipients may be located in the UK, EEA, Moldova, United States and other countries relevant to our business and customers. Restricted transfers require an applicable lawful mechanism and assessment. A public source or a commercial licence does not, on its own, satisfy transfer requirements. You may request information about safeguards applicable to your data.

8. Access, correction, objection and erasure

You may have rights to access your data and source information, correct inaccurate information, request deletion or restriction, object to legitimate-interest processing and complain to a regulator. Some rights depend on the legal basis and circumstances. Portability is not a general right to copy a dataset processed on legitimate interests.

Use the privacy request page without creating an account. Direct marketing objections must be honoured for that purpose. Other objections require an assessment of the relevant legal test. Where we cannot erase or must retain information for a lawful reason, we will explain the reason and available complaint route. We will communicate a correction, erasure or restriction to recipients where applicable law requires it.

We can correct or restrict our own processing; we cannot amend an official register on your behalf. You may also need to contact the original registry. A request about an official record will not be refused merely because the information was public.

9. Scores, profiling and individual decisions

Company scores and risk indicators can involve automated analysis and partner assessments. Their meaning depends on the entity, methodology, period, data quality and available evidence. Scores about a company must not be assumed to be a reliable assessment of a natural person.

Where processing concerns a sole trader or another identifiable individual, additional transparency, lawful-basis and automated-decision safeguards may apply. Customers must not rely on a report as the sole basis for a legally significant individual decision without satisfying those rules and any sector-specific requirements. Ask us about the source and methodology of a particular assessment.

10. US opt-outs and other local rights

Where applicable US privacy law treats licensing of personal business data as a sale or sharing, eligible people can request the relevant opt-out through Your privacy choices. You can also request access, correction or deletion and an appeal where available. An authorised agent may act where permitted. We request only the information reasonably needed for the type of request; an opt-out does not require registration or identity documents.

A browser privacy signal is applied to optional attribution on this website. To locate and suppress a separate product record, include the relevant professional identity or record reference. We do not treat the fact that someone is a business contact as a universal exemption from privacy law.

11. Contact and complaints

Contact the Privacy Team through the privacy request page or by post at our registered office. UK/EU requests are normally addressed without undue delay and within one month, subject to lawful verification and extensions. You may complain directly to the ICO or the competent authority in your country. This notice is reviewed as our services and applicable rules change.