GDPR Compliance

Our GDPR commitment

Leadistry processes UK B2B data in accordance with the UK GDPR and the Data Protection Act 2018. Which role we are in depends on the data, and there are three answers rather than one.

We are the data controller for the company and business-contact records we build from the public record and from companies' own websites. We decide what to collect, why, and how long to keep it, and a person in those records exercises their rights against us. That is the bulk of the personal data here.

We are a data processor for the personal data inside a customer's own account that they put there and we only hold on their behalf: the contents of the emails they write and send through us, the replies those emails receive, and the text of a connected mailbox we read to match a reply to a thread, and the letters they post through us. Our processing terms for that are in section 11 of our Terms of Service, which is the Article 28 contract between us, and the sub-processors involved are listed at leadistry.co.uk/sub-processors.

Our customer is an independent controller for the marketing they choose to send. We supply the record and draft the words; they decide who to write to and press send, so the obligations that attach to being a sender are theirs.

Our legal basis for processing director and business-contact data is UK GDPR Article 6(1)(f), legitimate interests. Direct marketing to corporate subscribers (limited companies) is permitted under the Privacy and Electronic Communications Regulations (PECR) without prior consent, provided opt-out is honoured. A letter to a company at its registered office is not covered by PECR; we rely on legitimate interests for it and post only to an address our check reads as one a letter can go to.

Our legitimate interests assessment, in short

We rely on legitimate interests, so we wrote down why, and tested it against the interests of the people in our records. This is a plain summary of that assessment.

The purpose. To help UK businesses write to other UK businesses, business to business.

Why not consent, and why not company-only data. We cannot ask a company officer for consent to hold their published business email without first holding that email. We also tried company-level data with no named person and rejected it: a generic info@ address reaches nobody, so the sender has to send more mail, not less.

What protects the person:

• The data is public record about a company role.
• Each email gives a dated public reason for writing, which the reader can check.
• New companies are held back until they can be reached.
• We use named emails only for limited companies and LLPs, and never for freemail addresses.
• Sole traders and general partnerships are held back.
• Every email says where the details came from and has a removal link.
• Removal is permanent and applies to every customer.

Dates. First assessed 29 May 2026, reissued 17 July 2026 and 21 September 2026. We review it at least once a year, and sooner if anything material changes. The full assessment is available to the ICO on request.

Data controller details

The data controller for personal data processed in the Leadistry database is:

Online Safety Act

Customers can upload a video to their emails, and anyone with its link can watch it. Under the Online Safety Act 2023 that makes Leadistry a user-to-user service. Anyone can report a video from its page. A video reported as child sexual abuse, terrorism or an intimate image shared without consent comes off its page at once while we check it.

Processors and international transfers

We use a small number of technical processors under UK GDPR Article 28 controller-processor contracts, listed in full in our Privacy Notice. These include Anthropic (US), the primary processor for our AI-assisted features via Anthropic's Claude API, and OpenAI (US), which acts as a secondary (fallback) AI processor. Under each provider's API terms, inputs to and outputs from the API are not used to train their models. Transfers of limited operational data outside the UK (including to Anthropic, OpenAI, PostHog, Microsoft Clarity, and Google Analytics) are covered by the UK International Data Transfer Addendum to the EU SCCs or equivalent transfer mechanisms published by each processor.

Your rights as a data subject

If you are a director, employee, or contact whose details appear in our database, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (right to be forgotten)
• Object to processing for direct marketing, this is an absolute right
• Restrict processing while we investigate a request
• Portability, receive a machine-readable copy

How to exercise your rights

The fastest routes are our four public self-service forms. Whole-company removal at leadistry.co.uk/remove-company (no account required; applied automatically within seconds). Director-level removal via our self-service opt-out form; those requests are reviewed manually and processed within 24 hours. Suppression is applied at the SQL level so the record cannot be reintroduced through future re-imports.

For other subject-rights requests (access, rectification, restriction, objection, portability), email support@leadistry.co.uk. We respond within 30 days as required by UK GDPR Article 12.

Retention

We retain company and contact data for as long as the company remains active on the public Companies House register, and re-verify it from source periodically (a monthly re-verification). We remove a company on a valid suppression request, and suppression is honoured permanently, once you've opted out, you stay opted out, even if the record is later re-imported from Companies House.

Complaints

You have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by phone on 0303 123 1113. We'd appreciate the chance to address concerns directly first via our contact page, but the ICO route is always available regardless.