GDPR Compliance

Our GDPR commitment

Leadistry processes UK B2B data in accordance with the UK GDPR and the Data Protection Act 2018. Which role we are in depends on the data, and there are three answers rather than one.

We are the data controllerfor the company and business-contact records we build from the public record and from companies' own websites. We decide what to collect, why, and how long to keep it, and a person in those records exercises their rights against us. That is the bulk of the personal data here.

We are a data processor for the personal data inside a customer's own account that they put there and we only hold on their behalf: the contents of the emails they write and send through us, the replies those emails receive, and the text of a connected mailbox we read to match a reply to a thread. Our processing terms for that are in section 11 of our Terms of Service, which is the Article 28 contract between us, and the sub-processors involved are listed at leadistry.co.uk/sub-processors.

Our customer is an independent controller for the marketing they choose to send. We supply the record and draft the words; they decide who to write to and press send, so the obligations that attach to being a sender are theirs.

Our legal basis for processing director and business-contact data is UK GDPR Article 6(1)(f), legitimate interests. Direct marketing to corporate subscribers (limited companies) is permitted under the Privacy and Electronic Communications Regulations (PECR) without prior consent, provided opt-out is honoured.

Data controller details

The data controller for personal data processed in the Leadistry database is:

Processors and international transfers

We use a small number of technical processors under UK GDPR Article 28 controller-processor contracts, listed in full in our Privacy Notice. These include Anthropic (US), the primary processor for our AI-assisted features via Anthropic's Claude API, and OpenAI (US), which acts as a secondary (fallback) AI processor. Under each provider's API terms, inputs to and outputs from the API are not used to train their models. Transfers of limited operational data outside the UK (including to Anthropic, OpenAI, PostHog, Microsoft Clarity, and Google Analytics) are covered by the UK International Data Transfer Addendum to the EU SCCs or equivalent transfer mechanisms published by each processor.

Your rights as a data subject

If you are a director, employee, or contact whose details appear in our database, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (right to be forgotten)
• Object to processing for direct marketing, this is an absolute right
• Restrict processing while we investigate a request
• Portability, receive a machine-readable copy

How to exercise your rights

The fastest routes are our two public self-service forms. Whole-company removal at leadistry.co.uk/remove-company (no account required; applied automatically within seconds). Director-level removal via our self-service opt-out form; those requests are reviewed manually and processed within 24 hours. Suppression is applied at the SQL level so the record cannot be reintroduced through future re-imports.

For other subject-rights requests (access, rectification, restriction, objection, portability), email hello@leadistry.co.uk. We respond within 30 days as required by UK GDPR Article 12.

Retention

We retain company and contact data for as long as the company remains active on the public Companies House register, and re-verify it from source periodically (a monthly re-verification). We remove a company on a valid suppression request, and suppression is honoured permanently, once you've opted out, you stay opted out, even if the record is later re-imported from Companies House.

Complaints

You have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by phone on 0303 123 1113. We'd appreciate the chance to address concerns directly first via our contact page, but the ICO route is always available regardless.