--- title: "Privacy and Fair Processing Notice" url: "https://www.wren-data.co.uk/legal/privacy" description: "Privacy and Fair Processing Notice for WREN TECHNOLOGIES LTD." --- ## 1\. Who we are and what this notice covers WREN TECHNOLOGIES LTD is a company registered in England and Wales under number 17382891. We are registered with the Information Commissioner’s Office as a data controller under registration reference ZC241278. Our registered office and privacy correspondence address is 128 City Road, London, EC1V 2NX, United Kingdom. “Wren”, “we”, “us” and “our” mean this company. Wren Data and Directory Enquiries are trading names, not separate legal entities. This notice covers people whose details are held in our business database or directories, users of our Marketplace and Pulse services, visitors to our websites, customer representatives, people we call to verify business information, and anyone contacting us or exercising their rights. It applies to wren-data.co.uk, app.wren-data.co.uk, directory-enquiries.co.uk and optout.wren-data.co.uk. Our business database and purchasing customers are UK-focused and restricted to the UK. We are a **controller** when we decide how to build and use our database, publish our directories, run campaigns and outbound integrations using Wren Data, administer accounts and run our own communications. We are a **processor** when we handle information a customer gives us solely on that customer’s instructions — principally Pulse uploads, described in section 6. Customers who obtain information from us generally become separate controllers of it. To opt out, exercise a right or ask a privacy question, see section 9 and the contact details at the end of this notice. ## 2\. Our business database The database is the main thing we do, so we describe it first. ### What we hold We hold business names, registered and trading addresses, company numbers, websites, business telephone numbers and general business email addresses. We also hold company status, activities, industry classifications, employee and site information, financial information from company filings, property and geographic information, and relevant public-register and specialist business information. For identifiable business contacts, we hold names, titles, job titles, departments, role classifications, contact email addresses, associated businesses, and links to individual LinkedIn, Facebook and X profiles. We also hold record identifiers, source and validation information where available, matching results, and marketing or suppression preferences. Business telephone numbers belong to business records in our system. We do not maintain a separate database of personal contact telephone numbers. ### Where the information comes from We obtain information from Companies House, public websites, public social-media accounts, business directories, open datasets, other public registers and licensed data suppliers. We also receive business updates through our verification calls, manual checking and direct requests for correction or removal. ### Information we generate We generate possible contact email addresses from the contact and company information available to us, the business website domain and common email-address patterns. We validate an address before use and send a privacy-information email. If an email bounces, we remove that address and the associated contact from the active database. We derive departments and role classifications from job titles. Matching and validation are performed by our database systems. These processes can produce errors, and you may ask us to correct them. Validating an address does not establish consent to marketing, and does not guarantee that the address belongs to the intended person. We classify business roles and departments, but we do not use those classifications to make solely automated decisions producing legal or similarly significant effects on you. ### Keeping information current Our update processes run daily. Changes may be triggered by website changes, public-register updates, verification calls, manual updates or opt-out processing. Daily processing does not mean every individual record is independently verified each day. We use historical business information to match older customer records to current businesses, update customer lists and support business analysis. Historical personal information that is not needed for an active purpose is removed or reduced during review. Review may be triggered by a source update, failed validation, a stale or unverified business association, a correction, erasure or objection request, or the related business becoming ineligible or outside our scope. The contact details of people who have left a business are kept in a separate former-contact database and restricted to suppression and matching use only, for the period in section 11. They are never supplied as current contact data. ### Telling people we hold their information Where we collect a business contact email address from a source other than the person themselves, we send a privacy-information email within 30 days of collection, and earlier where the UK GDPR requires it. It explains what we hold and how to exercise rights, including how to opt out. Sending that email is not a request for, or evidence of, consent to marketing. Where someone gives us their details directly during a verification call, we tell them about this notice at the time — see section 4. ### Who is included We use corporate-subscriber classifications and Companies House matching to identify eligible businesses. Businesses that are not corporate subscribers are outside our current scope. We exclude sole traders and partnerships by default where the business name contains personal information. Detection is not always reliable where a business name is ambiguous, so if a record containing a personal name reaches the database we will remove it on request, and we also remove such records when we identify them ourselves. We use suppression controls to prevent an excluded business or contact returning to the active dataset. If you believe an ineligible or inaccurate record is included, please contact us so we can investigate, correct or remove it. ### What we do not collect We do not intentionally collect personal information about children, special-category information such as health or religious beliefs, or criminal-offence information, for our business-contact services. School-level statistics or a school’s religious ethos describe the institution, and are not intended as information about individual pupils or staff. ## 3\. What we publish publicly Our directories at directory-enquiries.co.uk publish **business** contact details: business name, business address and business telephone number. We do not publish individual names, job titles or personal email addresses. Those are held in the licensed database described in section 2 and are not made public. Because sole-trader and partnership businesses can carry a person’s name, we exclude them by default, as explained in section 2. Where an ambiguous business name means a personal name is published, tell us and we will remove it. Directory listings are accessible to the public and may be indexed by search engines, which makes listed business information accessible outside the UK. Removing a listing does not alter Companies House or any other independent public register, and we cannot erase copies held by unrelated organisations. ## 4\. Verification calls We make outbound telephone calls to businesses to verify information we already hold. Calls are handled by our own automated calling system, which identifies itself at the start of the call: > “Hello, I’m an automated assistant calling on behalf of Wren Data to verify your existing business information. You can find how we handle your details at wren-data.co.uk/legal/privacy.” **We call main switchboard numbers only**, using details already in our database, and only to verify them. We do not cold-call direct dials for named individuals, and these are not marketing calls. We screen numbers against TPS and CTPS before dialling. **We do not record these calls.** We keep a transcript for 30 days so we can check what was confirmed, after which it is deleted. Verified details are written to the business record. We collect business-level information: business name, address, telephone number, company email address, employee and site information, and the contact at that site. If the person answering chooses to give their own name and email address, we record those too — they are never required, and the call proceeds without them. Where someone gives us their details this way, we are collecting directly from them, which is why the call points to this notice at the outset. ## 5\. Our websites, accounts and enquiries ### Accounts, orders and support We process account and registration information, professional contact details, order and billing records, support messages and service communications, to administer accounts, process orders and respond to enquiries. We use transaction and invoice information to administer payments and meet accounting and tax duties. When you use a form or service we identify the required fields. We need enough information to create an account, take a payment or deliver the service you asked for, and without it we may be unable to provide that service. Submitting an email opt-out does not require the optional fields. We may ask for proportionate identifying information to locate a record or verify a rights request. ### Security We process security events and technical information to protect accounts, systems and services. ### Cookies, analytics and advertising measurement Our websites and app use Google Analytics and Google Ads measurement only where you opt in through the cookie banner. We use them to understand visits and use of the service, measure advertising performance and support our marketing analysis. We do not use Google Signals. Cloudflare provides website delivery and protection, including Turnstile to reduce automated form abuse. We use Instiller to measure opens and clicks in our email campaigns, linking recorded engagement to the recipient to assess how a campaign performed. Email measurement is separate from website analytics. Full details are in our [Cookie Notice](/legal/cookies/). ### AI chat Our website chat is answered by an AI model that **we run ourselves**, on infrastructure we control hosted by Microsoft Azure. Messages are not sent to any third-party AI provider, and are not used to train anyone else’s model. We do not retain chat history, and we do not send database records or customer uploads through the chat. Please avoid putting confidential or unnecessary personal information into chat messages. ### Inbound calls Calls to us may be answered by our automated receptionist, which processes the caller’s speech to handle the request. It runs on the same self-hosted basis as the chat above. Recordings of inbound calls are kept for 30 days. ## 6\. Services we provide for customers This section explains services where we process information for customers. We are a **processor** for Pulse uploads, where the customer gives us its own data and decides the purpose. We remain controller of our own reference database, email campaigns and outbound integrations run using Wren Data. ### Pulse uploads and enrichment When a customer uploads a file to Pulse, we match it against our database and append the requested information to their file. We use the upload only to provide that service. We do not use it to populate our database, to train models, or to benefit any other customer. Matching is database-based and does not use AI. Uploaded files are held in a secure Azure Blob container. Files, enrichment outputs and file metadata are deleted 30 days after the initial upload, including outputs generated later within that period. ### Customer email campaigns and integrations We deliver email campaigns for customers using Wren Data. We do not upload customer-provided lists into those campaigns. Our sourcing, selection and use of Wren Data for those campaigns is our controller activity, and customers who receive campaign results or related information are responsible for their own subsequent use. At a customer’s instruction we transfer selected information to their connected Salesforce, Instiller, Mailchimp, HubSpot or Zapier service. The customer chooses the destination, holds that account and contracts with that provider directly, so those platforms are not our sub-processors and have their own privacy arrangements. Unless the customer’s agreement with us specifies a different period, Wren Data email campaign lists, send records, delivery information, opens, clicks and campaign results are retained for up to 18 months from the date the initial email list is created. ## 7\. Why we use personal information ### Legitimate interests We rely on legitimate interests to compile, verify, maintain and license business-contact information, to publish eligible business listings, and to support business prospecting, customer-record enrichment and market analysis. Those interests are our interest in providing these services and our customers’ interest in finding relevant business contacts and keeping their records accurate. We balance them against the reasonable expectations, rights and interests of the people in the database, including the effect of combining information from several public sources. We rely on legitimate interests for our own corporate B2B marketing — email campaigns, LinkedIn marketing and business calls — and we screen marketing calls against TPS and CTPS. You can object to direct marketing at any time and we will stop. Where our customer is a company, we rely on legitimate interests to administer its representatives’ details in order to deliver and support the service. We also rely on legitimate interests to keep our systems secure and prevent misuse, to maintain business-exclusion controls, and to handle disputes and preserve evidence where necessary to establish or defend legal claims. ### Consent We rely on consent for optional Google Analytics and Google Ads measurement, collected through the cookie banner. Where any marketing channel or technology requires consent, we obtain it separately. You may withdraw consent at any time, without affecting processing carried out before you withdrew it. ### Legal obligation We rely on legal obligation to keep accounting and tax records, and to handle rights requests and privacy complaints. Compliance with data-protection obligations is also the basis for the minimal suppression information we keep to honour objections and stop excluded records returning. ### Contract Where an individual is personally party to a contract with us, we rely on contract for the processing necessary to perform it. We do not treat a customer contract as a basis for processing unrelated people in our database. ## 8\. Who we share information with ### Our customers We supply eligible business and contact information to UK business customers for business prospecting, marketing, record enrichment and analysis. Customers decide how they use it afterwards and are responsible for their own privacy information, lawful basis and marketing compliance. We do not provide the service for credit or fraud checking. Customers are bound by our [Data Licence and Customer Suppression Schedule](/legal/data-licence/), which requires them to: - suppress a record immediately on request, and apply that suppression across their own records; - use each list only within the 12-month licence period, and use each record a maximum of 12 times in total across all purchased channels; - delete or irrecoverably destroy a list when the licence period ends, retaining only Business ID and Contact ID where needed for suppression; and - not resell, sublicense, transfer or publish a list. We seed lists to detect unauthorised resale, and we make suppression information available to customers so they can act on objections — see section 9. ### Service providers We use service providers to operate our services, under written data-processing terms. They fall into these categories: - **Hosting and infrastructure** — database hosting, backups, file storage, transactional email and the compute running our own AI models - **Payments** — payment processing, billing and invoicing - **Email delivery and measurement** — campaign sending and engagement measurement - **Website delivery and security** — DNS, hosting, web application firewall and bot protection - **Monitoring** — infrastructure monitoring and observability - **Analytics and advertising measurement** — optional website analytics and Google Ads measurement, subject to your cookie consent Named providers, their purposes and their roles are listed in our [Sub-processor Register](/legal/sub-processors/). A provider may act as our processor for some purposes and as an independent controller for its own account, transaction or security information, under its own notice. Our chat and calling AI models run on infrastructure we control. No third-party AI provider receives chat messages or call content. You can ask for details of specific recipients using the contact details at the end of this notice. ### Authorities and legal claims We may disclose information where required by law, in response to a valid regulatory request, or where necessary to establish, exercise or defend legal claims. ## 9\. Opting out, suppression and exclusion ### Opting out Use [https://optout.wren-data.co.uk](https://optout.wren-data.co.uk) to opt out an email address. You can also email [dpo@wren-data.co.uk](mailto:dpo@wren-data.co.uk), call 0161 524 8524, or write to our registered office marked “Data protection”. **We never ask for a reason.** An email opt-out removes the associated active contact details — name, position, email address and individual social-profile links. We keep minimal suppression information to stop the record returning. Our systems are normally updated within 24 hours. The automated service matches email addresses exactly, so submit each address you use. That limitation does not restrict your rights: contact us directly if you have no email address, several linked identities, inaccurate details, or you want a manual review. ### Full-company exclusion We also accept full-company exclusion requests, which remove the company listing, its contacts and the associated company information from our active services. We keep only the identifiers needed to enforce the exclusion. An email opt-out on its own does not remove non-personal company information or a business telephone number — a full-company exclusion is a separate request that we handle directly. ### Information already supplied to customers Where we erase, correct or restrict personal information that has previously been supplied to a customer, we notify the affected customer and provide a matched update through the customer portal. These updates contain only the identifiers needed to locate the original record, without revealing erased names, email addresses or other removed information. Current suppressions are also applied automatically to future downloads and refreshed exports. Our [Data Licence](/legal/data-licence/) requires customers to apply these updates promptly to their own systems and to stop using information that has been erased or restricted. We record when customers are notified and when updates are collected. We send reminders for outstanding updates and may restrict access where a customer does not comply. We retain a limited disclosure and suppression record after the associated order history has been deleted. This allows us to notify previous recipients, prevent suppressed information from being supplied again and demonstrate compliance with our data protection obligations. This record does not contain the removed personal information in readable form. ## 10\. Your rights You can ask us to: - **give you a copy** of your personal information, and tell you how it is used, where it came from and who it has gone to; - **correct** information that is inaccurate or incomplete; - **erase** information, in the circumstances where that right applies; - **restrict** how we process it, in the circumstances where that right applies; - **provide a machine-readable copy**, where processing is automated and based on consent or a contract with you. **You can object to direct marketing at any time and we must stop.** That right is absolute and includes related profiling. For other processing based on legitimate interests, you can object on grounds relating to your particular situation, and we must stop unless we can show compelling legitimate grounds that override your interests. Where we rely on consent you can withdraw it at any time, without affecting processing carried out beforehand. Contact us using the details at the end of this notice. Requests are free in normal circumstances. We respond without undue delay and within one month, and we will tell you if a lawful extension applies. If we cannot do what you asked, we explain why and how to challenge that. You can complain to us at [dpo@wren-data.co.uk](mailto:dpo@wren-data.co.uk) or at our postal address. We acknowledge privacy complaints within 30 days, investigate without undue delay and explain the outcome. You can also complain to the Information Commissioner’s Office at [https://ico.org.uk/make-a-complaint/](https://ico.org.uk/make-a-complaint/) or 0303 123 1113, whether or not you come to us first. ## 11\. How long we keep information Our [Data Retention Policy](/legal/retention/) sets out the period for each category. In summary: **Database records.** We keep active personal information for as long as it is necessary for the purposes in this notice, subject to ongoing review. That depends on the person’s continuing business association, the accuracy and relevance of the information, and any objection or other request. **Former contacts.** Where someone has left a business, we keep their name, email address and original business-contact details for **three years** in a separate former-contact database. We use those details only to match records, suppress the former contact, prevent re-acquisition and help customers identify that a contact in their own file is no longer at that business. We do not provide those former-contact details back to customers; where relevant, we provide only a flag or status indicating that the contact no longer appears to be at that business. **Suppression records.** We keep minimal email opt-out information indefinitely, so we can continue to honour the objection and stop the record being reintroduced. This is deliberately the smallest set of identifiers needed. **Operational records.** Purchased export files expire 30 days after the order date, though this does not affect copies a customer has downloaded. Order identifiers are kept for 365 days to support suppression, and a minimal disclosure and suppression record is kept beyond that, as described in section 9. Pulse uploads and their outputs are deleted after 30 days. Article 14 delivery logs, verification-call transcripts and inbound call recordings are kept for 30 days. Opt-out form IP addresses and any optional name are kept for 90 days. Security logs are kept for one year. General customer account records and support messages are kept for six years. Privacy complaints and rights-request records are kept for ten years from case closure so we can evidence how they were handled if there is a later complaint, dispute or regulatory issue. Invoice and accounting records are kept for ten years from invoice date for accounting, tax, audit and legal-defence purposes. **Backups.** Database backups are kept for two years. They do not include Pulse files, export files or call recordings. **Dissolved businesses.** We keep dissolved-business identifiers and associated historical company/contact state indefinitely for suppression and matching, including to help customers identify records that should be removed or treated as inactive. We do not supply dissolved businesses as active or current records. ## 12\. Security We use encryption in transit and at rest, MFA enabled by default, passkey options, database backups, monthly security testing and incident-response arrangements. These measures reduce risk, but no measure can guarantee that every incident is prevented. We do not currently hold an independent security certification. Personal contact rows are encrypted with contact-specific keys. When an opt-out applies, we delete the contact from the single source of truth and permanently destroy the relevant key, so encrypted copies of those contact rows in backups cannot be recovered. Dependent records, indexes and derived data are updated or removed through our overnight processing. The minimal suppression identifiers are held separately, so that we can continue to honour the request. Destroying a contact key does not erase customer account records, information kept as evidence for legal claims, or suppression records, which are held separately for the purposes described above. ## 13\. International transfers Our database is hosted in the UK, in Microsoft Azure UK West with replication to UK South. Our AI models run on Azure infrastructure we control, so chat messages and call content are not sent to any third-party AI provider. Some providers may process information, or allow access to it, outside the UK. Where a transfer is subject to UK transfer rules, we rely on an appropriate route — UK adequacy regulations, or contractual safeguards with the required assessment and any additional protections. You can ask us about the safeguards relevant to your information and how to get a copy, subject to necessary redactions. Further provider details are set out in our [Sub-processor Register](/legal/sub-processors/). ## 14\. Changes to this notice We update this notice when our processing changes, and we give appropriate notice of material changes. A revised notice does not itself create consent or authorise a new use. The current version and effective date appear at the top of this page. ## 15\. Contact us For privacy questions or to exercise your rights: - **Email:** [dpo@wren-data.co.uk](mailto:dpo@wren-data.co.uk) - **Telephone:** 0161 524 8524 - **Post:** WREN TECHNOLOGIES LTD, 128 City Road, London, EC1V 2NX, United Kingdom — marked “Data protection” To opt out an email address without giving a reason: [https://optout.wren-data.co.uk](https://optout.wren-data.co.uk) You can also complain to the Information Commissioner’s Office at [https://ico.org.uk/make-a-complaint/](https://ico.org.uk/make-a-complaint/) or 0303 123 1113.