This draft for the United Kingdom has not yet been reviewed by a lawyer and is not in force. Passages marked TO CONFIRM: … are to be clarified by the operator or by the lawyer.
The company database contains details of businesses in the United Kingdom. Some of them are sole traders or partnerships; their details relate to natural persons and are personal data. The same applies to named contact persons and to email addresses that contain a person’s name. Details of limited companies and other legal persons are not personal data under the UK GDPR. Public availability does not permit unrestricted reuse.
Martin Adamec is the controller for the database processing. Contact details are given below.
Depending on the source and the agreed export: business name, business address, postcode, nation, business category, industry, published business phone number, email address and website and, where a record is matched with Companies House, legal form, company number, company status and UK SIC code. A business address may also be a sole trader’s home address. We do not process special categories of data under Art. 9 UK GDPR.
Source categories are open map data (Overture Maps, licence CDLA Permissive 2.0), the details that businesses publish themselves on their websites (in particular email addresses) and the public register of Companies House (free data product: company number, company type, status and SIC codes). As of 4 November 2026, Overture Maps has been processed, reading of websites is in progress and the Companies House matching is in progress. The data sources and methodology page gives details; we will tell you the origin of your record on request.
The purpose is to structure business information and to provide agreed exports to businesses for market analysis, territory planning, maintaining customer data and addressed postal mailings. An export is neither consent to marketing nor proof of reachability. Under the Privacy and Electronic Communications Regulations 2003, marketing emails and texts to sole traders and partnerships in England, Wales and Northern Ireland need prior consent or a soft opt-in (regulation 22(3)), and live marketing calls must not be made to numbers registered with TPS or CTPS (regulation 21); we point this out to our customers.
For personal business data, Art. 6(1)(f) UK GDPR is intended as the legal basis: the interests of the operator and its customers in reliable business information. Necessity and the impact on data subjects must be assessed for the specific source, fields and use. Safeguards are data minimisation, source limits, rectification, objection and suppression. TO CONFIRM: legitimate interests assessment for sole traders and partners, in light of the ICO guidance on direct marketing and on business-to-business marketing (not opened from our server).
Recipients may be business customers receiving the agreed fields, necessary hosting and IT providers, professional advisers and competent authorities. Customers are responsible for their own processing and have their own information and data subject obligations.
The controller is established in the European Economic Area. A personal-data export to a recipient outside the UK and the EEA requires a case-by-case assessment and a transfer mechanism under Chapter V UK GDPR or Chapter V GDPR. A purchase alone does not justify disclosure.
Business records are kept only as long as necessary and lawful, taking into account the currency of the source, changes, objections and legal obligations. Outdated details are corrected or removed. Minimal suppression identifiers are kept so that a record is not added again after an objection.
You can request access including the origin of the data, rectification, erasure, restriction and, where applicable, data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation, and to use for direct marketing at any time without giving reasons (Art. 21 UK GDPR); that use then ends. Use the opt-out form or write to info@firmdat.co.uk. We generally reply within one month.
You can lodge a complaint with the Information Commissioner’s Office in the United Kingdom (ico.org.uk), with the Czech Office for Personal Data Protection (uoou.gov.cz) or with any other competent supervisory authority (Art. 77 UK GDPR, Art. 77 GDPR).
Where Art. 14 UK GDPR applies, data subjects must be informed individually and in good time: generally within one month, earlier where applicable at first communication or disclosure. This page supplements that obligation and does not automatically replace individual information. TO CONFIRM: whether and for which records an exemption under Art. 14(5) UK GDPR can be relied on, and how individual information is otherwise provided.
These details are updated when sources, purposes or processing change significantly. The current version date is shown above.
Martin Adamec
Mírová 1541, 516 01 Rychnov nad Kněžnou, Czech Republic
IČO: 19552319
info@firmdat.co.uk
Legal notice · Terms · Privacy policy · Opt out · Data sources and methodology
