Privacy

Business contacts we hold and may email

Who we are. FreshlySpotted is run by NIMBUS LABS LTD (company 17530252), 124-128 City Road, London EC1V 2NX. We are the controller of this information. Contact: support@nimbus-labs.co.uk. FreshlySpotted is part of the Nimbus Labs Group (NIMBUS LABS LTD). ICO registration number: ZC280192.

Who this is about. Directors and staff of newly formed companies that we may email once, after outreach starts, to tell them about FreshlySpotted.

We will only email you once outreach starts, and every email will let you opt out.

What we hold. Your name, your role (for example director), your work email address, and your company's name, number, registered address and date of formation. We will also record when we email you and whether you reply or ask us to stop.

Where we got it. Your name, role and company details come from the public Companies House register. Your work email address comes from business contact data providers (Hunter), which find or check work addresses from public business sources. Some work addresses come from a business contact database shared across the Nimbus Labs Group, built from the business's own website.

Why, and our legal basis. To tell new businesses about a service that may help them. Our legal basis is legitimate interests (UK GDPR Article 6(1)(f)): our interest in direct marketing to businesses. We have done a legitimate interests assessment (LIA) and weighed our interest against yours: we only use work details, and we stop as soon as you ask. You can ask us for a copy of the LIA. We only hold, and will only email, details of limited companies and LLPs. We don't collect, and will not email, details of sole traders or partnerships.

Who we share it with. Only our service providers who help us send and store email (for example our email provider and data providers above), under contract. We don't sell your details. Hunter Web Services, Inc. (USA; servers in Belgium, transfers under Standard Contractual Clauses plus the UK International Data Transfer Addendum) finds and checks business email addresses. Google Workspace (Google LLC, USA) handles our email. Transfers are covered by the UK-US data bridge and Google's data processing terms.

How long we keep it. We delete your details 12 months after we collected them, unless you have become a customer. If you ask us not to contact you, we keep only your email address and company number on our do-not-contact list so we don't contact you again, for as long as needed to honour your request.

Your right to object. You can object to marketing at any time and we will stop: reply "stop", use the unsubscribe link, or email us. We act on any request to stop or delete within 7 days. Our do-not-contact list is shared across all Nimbus Labs Group brands, so if you opt out of one, none of our brands will contact you.

Your other rights. You can also ask to see, correct or delete your data, or restrict how we use it. We reply within one month. If you're unhappy, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Do you have to give us anything? No. We didn't get this from you, and you don't have to do anything.

Customers

Who this is about. People who sign up for, pay for or use a FreshlySpotted account for their business.

What we hold. Your name, work email address, company name and billing address. Your Stripe customer ID and payment IDs. We never see or store full card numbers; Stripe handles those. Records of when you sign in and how you use the service.

Why, and our legal basis. To run your account, take payment and send service emails. Basis: contract (UK GDPR Article 6(1)(b)). To keep tax and accounting records. Basis: legal obligation (Article 6(1)(c)), under the Companies Act 2006 (section 388) and HMRC rules. To keep the service secure and prevent fraud and misuse. Basis: legitimate interests (Article 6(1)(f)).

Payments. Stripe (Stripe Payments UK Ltd and Stripe, Inc.) processes payments for us as our processor. Stripe also acts as a separate controller for its own fraud prevention and regulatory duties. See Stripe's privacy policy: https://stripe.com/gb/privacy. Where Stripe sends data to the US, it relies on the UK-US data bridge and/or the UK International Data Transfer Addendum to Standard Contractual Clauses.

Other service providers. Our email provider (Google Workspace (Google LLC, USA), covered by the UK-US data bridge) sends service emails. Cloudflare, Inc. hosts the site and service, under its data processing terms (UK-US data bridge and Standard Contractual Clauses with the UK Addendum). They act only on our instructions. We don't sell your details.

How long we keep it. Account and usage details: while you have an account, then deleted within 12 months after it closes. Sign-in and security logs: 12 months. Invoices, payment and tax records: 6 years after the end of the financial year they relate to.

Emails. We send service emails you need: receipts, price-change notices, account and security messages, and the Monday email you subscribed to. We may also send news about our products. The law does not require consent for this to company email addresses, but every marketing email lets you opt out, and you can email us any time. Opting out of marketing won't stop service emails.

Your rights. You can ask to see, correct or delete your data, restrict or object to how we use it, or get a copy to move elsewhere. We reply within one month. We may need to keep some records the law requires. If you're unhappy, you can complain to the ICO: ico.org.uk/make-a-complaint, 0303 123 1113.

Do you have to give us anything? We need your name, email, company and billing details to open and bill your account. Without them we can't provide the service.