Privacy notice regarding Data HQ business database

Privacy Notice for our Business Database

Last updated: August 2026

This privacy notice explains how Data HQ Limited collects and uses business contact information for our business-to-business database and related data and marketing services.

Much of this information is not collected directly from the individual concerned, so this notice is provided in accordance with Article 14 of the UK General Data Protection Regulation (UK GDPR).

Who we are

Data HQ Limited is the controller of the personal data described in this notice.

Data HQ Limited
Company number: 04193862
Registered office: 46–54 High Street, Ingatestone, Essex, CM4 9DW

Our Data Protection Officer is the Managing Director.

You can contact us about privacy or data protection matters at:

Email: info@datahq.co.uk
Telephone: 01245 807470

What information we hold

Our database, Vista, is a business-to-business database containing information about UK organisations and people working within them.

Depending on the organisation and the individual, we may hold some or all of the following:

  • name;
  • job title, job function or business role;
  • employer, organisation or trading name;
  • business address;
  • company identifiers and registration information;
  • industry, employee size, turnover and other business or firmographic information;
  • business email address; and
  • business telephone number.

Where an organisation is a corporate body, we may hold business contact information relating to individuals working for it.

For sole traders and other individual subscribers, we do not include personal telephone numbers or personal email addresses for unsolicited electronic marketing.

We do not intentionally collect or maintain special category personal data, such as information about health, ethnicity, religion, political opinions or sexual orientation, as part of Vista.

Where we obtain the information

We obtain and verify information from a combination of licensed, publicly available and proprietary business data sources.

These may include:

  • the public Companies House register;
  • Dun & Bradstreet Limited;
  • public company and organisational websites;
  • publicly available business directories;
  • public business pages and professional information made available on social media platforms; and
  • our own research and verification processes.

Information from different sources may be matched and combined to help us improve the accuracy and completeness of the database.

We do not telephone individuals for the purpose of researching and building individual contact records for Vista.

Why we use the information

We use business data for a number of related purposes, including to:

  • build, maintain, verify and update our Vista B2B database;
  • identify relevant organisations and business decision-makers;
  • produce and license B2B marketing data to business customers;
  • select relevant business audiences for managed marketing campaigns, including campaigns delivered through our Dynamo platform;
  • provide data matching, validation, cleansing and enrichment services;
  • support services such as VistaConnect, including business-data searching, matching and enrichment;
  • analyse business markets, sectors and audiences;
  • maintain suppression records and honour objections and marketing preferences; and
  • market Data HQ's own relevant B2B products and services.

Where we process information supplied to us by a customer solely on that customer's instructions - for example as part of certain data audits, cleansing or enrichment projects - Data HQ may act as a processor rather than a controller in relation to the customer's original data. That processing is governed separately by our agreement with the customer.

Our lawful basis

For the business database activities described in this notice, we generally rely on legitimate interests under Article 6(1)(f) of the UK GDPR.

The legitimate interests include:

  • Data HQ's legitimate commercial interest in operating and maintaining a B2B information and marketing-data business;
  • helping businesses identify and communicate with relevant organisations and business decision-makers;
  • enabling accurate B2B data matching, validation and enrichment; and
  • our customers' legitimate interests in promoting relevant products and services to other organisations.

We have carried out a Legitimate Interests Assessment considering the necessity of the processing, the nature of the information involved, the reasonable expectations of business contacts and the potential impact on individuals.

We consider that the processing is proportionate because the information relates to individuals in their professional or business capacity, we limit the types of information we hold, individuals can object at any time, and we operate suppression and preference controls.

Where you become a Data HQ customer, we may also process information where necessary to enter into or perform a contract with you.

Direct marketing and PECR

Data protection law and the Privacy and Electronic Communications Regulations 2003 (PECR) apply differently depending on the type of organisation and the method of communication used.

We take these requirements into account when determining whether particular contact channels may be used.

We also operate suppression and preference controls, including appropriate screening where telephone marketing is involved.

Our customers are responsible for ensuring that their own marketing activity complies with applicable data protection and electronic marketing law.

Who we share information with

We may share business contact information with business customers operating across standard UK industry sectors where they have licensed or purchased relevant data from us.

These customers may use the information to identify and communicate with organisations that may have an interest in their products or services.

Where we disclose personal data to a customer, that customer normally becomes an independent controller of the information it receives and is responsible for its own subsequent use of that data.

We also provide managed marketing services such as Dynamo. In these circumstances, relevant Vista records may be selected and used by Data HQ to deliver campaigns on behalf of a customer without the underlying contact data being disclosed to the customer.

We may also disclose information to service providers that help us operate our systems and deliver our services, including hosting, security, communications, payment and technology providers.

These providers are permitted to process personal data only for the relevant service and subject to appropriate contractual and security requirements.

We may also disclose information where required by law, regulation or a competent authority.

Where your information is stored

Our principal systems and business database are hosted using Microsoft Azure services in the United Kingdom.

We use technical and organisational security measures designed to protect personal data, including access controls, multi-factor authentication and appropriate security controls for our systems and services.

Some technology suppliers may provide support or other limited processing from outside the United Kingdom. Where an international transfer of personal data takes place, we use appropriate safeguards as required by UK data protection law, such as an adequacy regulation or approved contractual transfer mechanisms.

How long we keep information

We aim to keep Vista accurate and up to date.

We normally retain a business contact record while the individual appears to remain relevant in that professional role or at that organisation.

Information may be updated, replaced, removed or suppressed when we obtain evidence that it is no longer accurate or relevant.

If you object to the use of your information, we may retain a minimal suppression record rather than deleting every reference to you. This allows us to recognise your details and ensure that you are not subsequently re-added to the database or used for the purpose to which you have objected.

Your rights

Depending on the circumstances, you have rights under data protection law including the right to:

  • request access to the personal data we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase your personal data in certain circumstances;
  • ask us to restrict the way we process your information;
  • object to processing based on legitimate interests; and
  • object to the use of your personal data for direct marketing.

You have an absolute right to object to the use of your personal data for direct marketing. If you object to direct marketing, we will stop using your information for that purpose.

The right to data portability does not generally apply to the processing described in this notice because our principal lawful basis is legitimate interests rather than consent or contractual necessity.

We may need to verify your identity before responding to a rights request.

To exercise your rights, contact:

Email: compliance@datahq.co.uk

or write to:

Data Protection Officer
Data HQ Limited
46–54 High Street
Ingatestone
Essex
CM4 9DW

How we provide this information when we did not obtain your data directly

Much of the information in Vista is obtained from sources other than the individual concerned.

Article 14 of the UK GDPR requires us to provide privacy information within a reasonable period after obtaining personal data and, at the latest, within one month, at the time of our first communication with the individual, or before the information is first disclosed to another recipient, depending on which applies first.

We use a combination of measures to provide transparency about our processing.

These include:

  • maintaining and publishing this privacy notice;
  • requiring customers receiving business contact data from us to provide appropriate transparency about the source of the information when they first use it;
  • identifying Data HQ as the source of data where appropriate;
  • providing access to this notice when we communicate directly with an individual; and
  • maintaining clear mechanisms through which individuals can object, request information or have their details suppressed.

Because Vista contains a large number of business records obtained from a combination of public and licensed business sources, we have assessed the practicality and proportionality of individually contacting every person immediately when a record is first obtained.

Where we rely on the UK GDPR provisions relating to disproportionate effort, we take other appropriate measures to protect individuals' rights and interests, including making this notice publicly available and providing straightforward ways for individuals to find out what information we hold and object to its use.

Objecting or asking us not to use your information

If you do not want your personal information included in Vista or used for B2B marketing purposes, you can contact us at any time.

Email compliance@datahq.co.uk with "Do not contact" in the subject line and provide enough information for us to identify the correct record, normally:

  • your name;
  • organisation; and
  • business postcode or other information that will help us locate you.

We will suppress the relevant record from future marketing use and data licensing as appropriate.

Maintaining a suppression record is important because simply deleting the record completely could allow the same information to be collected again from another source.

Complaints

If you have a concern about how we use your personal data, please contact us first and we will try to resolve it.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
www.ico.org.uk

Changes to this notice

We may update this privacy notice from time to time to reflect changes to our services, processing activities, legal requirements or business practices.

The date at the top of this page shows when the notice was last updated.