Privacy Notice

About this notice

This notice explains how Data Forest Ltd handles personal information under applicable UK data-protection and electronic-marketing laws.

It covers information collected directly from people and information obtained from other sources, including public business sources and authorised data suppliers. It applies when Data Forest Ltd acts as a controller and determines why and how personal information is used.

“Personal information” means information relating to an identified or identifiable living person. A named business email address, business telephone number or professional profile may be personal information even when used in a business context.

Who we are

Data Forest Ltd provides business data, B2B contact-list, market-research, lead-generation and digital-marketing support services.

Data Forest Ltd is an active private limited company incorporated in England and Wales on 3 September 2025.

Who this notice applies to

This notice may apply to:

Our services are intended for organisations and business professionals. We do not knowingly design B2B datasets for children and do not intentionally collect children’s information for business marketing.

Information we use

Depending on the relationship and service, we may use the following categories:

• Identity data: name, professional title and business role.
• Business contact data: work email, business phone number, business address and professional profile link.
• Organisation data: company name, website, sector, size, location and other business characteristics.
• Event and professional-interest data: business event, conference, trade-show, industry or role associations where lawfully obtained.
• Customer and enquiry data: requirements, correspondence, quotations, sample requests, contracts and service history.
• Transaction data: invoices, payment status and transaction references. Full card information is normally handled by the payment provider rather than stored by us.
• Technical data: IP address, browser, device, security logs and website interactions.
• Marketing data: communication history, preferences, objections, unsubscribe status and campaign interaction information.
• Rights and complaint data: request details, identity-verification information and our response record.

Where information comes from

We may receive personal information from:

• You directly, including through forms, emails, calls, orders and privacy requests.
• Public business sources, such as corporate websites, public registers, professional directories, exhibitor or sponsor directories, published event materials and other publicly accessible business information.
• Authorised data suppliers and research partners that contractually confirm they are permitted to provide the information.
• Customers, when they provide targeting requirements, suppression information or data for a contracted service.
• Service providers, such as website, analytics, security, CRM, communications and payment providers.
• Derived information, such as standardised job functions, industry categories, duplicate indicators and verification status produced from existing business information.

Where reasonably possible, we record or retain information about the source or source category. If you ask where we obtained your information, we will provide the available source information, subject to applicable legal limitations and the rights of others.

How and why we use information

We identify a lawful basis for each purpose. The basis depends on the information, relationship, communication channel and recipient.

Where we rely on legitimate interests, the relevant interests may include operating a B2B information service, helping organisations identify relevant professional audiences, maintaining accurate records, developing customer relationships, protecting our services and preventing misuse. We assess necessity, reasonable expectations and potential impact before relying on this basis.

B2B data and direct marketing

UK rules distinguish between corporate subscribers and individual subscribers. The applicable rule depends on the recipient and the communication method.

Corporate subscribers

For email marketing to corporate subscribers, such as limited companies and limited liability partnerships, PECR does not generally require prior consent. The sender must identify itself and provide a valid way to opt out. Where a message uses a named employee’s details, UK data-protection law still applies and a lawful basis is required.

Sole traders and certain partnerships

Sole traders and some partnerships are treated similarly to individual subscribers under PECR. Email or text marketing generally requires valid consent unless the limited “soft opt-in” conditions apply.

Telephone marketing

Telephone campaigns must follow applicable PECR rules, including relevant Telephone Preference Service, Corporate Telephone Preference Service, caller-identification and prior-objection requirements.

How business-contact data is disclosed or licensed

Because Data Forest Ltd provides B2B data services, we may license or supply relevant business-contact data to customers for defined business purposes. We do not describe this activity as merely “sharing with processors”; it is part of the service we provide.

Before supplying data, we may take steps such as:

• reviewing the customer’s organisation, intended audience and stated purpose;
• limiting data fields to those reasonably relevant to the project;
• applying suppression, objection and quality controls;
• requiring contractual restrictions on use, security, onward disclosure and compliance;
• prohibiting spam, unlawful discrimination, harassment and use for purely personal or household purposes; and
• suspending or ending access where misuse is identified.

A customer receiving business-contact data will generally act as an independent controller for its own subsequent use. The customer must identify its own lawful basis, comply with PECR and other applicable marketing rules, provide required privacy information, honour objections and maintain appropriate security.

Service providers and other recipients

We may disclose information to appropriate categories of recipients, including:

• hosting, cloud-storage, backup and website-technology providers;
• CRM, email, telephone, communications and customer-support providers;
• data-validation, hygiene, research and quality-control providers;
• analytics, security, anti-fraud and incident-response providers;
• payment processors, banks, accountants, auditors and professional advisers;
• B2B customers receiving licensed data as described above;
• potential buyers, investors or advisers involved in a genuine corporate transaction; and
• courts, regulators, law-enforcement bodies and public authorities where disclosure is required or permitted by law.

Processors acting on our behalf are required to follow contractual data- protection, confidentiality and security obligations. We do not authorise them to use personal information for unrelated independent purposes.

International transfers

Some customers or service providers may be located outside the United Kingdom, or may process information using infrastructure located outside the UK. A transfer outside the UK is made only where a lawful transfer mechanism is available.

Depending on the destination and arrangement, safeguards may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved EU Standard Contractual Clauses;
• another legally approved safeguard, together with any required transfer-risk assessment; or
• a limited statutory exception where legally available and appropriate.

You may contact us for further information about the transfer mechanism relevant to your personal information. Commercially confidential details and information affecting the rights of others may be redacted.

How long we keep information

We keep personal information only for as long as it is reasonably needed for the relevant purpose, legal obligations, disputes, security and the exercise or defence of legal claims. Retention is reviewed using the criteria below.

When information is no longer required, we delete it, securely dispose of it, anonymise it, or restrict it where retention is still legally necessary.

How we protect information

We use proportionate technical and organisational measures designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

Measures may include:

• role-based access controls and least-privilege access;
• password, authentication and account-management controls;
• encryption in transit and, where appropriate, at rest;
• secure backups, malware protection and system monitoring;
• supplier due diligence and contractual safeguards;
• data minimisation, masking, validation and suppression controls;
• staff confidentiality and privacy-awareness measures; and
• incident assessment, response and notification procedures.

No internet or storage system is completely secure. We therefore cannot guarantee absolute security, but we review measures in light of risk, available technology, implementation cost and the nature of the information.

Cookies and similar technologies

Cookies and similar technologies may store or access information on your device. They can support essential website functions, preferences, security, analytics and advertising.

The preference control on this page stores your selection locally. It does not itself activate third-party analytics or advertising scripts. Website administrators must configure those scripts so they load only after the appropriate consent signal.

Your data-protection rights

Your rights depend on the circumstances and lawful basis. They are not all absolute, and legal exemptions may apply.

How to exercise a right

Email info@dataforest.uk and describe the right you wish to exercise. You may also telephone or write to us using the details in this notice.

We may ask for information reasonably necessary to confirm identity or locate the relevant records. We will not request excessive identification where we already have enough information.

We normally respond without undue delay and within one month of receiving a valid request. The period may be extended where the request is complex or multiple requests are made, where the law permits; if so, we will explain the extension.

Data-protection complaints

You may complain if you believe we have handled your personal information unfairly, inaccurately, unlawfully or without appropriate security, or if you are dissatisfied with our response to a rights request.

How to complain to Data Forest Ltd

Email info@dataforest.uk with the subject “Data protection complaint”. Please explain what happened, the information involved, the outcome you seek and any relevant dates or evidence.

In line with current UK requirements, we will:

• provide a clear way to make a data-protection complaint;
• acknowledge receipt within 30 days;
• take appropriate steps to investigate without undue delay;
• keep you appropriately informed; and
• communicate the outcome without unjustifiable or excessive delay.

Complaining to the ICO

You may also raise a concern with the Information Commissioner’s Office, the UK supervisory authority. We encourage you to contact us first so we have an opportunity to investigate and resolve the matter.

ICO information and complaint services are available at ico.org.uk/make-a-complaint.

Contact details and changes to this notice

Questions, rights requests, objections and complaints may be sent to:

We may update this notice when our services, processing activities, suppliers or legal obligations change. Material changes will be highlighted where appropriate. The current version will be published on this page with an updated review date.

Earlier versions may be requested by emailing us. Continued website use does not replace any consent that is legally required for a specific processing activity.