Privacy policy

Version 1.0, effective 1 November 2026

Published by Emailmovers Limited, company 05046417, registered office 33-35 Exchange Street, Driffield YO25 6LL. ICO registration Z9714386.

This version lives at emailmovers.com/privacy/ and, once a later version replaces it, at emailmovers.com/privacy/v1/. It replaces every earlier Emailmovers privacy policy.

1. Who we are

Emailmovers Limited (“we”, “us”) is a UK business-to-business data company. We compile and own a database of UK business contacts, and we license it to businesses for their marketing, including through MyDataHub. We also run email campaigns and other data services for business customers.

We are the controller of the personal data this notice describes, unless we say otherwise.

Contact us about your personal data:

• email [email protected];
• call 01723 800030;
• write to Emailmovers Limited, 33-35 Exchange Street, Driffield YO25 6LL.

Our data protection lead is Duncan Gledhill, Director. You can reach them at [email protected]. We have not appointed a data protection officer.

2. Who this notice covers

Sections 8 to 16 apply to everyone.

When we process data for a customer, for example a list they ask us to clean or send to, or a suppression list they upload to MyDataHub, we act as that customer’s processor. The customer’s own privacy notice then applies, not this one.

3. People in our business contact data

This section tells you what we hold about you if your business details are in our database, and what you can do about it.

3.1 What we hold

About you in your business role:

• your name, job title, job function and level of seniority;
• your business email address;
• your business telephone numbers;
• your business postal address;
• the address of your public professional profile, such as LinkedIn, which we use to check your details.

About your company: its name, Companies House number and status, industry code, size, addresses and website.

About how we handle your details:

• where each detail came from, and when we last confirmed it;
• whether and when we sent you our notice about this processing, which version, and whether it bounced or you objected;
• the results of checks on your email address and telephone numbers, with their dates;
• the TPS and CTPS status of each telephone number, with the date of the screen;
• whether your organisation is a corporate or an individual subscriber, which decides whether it may receive marketing email without consent;
• whether you are on our suppression list, and why;
• which of our customers have licensed your details, and when, so that we can pass on your objection to them.

We do not hold special category data, such as health or political opinions, about you. We do not keep personal email addresses, home addresses, dates of birth or similar private details from our sources.

3.2 Where your details come from

• Companies House, the public register of companies, for company details and the names of company officers.
• Our own research. We use AI tools to read and index public company websites. We use Anymailfinder to find a business email address from a person’s name and company. We use our own email pattern recognition tool, which works out a company’s email address format.
• RampedUp Inc, a business data company in the United States, from which we buy business contact data outright.
• You, if you contact us or update your details.

We add new data about four times a year. We may also buy details we do not yet hold from RampedUp when a customer orders them.

Some older records came from our former 5mins business directory.

3.3 Our notice to you

When we add your details, we email you a short notice that says who we are, what we hold and why, and how to object. If you object, or the email bounces, we remove your details before we make them available.

When we buy details for a particular customer’s order, we wait at least 48 hours after sending the notice before we supply them, so that you have time to object.

Where we hold no email address for you, for example as a company officer listed at Companies House, we tell you about our processing through this published notice, because writing to each person by post would take effort out of proportion to the benefit. You can object at any time.

3.4 What we do with your details, and why

Our legitimate interests are running a business data company, helping businesses find business customers, and respecting objections. The law gives direct marketing as an example of a legitimate interest. We have weighed these interests against your rights. We think they are not overridden because:

• we hold only details about your business role;
• we tell you about the processing and make objecting easy;
• by default we supply email addresses only for people at companies and other corporate bodies, whom businesses may email without prior consent;
• we screen telephone numbers against the TPS and the CTPS each night, and update our suppression list each night;
• our customers must keep to a licence that limits their use and makes them act on objections.

You can ask us for our legitimate interests assessment at [email protected].

We check email addresses with verification services, and sometimes by sending an email to the address. We check telephone numbers for their line type and network, and against the TPS and the CTPS.

3.5 Who receives your details

• Our customers. UK businesses that license your details through MyDataHub or from our team. Each becomes a controller of its copy and uses it under a licence for business-to-business marketing; in MyDataHub the licence lasts 12 months. Each must give you its own privacy information when it first contacts you. It must act on your objection, and on the objections we pass to it.
• Data partners. We license our data to credit reference and business information companies, and to a data supplier’s count platform. They may supply it to their own business customers under their own privacy notices. You can ask us which companies have received your details at [email protected].
• Our service providers. They process your details for us, under contract, to host our database and check your details. Our sub-processor page, emailmovers.com/trust/sub-processors/, lists them.
• RampedUp Inc. We send it the email addresses on our suppression list, so that it does not supply them to us again.
• Anymailfinder. When we use it to find an email address, it also keeps addresses it finds or confirms for its own service, as a separate controller under its own privacy policy.

3.6 How long we keep your details

We keep your details while they are accurate and useful for business marketing. We check them regularly. We remove details that we find are out of date, for example an email address that fails our checks twice, or when we learn that you have left the company. If we cannot confirm a record for 3 years, we delete it.

If you object, we keep the minimum we need to make sure you are not contacted again: your name, business email address, job role, company and business landline number. We keep this for as long as we trade.

3.7 Your right to object

You can object to direct marketing at any time, and we will always stop. You do not need to give a reason.

• Use the unsubscribe link in any email from us.
• Use emailmovers.com/unsubscribe/.
• Email [email protected], call 01723 800030, or write to us.

What happens next:

• we stop marketing to you straight away;
• our suppression process removes you from all our systems by the next night;
• MyDataHub stops including you in counts and orders;
• we tell every customer that holds your details under licence, and they must stop too.

You can also ask us to delete you from our suppression list. If you do, we may receive your details again from a source and contact you, as we will have no record of your objection.

4. Customers and MyDataHub account holders

4.1 What we hold

• your name, work email address, role in your organisation’s account, and the organisation’s business name and confirmation that it is a UK business;
• billing details, such as a billing address and VAT number, and payment references. Stripe handles card details; we do not receive full card numbers;
• quotes, orders, credits, receipts and invoices;
• agent keys and the budgets set for them;
• saved audiences, alerts, suppression lists and settings;
• which versions of our terms, agreements and this notice you accepted, and when;
• sign-in events and security logs, including IP addresses and browser details;
• your messages to us.

4.2 Why, and our lawful basis

You must have a work email address to open an account. We refuse personal email domains.

4.3 Who processes it for us

• Google Cloud hosts MyDataHub in London.
• Resend sends emails from mydatahub.emailmovers.com, such as sign-in links and receipts.
• Stripe takes card payments for us. Stripe also uses payment information for its own purposes, such as preventing fraud and meeting its legal duties. For those purposes Stripe is a separate controller, under its own privacy notice at stripe.com/gb/privacy.
• Our company-wide services in section 8, such as Xero for accounts and PandaDoc for contracts.

4.4 How long we keep it

• Account details: while the account is open, and for 6 years after it closes.
• Orders, payments and invoices: six years after the end of the financial year they belong to, as tax law requires.
• Records of what you accepted: 6 years after the agreement ends.
• Security logs: 30 days.

Customers of today’s MyDataHub at app.mydatahub.uk carry on under their current agreements. It is run for us by a hosting supplier in the United Kingdom.

5. Visitors to our website

5.1 Our website and cookies

Cloudflare hosts emailmovers.com. Like any web server, it receives your IP address, the pages you ask for, and your browser’s details, to deliver the site and keep it secure. We do not receive or keep logs of individual visits; Cloudflare keeps its own security logs under its terms. Our lawful basis is legitimate interests.

We use only strictly necessary cookies unless you choose otherwise. Our cookie banner offers “Reject all” beside “Accept all”, and nothing optional runs before you choose. We run no analytics today. Our cookie policy at emailmovers.com/cookies/ lists every cookie.

5.2 Forms

When you send a quote request, a contact form or a data health report request, we receive the details you give: usually your name, company, email address, telephone number and message. The form passes through our own service to Salesforce, our customer records system, and we keep no copy on the way. We use your details to answer you. Our lawful basis is legitimate interests, or taking steps you have asked for before a contract.

5.3 Our newsletter

If you sign up for Emailology, our newsletter, we record your email address, your consent, the wording you agreed to and the time. Our lawful basis is consent. You can unsubscribe at any time from any issue.

5.4 The unsubscribe page

If you use emailmovers.com/unsubscribe/, we use the email address you give only to stop marketing to it, as section 3.7 describes.

5.5 Our chat

The chat runs only after you turn on functional cookies.

• An AI assistant answers first. Anthropic provides the AI. Your messages pass through our own chat service, hosted by Google Cloud, to Anthropic, which writes the replies.
• Our chat service keeps the conversation in memory for 30 minutes, then it is gone. It does not write the conversation to disk.
• Anthropic deletes messages it receives through its API within 30 days, unless they are flagged for breaking its usage policy, when it may keep them for up to 2 years, or the law requires it to keep them longer.
• You can ask for a person at any time. A member of our team answers from Monday to Friday, 09:00 to 17:30 UK time, and sees the conversation so far. Outside those hours we offer our telephone number and a message form, which works as section 5.2 describes.
• If you ask for a sample of our data, MyDataHub emails a confirmation link to the address you give.

Please do not type personal details into the chat. Counts and prices need none. Our lawful basis is legitimate interests: answering your questions.

When one of our team takes over a chat, we do not keep the conversation afterwards either. If they need to follow up, they note what is needed in our customer records.

6. Calls, emails, meetings and messages

When you contact us or we contact you, we keep your details and what was said or written, so we can deal with it and keep a record.

• Telephone. Dial9 runs our telephone calls. We record all calls to and from our team, and tell you at the start of the call. Groq transcribes the recordings for us. We keep recordings and their transcripts for 12 months, longer only where one is needed for a complaint or a dispute.
• Email and files. Google Workspace hosts our email and files.
• Meetings. Fireflies records and transcribes online meetings, and Google Workspace may take meeting notes. We record an online meeting only if you agree. The recorder joins as a participant named Fireflies, and you can ask us to stop it at any time.
• Messages. We use WhatsApp Business with some contacts, and Slack within our team.
• Customer records. We keep records of our dealings with customers and prospects in Salesforce.

Our lawful basis is legitimate interests: running our business, answering you and keeping records. Where a call or message relates to a contract with you, it is also contract.

We keep correspondence and call records for 6 years for customers, and as section 7 says for others. We keep requests about personal data, such as access and deletion requests, for six years.

7. Our own marketing

We send business-to-business marketing about our services to customers and to people in their business roles, by email, telephone and post. We send marketing email through Instiller.

For people at companies and other corporate bodies our lawful basis is legitimate interests. For our newsletter, and for anyone at a sole trader or ordinary partnership, we email only with consent. Every marketing email has an unsubscribe link, and you can object at any time as section 3.7 describes.

We keep details of prospects who have never bought from us for 3 years after our last contact, after which we keep only a do-not-contact record.

8. Services we use across the company

These providers process personal data for us under contract. Our sub-processor page, emailmovers.com/trust/sub-processors/, lists the providers for MyDataHub, our contact data and our website in more detail.

9. Other people we may share with

• Our accountants, lawyers, auditors, insurers and bank, where they need it to advise or serve us.
• The police, regulators, courts and other authorities, where the law requires or allows it, for example to prevent fraud.
• A buyer of all or part of our business, who would use your details as this notice describes.

10. Transfers outside the UK

Some providers process personal data outside the UK, as section 8 and our sub-processor page show. When they do, we rely on:

• UK adequacy regulations, for countries in the European Economic Area;
• the UK Extension to the EU-US Data Privacy Framework, for US organisations certified under it;
• otherwise, the ICO’s International Data Transfer Agreement, or its Addendum to the EU standard contractual clauses.

Ask us for a copy of the safeguard for any transfer.

11. Security

We protect personal data with technical and organisational measures that suit the risk. They include limiting access to people who need it, encrypting data in transit, hosting MyDataHub in Google Cloud’s London region, and contracts that bind our providers to protect it. No system is completely secure, so if you think your data is at risk, tell us at [email protected].

12. Your rights

You have the right to:

• ask for a copy of your personal data, and how we use it;
• have inaccurate data corrected;
• have your data deleted, in some cases;
• restrict how we use it, in some cases;
• object to how we use it. Your right to object to direct marketing is absolute;
• receive data you gave us in a portable form, where we rely on consent or contract;
• withdraw consent at any time, where we rely on it;
• complain to us, and to the Information Commission (the ICO).

To use a right, contact us as section 1 shows. We may ask you to confirm who you are before we act. We reply within one month. If a request is complex, we may take up to two more months, and we tell you why within the first month. We do not usually charge.

13. Complaints

If you are unhappy with how we have used your personal data, please tell us first. Our complaints page, emailmovers.com/complaints/, explains how to complain and what we do. We acknowledge every complaint within 24 hours, or by the end of the next working day if it reaches us at a weekend or on a bank holiday.

You can also complain to the Information Commission, the UK regulator for data protection, at ico.org.uk.

14. Automated decisions

We do not make decisions about you by automated means that have a legal or similarly significant effect on you. We sort and group business contacts by details such as job title, level and industry, so that customers can find the right people. This does not affect you in that way.

15. Children

Our services are for businesses. We do not knowingly collect data about anyone under 18.

16. Changes to this notice

We review this notice at least once a year. Each version has a number and an effective date, and lives at its own URL. Earlier versions stay at stable archive URLs, such as emailmovers.com/privacy/v1/ for this one. If we make a material change, we email MyDataHub account holders before it takes effect.