Data provenance and compliance

Who is behind MyDataHub?

Other, unrelated businesses also use the name MyDataHub, so we introduce it as MyDataHub by Emailmovers.

What is in place, and what is planned?

Trust claims are only useful if they are true on the day you read them. Each row below says whether the item exists today or is planned, and planned dates are targets, not promises.

How do we answer the ICO's seven due diligence areas?

The ICO says that accepting a data broker's assurances is not enough. So every MyDataHub record carries the evidence for each of the seven due diligence areas below, and you can check it from a sample record.

The wording of each area is ours. The ICO's own wording is in its guidance for organisations using data brokers.

What does every record carry?

Every preview row, order record, lookup and enrichment response carries a compliance object. The same fields appear as CSV columns and as the MyDataHub property group on a CRM push.

Companies House officer names are personal data outside the Open Government Licence, so they carry an Article 14 status instead of the licence attribution.

What does every count and order show?

Every count returns a compliance summary beside the number, so you can reason before you spend.

Every order also issues a compliance receipt, signed as a JWS with ES256, with a PDF twin. Anyone can verify a receipt without an account through POST /v1/compliance/receipts/verify, which returns whether it is valid, whether the order exists, when the licence ends and whether it was revoked.

Where does the data come from?

Contacts, titles, named emails, direct phones and sites come from Emailmovers' own research. Company facts come from Companies House under the Open Government Licence v3.0, and places come from the ONS Postcode Directory under the same licence.

The UK business database page lists each source with its licence and cadence.

What is the legal position?

1. PECR regulation 22 protects individual subscribers only. People at companies, LLPs, Scottish partnerships and public bodies can be emailed without consent, and sole traders and ordinary partnerships cannot.
2. A named work email is personal data, so our lawful basis is UK GDPR Article 6(1)(f), legitimate interests, with an assessment planned for publication by 30 November 2026. Since 5 February 2026 direct marketing is an example of a legitimate interest.
3. Because we obtain data indirectly, Article 14 requires privacy information within one month, or at first communication if sooner.
4. Everyone has an absolute right to object to direct marketing, honoured within one month and kept by suppression rather than erasure.
5. Live calls must not go to TPS or CTPS numbers without consent, and a screen lasts 28 days. The PECR fine ceiling is £17.5 million or 4 percent of worldwide turnover since 5 February 2026, and a statutory complaints procedure applies from 19 June 2026.

The guide explains each point and links the ICO sources.

How are objections and suppressions handled?

A buyer reports an objection with one call and gets a suppression id and a time. An objection to a licensee suppresses the record for that organisation at once, and an objection to us suppresses it database-wide within one working day.

Database-wide suppressions reach every licensee through a signed webhook, a property on a CRM push and a pull endpoint. Suppressed records never appear in counts or orders, and we keep only a hash.

Where is data held, and who processes it?

The residency statement we publish is this, and nothing broader:

Data is held in the UK (Google Cloud London). Email addresses are verified in the EU by Millionverifier, with some verification traffic passing through US providers under standard contractual clauses. Telephone numbers are checked by Telnyx in the United States under the UK Extension to the Data Privacy Framework. Every telephone number is screened against the TPS and CTPS each night through a licensed screening service based in the UK, which processes the numbers in the UK. Payments are processed by Stripe.

The statement describes the service at launch, and the hosting it names is a condition of launch. The sub-processor page lists each vendor with its purpose, location and transfer mechanism.

How are emails and phone numbers verified?

That is about 6.2 million email checks a year for 1.6 million addresses. Every telephone number is screened against the TPS and CTPS each night through a licensed screening service, and carries its status and the date of that screen, valid for 28 days.

Which quality figures do we publish?

We publish these numbers with their dates, and we never publish an accuracy percentage without a measured audit behind it. Coverage by field, such as direct phone, mobile, postal address and Companies House number, is published with each dataset version's changelog.

What is the warranty?

Today's policy replaces the affected records when hard bounces exceed 10 percent of an order. A stricter policy is proposed and is not current. It would replace or re-credit any hard bounce within 30 days automatically, exclude catch-all addresses unless you opt in and cap the payout at 10 percent of an order.

Which datasets exist?

How is security handled?

These are our specified controls. A row marked Specified is a design commitment for launch, and Target and Planned rows are not yet complete.

What are the resilience targets?

Measured performance is published on the status page, not here. A target is not a measurement.

Frequently asked questions

Is Emailmovers registered with the ICO?

Yes. Emailmovers Ltd is registered with the Information Commissioner's Office under Z9714386, and the registration renews on 18 December 2026. The register entry is public.

Where is the data held?

Data is held in the UK (Google Cloud London). Email addresses are verified in the EU by Millionverifier, with some verification traffic passing through US providers under standard contractual clauses. The sub-processor list gives the full statement.

Which security certifications do you hold?

This page claims no certification until its register entry exists. Cyber Essentials is planned for October 2026, and ISO 27001:2022 for the fourth quarter of 2027. The table above shows every target and its date.

Do you sell data scraped from LinkedIn or intent data?

No. We never resell intent, technographic or LinkedIn-derived data. Our signals come from the Companies House register, each with its source and date.

How do I stop receiving marketing that uses my details?

You have an absolute right to object to direct marketing. Tell the organisation that wrote to you, and it must stop within one month. Objections reported to us are suppressed for every licensee.