Privacy Policy

Who we are

Datuma is a UK-based contact data cleaning service operated from datuma.co.uk by DATUMA LTD, a company registered in England and Wales under company number 16428722, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. DATUMA LTD is registered with the Information Commission (formerly the Information Commissioner's Office) under registration number ZC209580. This policy covers the datuma.co.uk website, the free check, the work we run for you, and the company research we do for business clients. For the technical controls that back this policy, see our Security page. For all privacy queries, contact support@datuma.co.uk.

What data we collect via the website

When you contact us, ask for a check, or become a customer, we collect:

• Your name
• Your work email address
• Your organisation name
• What you tell us in the message, including a call slot preference where you give one
• The contact spreadsheet you send us for processing (which may include names, email addresses, phone numbers, job titles, LinkedIn URLs, and organisation names).

We also collect standard server and analytics information (request logs, page views, approximate location from IP) to operate and secure the site.

The forms on this website are protected by Cloudflare Turnstile, an anti-abuse check that tells us a form was completed by a person rather than a script. To do that, Cloudflare processes your IP address and signals about your browser when the form page loads. It runs only on the pages that carry a form. Cloudflare states that it uses these signals solely to detect and block automated visits, not to identify, profile or target individuals, and that it also uses them to improve its own bot detection.

What data we process during enrichment

When a contact spreadsheet is processed (for a free check, or for a paying client), minimal identifiers from each row (name, email, LinkedIn URL where present) are sent to our contact-data enrichment provider for lookup. The provider returns professional and organisational data, which Datuma uses in its checks and writes into the result.

Depending on the features enabled for a given account, enrichment may also include:

• Business email validation: a deliverability check on a business email address, returned as a status (for example, verified or undeliverable).
• Personal mobile number: where this feature is enabled, a personal mobile number associated with a business contact, together with the date it was found and the category of source.
• Phone number verification: where this feature is enabled, a liveness check on a phone number in the file you sent us, returned as a status (for example, live and reachable).

For paying clients, the enriched records are held in the account we run the work in and retained as set out in the retention annex of our Data Processing Terms. That account sits in the same European Union environment as every other, in a logically separated tenancy enforced at the database row level, which is the arrangement described in our Data Processing Terms.

Where enriched contact data comes from

Some contact details in an enriched record (including business email deliverability status and, where enabled, a personal mobile number) are not collected from the individual directly. They are sourced from third-party contact-data providers. These providers collect information that is publicly available or has been made public by the individual, or obtain it from suppliers who have confirmed a lawful right to share it.

On request, we will tell an individual the category of source for a given record and, where available, the immediate source of that record. Individuals can ask us to access, correct, or delete their data, or object to its processing, using the contact details below. Who answers depends on how the data reached us, as the Your rights section below explains.

If we contact you about our own service

We sometimes contact people at organisations we think could use Datuma, to tell them about the service. For that we hold your name, job title, organisation, work email address and professional profile link, where we have them, and a record of our contact with you. We do this under our legitimate interest in telling organisations about a service relevant to their work. These details are not taken from any file a customer sends us.

If you tell us you do not want to hear from us, we stop, and we record that you have opted out so that we do not contact you again. You can tell us by replying to any message from us, by using the unsubscribe link in any email we send you, or by writing to support@datuma.co.uk. You can also ask us what we hold about you, or ask us to delete it.

If we research you for one of our business clients

We research UK companies for business clients who sell to them, and identify the senior people at those companies who are likely to make or influence a buying decision. If you are one of them, we may pass your work details to that client so that it can contact you about products relevant to your organisation. These details are not taken from any file a customer sends us.

What we hold: your name, job title, organisation, work email address, a phone number where we find one (which may be a mobile), your professional profile link and the roles it shows, and a record of where each detail came from and when we checked it.

Where it comes from: the Companies House register, your organisation's own website, a professional-profile data provider, and contact-data providers that find work email addresses and phone numbers. We check that an email address accepts mail and that a mobile number is live on the network, and we screen phone numbers against the Telephone Preference Service registers before we pass them on.

Who receives it: the business client we did the research for, which has confirmed to us in writing that it will use your details only for legitimate business purposes. Our providers process your details for us to carry out these checks. Once the client has your details, it is responsible for them, and it must give you its own privacy information at the latest when it first contacts you.

Why, and our legal basis: our legitimate interest, and our client's, in reaching the right people at organisations for which a product is relevant. We have weighed that interest against your rights: we use only work details, in your professional capacity, and you can stop it at any time.

How long we keep it: we delete our copy within 30 days of passing it to the client.

Your right to object: tell us at support@datuma.co.uk and we stop. We record your objection so that we do not pass your details to a client again, and we tell any client we have already given them to. You can also ask us what we hold about you and where it came from, or ask us to correct or delete it.

Data retention

• The file you send us: deleted 30 days after it enters our systems, by a scheduled sweep that runs daily across all accounts. It does not wait for a request from you.
• The contact records derived from your file: kept while we are working together, so that a later check can be compared with an earlier one. There is no automatic deletion after a fixed period. They are deleted when you ask us to, and when our engagement ends. A separate copy of what we handed back for each contact is deleted automatically 365 days after the check that produced it, by the same scheduled sweep as the file you send us; the contact records, and the check results held on them, are not.
• The result files we produce for you: kept while we are working together. There is no automatic deletion after a fixed period. They are deleted when you ask us to, and when our engagement ends.
• When our engagement ends: several items above are kept while we are working together and deleted when our engagement ends. Our engagement ends when you tell us in writing that you want no further work from us, or when we tell you in writing that we will take no further work from you.
• Personal mobile numbers: where this feature is enabled for an account, a personal mobile number is held on the contact record and is purged alongside the rest of the contact record. A later check never reuses a number looked up more than 90 days earlier.
• Free check data: a free check is run separately from all other work. Everything for it, including the file you sent, the records derived from it and the result files, is erased 7 days after the last thing happens in it: 7 days after we run the check, or 7 days after the file arrives if we never run it. That happens automatically, whether or not anyone asks, and it cannot be reversed. It is shorter than every other period on this page, and it applies to everything for that free check rather than to a single file. Separately, we keep a short record of the request for a free check (your name, work email, organisation and what you agreed to) for 12 months as the record of your instruction, and then delete your name, email and organisation from it. If the free check leads to an order, that record is kept with the order instead.
• Cached lookup results: a cached result is treated as out of date and re-checked after 90 days. Cached role and organisation lookups are deleted after 180 days, by a sweep that runs weekly. Cached email deliverability results and the identity match records used to recognise the same contact across full checks have no fixed deletion date. All of them are removed for your records on account erasure, and on request, as set out in Annex 2 of our Data Processing Terms.
• Enrichment API provider: retains the minimal lookup identifiers for the term of the agreement and deletes them within 60 days of termination, under its published data processing terms.
• Email-verification provider: retains email addresses sent for deliverability validation solely to perform the check, and deletes them on termination. Results are stored only in your isolated records in Datuma's EU environment.
• Phone-verification provider: where phone verification is enabled, phone numbers sent for a liveness check are retained by the provider solely to perform the check, for up to 30 days. On termination all data is deleted under the DPA. Results are stored only in your isolated records in Datuma's EU environment.
• Paying clients: retention is set out in the retention annex of our Data Processing Terms. Their records are held in the European Union in a logically separated tenancy, on the same infrastructure described above.

Third-party processors

We rely on the following infrastructure partners to deliver the service and the website:

• Supabase: PostgreSQL database hosting. Your file and the records derived from it are stored in Ireland. Some limited access and transfers happen outside the UK and EU, and section 5 of our Data Processing Terms lists them.
• Google Workspace: hosts our business email. A file sent to us by email, and any written instruction or correspondence, is received and stored in our mailbox until we delete it (Irish contracting entity; no data region is configured for our account, so mailbox content may be processed where the provider or its sub-processors maintain facilities, under its transfer instruments).
• Contact-data enrichment provider: professional and organisational data enrichment. It processes the lookup identifiers we send on our instructions, as our sub-processor (EU SCCs Module 3, processor to processor, with the UK Addendum), and acts as a controller in its own right for the results it compiles and returns from its own database (Module 1).
• Email-verification provider: email deliverability validation for business addresses (EU region).
• Phone-verification provider: mobile number liveness validation, where this feature is enabled (UK-domiciled, under DPA).
• Resend: transactional email delivery for results and notifications, including the email that returns finished files. A US provider: we send from its Ireland region, but it stores account data, message metadata and logs in the US whatever region is selected.
• Language-model provider (diagnostics only): where a processing run fails, and only where this diagnostic feature is switched on for our account, a short diagnostic summary (identifiers, the error message, counts, recent log lines; no contact records) is sent to draft an internal diagnosis for our operator. Its published position for its programming interface is that inputs and outputs are deleted within 30 days of receipt, subject to four exceptions it publishes: a service with longer retention under the customer’s control, a separately agreed retention arrangement, retention needed to enforce its usage policy, and retention required by law. Where its automated systems flag a submission as a usage policy violation it retains inputs and outputs for up to two years, and classification scores for up to seven. That is its published position and not a commitment given to us.
• Language-model provider (engineering and operations assistant): our director uses an AI coding assistant to run and maintain the service. For routine work it connects through a dedicated read-only database account that can read only counts, statuses, dates, amounts and identifiers (an account identifier can contain a person’s name), not contact records. A contact record is read only by the director, deliberately, to fix a fault in that customer’s own batch. Other database credentials exist on the same computer, so beyond that account the director’s rules and permissions, not the database, keep the assistant away from contact records. It is never given a customer’s file. What the provider keeps is set by its published terms for the plan we use.
• GoCardless: payment and any Direct Debit mandate for paying clients. A UK-regulated payment institution acting as a controller in its own right, not our sub-processor: it receives the billing contact and bank details of the organisation that pays us, never a customer file or any record derived from one.
• Netlify: website hosting for datuma.co.uk.
• Cloudflare: Turnstile anti-abuse check on the forms on this website, processing visitor IP address and browser signals (US provider under Cloudflare's data processing addendum, certified under the EU-US Data Privacy Framework including the UK Extension).
• Plausible Insights OÜ (Estonia): website and internal admin page analytics. Cookieless, no contact data, IP addresses hashed transiently and not retained (European Union).

See /subprocessors for the current sub-processor list, and our Data Processing Terms for the contractual annex stating each provider's location and transfer mechanism.

Cookies

datuma.co.uk uses a minimal set of cookies. We do not set third-party tracking or advertising cookies. Any cookies used are strictly essential for the site and its forms to function.

Your rights

Under UK and EU data protection law, you have the following rights in relation to personal data we hold about you:

• Right of access
• Right to rectification
• Right to erasure
• Right to data portability
• Right to object to processing
• Right to restrict processing

To exercise any of these rights, email support@datuma.co.uk.

Who handles a data-rights request. If your details reached us in a file one of our customers sent us, that customer is the controller and decides what happens to them. We will tell you to contact that customer, and we will tell the customer about your request promptly, as our Data Processing Terms require. For personal data we hold as a controller, including your details as a customer or enquirer, results our contact-data enrichment provider has returned to us, your details if we have contacted you about our own service, and your details if we have researched you for a business client, we will answer you ourselves.

Complaints. If you are unhappy with how we have handled your personal data, please tell us at support@datuma.co.uk so that we can look into it. We acknowledge a complaint within 30 days of receiving it. You also have the right to complain at any time to the Information Commission (formerly the Information Commissioner's Office), the UK supervisory authority for data protection, at ico.org.uk.

Legal basis for processing

• The contact records in a file you send us, for a free check or a full check: we process them as your processor, on your instructions, under our Data Processing Terms. The lawful basis for that processing is yours as the controller, and you confirm you have one when you instruct us.
• Results our contact-data enrichment provider returns: as our Data Processing Terms explain, once these reach us we hold them as a controller in our own right. Our basis is our legitimate interest in checking business contact data accurately for the customers who instruct us, balanced against the rights and reasonable expectations of the individuals concerned. Individuals can object to this processing at any time using the contact details below.
• Your own details as a customer or enquirer (when you write to us, ask for a check, order or pay): our legitimate interest in answering you, doing the work you asked for and keeping a record of what we agreed. Where we must keep accounting records, our legal obligation to keep them.
• People we contact about our own service: our legitimate interest in telling organisations about a service relevant to their work, as described above.
• People we research for a business client: our legitimate interest, and our client's, in reaching the right people at organisations for which a product is relevant, as described above.
• Website operation and security: legitimate interest in running a secure, functioning site.

International transfers

Where personal data is transferred outside the UK or the European Economic Area, transfers take place under EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) supplemented by a UK International Data Transfer Addendum, or under the EU-US Data Privacy Framework where a provider holds a current certification. Our contact-data enrichment provider receives lookup identifiers as our processor, under the Module 3 (processor to processor) clauses with the UK Addendum; the results it returns from its own database come back under the Module 1 (controller to controller) clauses. The full transfer position for each provider is stated in Annex 1 of our Data Processing Terms.

Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page shows when it last changed. Material changes will be reflected here before they take effect.

Contact

For any privacy or data protection query, email support@datuma.co.uk.