Privacy policy
Last updated: 11 October 2026
1. Who we are
POLICYANDPLAY LTD, a company registered in England and Wales (company number 17253846). Registered office: 7 Cosford Drive, Shortstown, Bedford MK42 0DQ, United Kingdom. ICO registration: ZC165321. Email: [email protected]. We trade as Regional Commerce Data. We are not VAT registered.
We are the data controller for everything on this page. This policy covers regionalcommercedata.co.uk and the alert domains that redirect to it.
2. What we collect and why
| Data | Why | Lawful basis | How long |
|---|---|---|---|
| Email, region, optional trade (free list) | Send the free weekly trade pulse | Consent | Until you unsubscribe, then deleted within 30 days |
| Email, trades, region (paid products) | Take payment, match and deliver your lead, intel or pack | Contract | Life of the subscription plus 30 days |
| Payment and order records (amount, date, Stripe customer and subscription IDs; Stripe holds card details, we never see them) | Accounts, tax, refunds, disputes | Legal obligation, contract | 6 years |
| Your answers to the checkout acknowledgements | Proof of what you agreed | Legal obligation, legitimate interests | 6 years |
| Emails you send us | Support, refunds, data requests | Legitimate interests | 3 years after the last message |
| Server logs (IP address, request, time) | Security and fixing faults | Legitimate interests | Up to 30 days |
| Saved trade and region choices, dashboard access token (stored in your own browser) | Remember your settings on your device | Strictly necessary / you asked for it | Until you clear your browser data |
We do not use advertising, tracking or analytics cookies. See the cookie policy.
3. Marketing emails
The free weekly list is sent only if you tick the box and ask for it. Paying customers get the product they bought, plus the odd service email about their account. Every email has an unsubscribe link. You can also email us. We do not send marketing to anyone who has not asked for it or bought from us.
4. Who we share it with
We never sell personal data. These providers process it for us:
- Netlify (US) — hosting and the functions that run the site
- Supabase — database for subscriber profiles, subscriptions and match data
- Stripe (US) — card payments and subscription billing
- Resend (US) — sending and unsubscribe handling for our emails
- eBay — we may query its public listings API for job-lot examples. No personal data about you is sent.
Companies House and the Gazette are sources of public information, not processors. We take data from them (see section 12). We pass nothing to them about you.
We may also disclose data where the law requires it, or to our professional advisers.
5. International transfers
Some providers are in the US. We rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or on the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
6. Retention
The periods are in the table in section 2. Company-register data is covered in section 12. When a period ends we delete the data or strip out anything that identifies a person.
7. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or move it to someone else. You can object to our use of your data, including for direct marketing at any time, and withdraw consent whenever you like. You have rights around automated decisions. We make none that have legal or similarly significant effects on anyone. Email [email protected]. We reply within one month.
8. Complaints
If you're unhappy with how we've handled your data, email [email protected] with "Data protection complaint" in the subject. We'll acknowledge within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
9. Cookies
See our cookie policy.
10. Children
This is a business service. It is not directed at anyone under 18 and we do not knowingly collect children's data.
11. Changes
If we change this policy in a way that matters, we will update the date above and, if you have a subscription, email you.
12. Notice about data from public registers (UK GDPR Article 14)
Our products are built from public registers. This section is for people whose details appear in them and who have not dealt with us directly.
| Who is the controller | POLICYANDPLAY LTD (details in section 1). |
|---|---|
| Where the data comes from | The Companies House register (via its public API) and The Gazette (insolvency and other statutory notices). Both are public by law. We also run public search links to help buyers check a company, but we do not scrape private sources. |
| What we hold | Company name, company number, status, incorporation date, SIC codes, registered office address or locality, and insolvency or strike-off notices. These cover limited companies, LLPs and the like. A company name or registered office can identify a person, for example a sole director who uses a home address or a company named after its owner. We do not supply director names, personal phone numbers or personal email addresses in our products. |
| Why we use it | To build lead lists, market summaries and weekly packs that help businesses find customers and suppliers, and to spot distressed firms. |
| Lawful basis | Legitimate interests. Ours and our customers' interest is in B2B market intelligence and sales prospecting. Because the data is already public and limited to business facts, the impact on individuals is low. We have weighed that against your rights. |
| Who receives it | Our paying customers, by email, in the packs and leads they buy. Our processors in section 4. |
| How long we keep it | We keep a company record for as long as the company's entry is useful for current packs, reviewed at least once a year, and delete it sooner if you object successfully. Copies already delivered to customers are theirs to handle under our acceptable use rules. |
| Your right to object | You can object at any time. We will remove the record from future products unless we have compelling grounds not to. |
| How to opt out of being included | Email [email protected] with "Remove" in the subject and the company number. We do not need ID for a company record, but we may check you are connected to the company. The register itself is run by Companies House and we cannot change it. Contact them to correct or restrict what they publish. |
| Complaints | As in section 8. |
We do not tell each person individually when we add a company to our data, because the information is already public and doing so would take disproportionate effort. This notice is how we make it available.