Data Sources & Your Rights

1. Who this notice is for

This notice is given under Article 14 of the UK GDPR to the people whose personal data appears in the business records we hold: sole traders, partners, people named in a business role on a business website, and anyone whose name forms part of a business email address. It forms part of our Privacy Policy.

Most of the information we hold is about businesses, not people. Information about a limited company is not personal data, but the details of a sole trader or partnership, or a named business email address, can be. We treat them with that care.

2. Who is responsible for your data

MIRA NOVUM LTD, company number 17465260, whose registered office is at 128 City Road, London, United Kingdom, EC1V 2NX, is the controller. ICO registration number: registration in progress. You can contact our compliance team at compliance@miranovum.com about anything in this notice.

3. What we hold

Business-context information: business name, category and niche, business address (the town, postcode district and region are shown publicly; the full street address is part of the paid record), business phone numbers and messaging numbers, business email addresses (for example info@ addresses or a named address published on a company website), website, contact pages, links to official social profiles that the business links to, opening hours, the languages and locations it publishes, company registration details where published, website technology and health checks, AI-generated classifications and summaries, and indicative lead scores. Each field keeps the date it was last checked.

For email addresses we hold the result of our checks (for example whether the mail server accepts mail, or whether the address is a role, free webmail or disposable address) and the date of the check. For websites we hold whether the site responds and the technologies it uses.

4. What we do not collect

We do not knowingly collect home addresses kept for private purposes, personal mobile numbers published only for private purposes, dates of birth, identity documents, financial account details, special category data (such as health, religion or ethnicity) or information about criminal offences. We do not collect private social media activity, followers or other social metrics, and we do not show ratings or reviews.

We show company register details only about the company itself and never protected or residential details about the people connected with it.

5. Where it comes from

From public business websites, the structured data published on those websites, official business registers and AI analysis. All of it is publicly accessible information that businesses publish so that they can be found and contacted. We also hold corrections and labels that a verified owner of the business gives us.

Further source categories help us keep records accurate and complete: business details that users of our browser extension and desktop app share with us after the app read them on the business’s own public website (on a free account, sharing is a condition of using the signed-in apps; on a paid plan it is a choice), and business records the desktop app builds from the public pages of business websites, all of which wait in review and are checked against other sources before they are used; organisations that our planning module finds in open registers and public sources, labelled to be verified until we have checked them; and the technical delivery results of messages our customers send through the Service, for example that a mail server reported an address as not existing, or that a reply came back from it and when. We do not keep the content of those messages.

Information from official business registers is used under the terms of the licence that applies to it; for UK company register data, that is the Open Government Licence, and we use the register to confirm a company’s status, registered name and incorporation date. We do not take the names, addresses or dates of birth of directors, secretaries or people with significant control from the register. Each field in our records keeps a reference to its source, and if you ask for a copy of your data, our answer gives the actual source of each value we hold about you (the page address or the register it came from, with the date we collected or last checked it), not just a description of the kind of source.

6. Why we use it and our lawful basis

We compile business records so that businesses can find and contact other businesses for relevant business purposes: buying and selling, supply and distribution, partnerships and collaborations, recruitment of business partners, research and planning, and checking their own business lists. We also publish a free public directory so that anyone can find businesses by category and place.

Our lawful basis is legitimate interests (Article 6(1)(f) of the UK GDPR): our interest, and our customers’ interest, in business to business commerce and communication, and the interest of listed businesses in being found. We have carried out a legitimate interests assessment, which concluded that these interests are not overridden by the rights of the people concerned as long as our safeguards stay in place. A summary of it is published on our website.

7. How we protect the people listed

Contact details are masked on public pages and shown only to registered customers who unlock or export a record. Before they do, customers confirm that they act as independent controllers, will have a lawful basis, will identify themselves, offer an opt-out and respect objections, and will screen numbers against the telephone preference registers before marketing calls.

Customers receive a licence that allows use only inside their own business and forbids resale and consumer targeting. Named and free webmail addresses are flagged so buyers can exclude them. Businesses whose verified owner has chosen labels such as “No Sales Pitches” are left out of every export and campaign. Removed records are suppressed so they are not collected or supplied again.

8. Automated processing and scores

We use automated processing and AI to classify businesses, summarise the information they publish, check that email addresses and websites respond, and calculate indicative lead scores (such as the Mira Novum Score, Commercial potential, Completeness, Verification, Freshness and Lead priority). These scores describe business records for comparing and prioritising leads; they are not decisions about any person and have no legal or similarly significant effect on anyone. AI-generated fields are labelled in the product.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you within Article 22 of the UK GDPR. A missing piece of information earns no points and is shown as not checked, never as a failed check.

If you think a score for your business is wrong, tell us at compliance@miranovum.com or through Help and support in your dashboard. A member of our team reviews the score and the evidence behind it within 30 days, corrects any evidence that is wrong and tells you the result. Verified owners can ask for a breakdown of how each score for their business was calculated.

9. Who receives it

Registered customers who unlock or export a record, or receive it through our API, under a licence that limits use to their own business and requires them to comply with UK GDPR and PECR. Customers on some API plans may show records inside their own product to their own customers, under the same obligations, which they must pass on, but may not pass records on as lists or files.

Our processors, such as hosting, storage, email verification and email delivery providers, under contracts that protect the data. Professional advisers, regulators, courts and law enforcement where the law requires it. A buyer or successor of our business, under the same protections as this notice.

10. International transfers

Some of our processors may store or access data outside the UK, and some customers who obtain records are based outside the UK. Where we transfer data outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Customers outside the UK are responsible for complying with the law that applies to them and with our licence.

11. How long we keep it

We keep a business record while the information remains publicly available and relevant to business contact. Records are re-checked on a rolling schedule. Records that fail quality checks (for example an expired or parked domain) are excluded from sale for 90 days and checked again before they can return, and closed or removed businesses are excluded from search, exports and the API.

Results of our checks (domain screening, registry, email and website checks) are kept with the record only as a generic outcome and its date, for example "no adverse finding as of" a date or "excluded: parked domain". Each result is replaced when the check runs again and is deleted with the record. We do not store the raw answers that checking services give about a business. A domain excluded after a quality check stays on our suppression list for 90 days.

When a business asks to be deleted, we delete the record and keep only a suppression entry (the domain, email addresses and phone numbers needed to recognise it) for 5 years, so that it is not collected or supplied again. Records of the request and how it was verified are kept for 6 years as evidence that we acted on it.

12. Your rights

You have the right to object to our processing at any time. Because the purpose of our database is to enable business contact, we treat an objection from a listed person as a request to stop supplying their details, and we act on it. You also have the right to access a copy of your data, to have it corrected, to have it erased, and to restrict its use while a concern is checked.

You can use these rights free of charge. We respond within one month, or within the extended time the law allows for complex requests, in which case we tell you why. We may need to check that a request comes from the business or person concerned, so that competitors cannot remove a business.

13. How to remove, hide or correct your details

Use the form at /data-removal. You do not need an account. Find the business, then enter an email address on the business’s own website domain or an address we already hold for it. We send a six-digit code, valid for 15 minutes, and ask for a second detail we hold, such as the postcode district or the last four digits of a listed phone number.

You can then choose to delete the record, to hide the full street address or the phone numbers (they stay hidden on every update of the record), or to send a correction for our team to review. If you cannot receive email at the business, email compliance@miranovum.com and we will verify the request by hand. We confirm receipt straight away and act on verified requests within 30 days, usually within two working days.

14. If you run the business: verify instead

If you would rather stay listed but control how you are contacted, you can claim the profile for free at /verify-my-business. Verified owners can correct details, add a description, and choose how they may be contacted (open, only through our platform or their website form, one channel only, or no cold email or calls) and which topics they do not want. Buyers see the choice with every record and must follow it; businesses that choose no cold contact are left out of every export and campaign on our platform. Without claiming, you can also object to direct marketing on /data-removal: the listing stays, and nobody can export or contact the business through our platform. Verifying is never a condition of removal, and you can remove the record at any time.

15. If someone contacts you using our data

Customers who obtain records from us are independent controllers and must identify themselves, explain where they obtained your details and offer an easy way to object. If you no longer wish to hear from them, tell them directly; they must stop and keep you on their suppression list. Removing your record from our database stops future supply, but copies obtained earlier are under the customer’s control.

If a customer ignores your objection or contacts you in a way you think breaks the law, please tell us at compliance@miranovum.com with the details. We investigate reports and can suspend customers who break our Acceptable Use and Anti-Spam Policy.

16. Complaints

Please contact us first at compliance@miranovum.com so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, website ico.org.uk. If you live in the European Union, you can complain to the data protection authority in your country.