1. Who we are
WhoBuys is a product of Falcon Creative Ltd, a company registered in England and Wales under company number 17413303. Falcon Creative Ltd is the data controller for the personal data described in this policy.
You can contact us about anything in this policy at [email protected].
2. What this policy covers
This policy explains how we handle personal data in two distinct situations: when you contact us through this website, and when business contact information appears in the WhoBuys index itself. These are treated separately below because they involve different people and different purposes.
3. Information you give us through this website
If you submit the request form, we collect the information you enter:
- Your name and job role
- Your company name
- Your business email address
- Your stated intended use and the licence tier you are interested in
We use this only to respond to your enquiry, to send the sample and licensing information you asked for, and to have any follow-up conversation about that enquiry. We do not add you to a marketing list, and we do not sell or rent your details.
Lawful basis: our legitimate interests in responding to a business enquiry you have chosen to send us. You can object to this at any time, and we will stop.
4. Information in the WhoBuys index
The index is a business-to-business dataset about organisations, not about individuals as consumers. For each organisation it records details such as the organisation name, sector category, headquarters location, a business contact route such as a switchboard number or website, a modelled estimate of annual print spend, and the job title of the role likely to hold the relevant budget.
The index is built from publicly available and published sources. Where a record includes information that identifies an individual — for example a named role holder — that information constitutes personal data, and the following applies:
- Lawful basis: our legitimate interests, and those of our licensees, in business-to-business commercial communication. We have considered the impact on the individuals concerned, and the data is limited to professional, work-related information.
- No special category data. The index does not contain health, biometric, political, religious or similar sensitive categories, and it does not contain personal financial information about individuals.
- Right to object. If you are named in the index and do not want to be, email [email protected] and we will remove you from the master file and notify current licensees of the removal.
Spend figures are modelled estimates produced from public indicators of organisational scale. They are not confirmed financial data, are not obtained from the organisations concerned, and should not be read as statements of fact about any organisation's actual expenditure.
5. Licensees' own obligations
Organisations that licence the index become independent data controllers in respect of how they use it. Each licensee is responsible for its own compliance with UK GDPR, the Privacy and Electronic Communications Regulations, and any marketing rules that apply to its outreach. Our licence terms require lawful use, but we do not control and cannot be responsible for how a licensee contacts anyone.
6. Website technical data
This site is served through Cloudflare, which processes technical information such as IP addresses and request details in order to deliver the page and protect against abuse. We do not run advertising trackers, analytics profiling or third-party marketing cookies on this site.
7. Who we share information with
We use a small number of service providers who process data on our behalf:
- Formspree — receives and forwards submissions from the request form
- Zoho Mail — hosts our email, so correspondence with you is stored there
- Cloudflare — hosts and serves this website
We do not sell personal data. We may disclose information where we are required to by law.
8. International transfers
Some of the providers above operate outside the UK. Where personal data is transferred internationally, we rely on the transfer mechanisms those providers put in place, such as the UK International Data Transfer Addendum or equivalent standard contractual clauses.
9. How long we keep it
Enquiry correspondence is kept for as long as needed to deal with the enquiry and any resulting commercial relationship, and for a reasonable period afterwards for record-keeping and legal purposes. Records relating to a completed licence are kept for six years in line with normal UK business record retention. You can ask us to delete your enquiry sooner.
10. Your rights
Under UK GDPR you have the right to ask us to:
- confirm what personal data we hold about you, and give you a copy
- correct personal data that is inaccurate or incomplete
- erase your personal data in certain circumstances
- restrict how we use it while a concern is investigated
- object to our use of it where we rely on legitimate interests
- receive it in a portable format, where that right applies
Email [email protected] to make a request. We aim to respond within one month, as UK GDPR requires. There is normally no charge.
11. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.
12. Changes to this policy
We may update this policy as the product develops. The date at the top of the page shows when it was last changed.