Privacy Policy

1. Who we are

Peach Data is a trading name of Meridian Interface Ltd, a company registered in England and Wales (Company No. 16150489). Our registered address is Park House, Wilmington Street, Leeds, LS7 2BP.

We operate a B2B data intelligence platform, collecting and supplying verified contact data about UK businesses to sales organisations.

For data protection enquiries, contact us at: privacy@peachdata.co.uk

2. What data we hold and where it comes from

Peach Data compiles business contact information about UK businesses from the following categories of publicly accessible sources:

• Statutory public registers: director and founder names, registered company addresses, company status and incorporation dates published on official government registers
• Regulatory and licensing records: business name, address and compliance data published under statutory mandate
• Public business directories: business name, address, phone number and category information voluntarily published by business owners

The data we hold includes: business name, business address, postcode, city, phone number, owner or director name, email address (where publicly available), business category and business registration details.

All data relates to individuals in their capacity as business owners, directors or founders of UK commercial enterprises. We do not collect or process consumer personal data, sensitive personal data or data relating to children.

3. Our legal basis for processing

We process personal data under Article 6(1)(f) of the UK GDPR: Legitimate Interests.

Our legitimate interests are: compiling accurate, publicly available B2B contact data to enable sales organisations to identify and contact relevant UK businesses efficiently.

We have conducted a Legitimate Interest Assessment (LIA) confirming that:

• Our purpose is genuine and relevant to lawful commercial activity
• Processing is limited to the minimum data necessary
• All data is sourced from public registers where business operators have a reasonable expectation of commercial use
• The processing does not override the rights and freedoms of data subjects, who are acting in a commercial capacity
• Safeguards are in place including opt-out mechanisms, suppression lists, and TPS/CTPS screening

A copy of our LIA is available on request at privacy@peachdata.co.uk.

4. How we use the data

We use the data we hold to:

• Compile territory based record packages for sale to B2B sales organisations (including POS vendors, payment processors and other technology vendors)
• Provide downloadable datasets via our customer portal
• Maintain data accuracy through regular review and re-verification
• Operate our suppression list to honour opt-out requests

We do not use the data for consumer marketing, profiling, automated decision-making, or any purpose unrelated to B2B commercial outreach.

5. Who we share data with

We supply compiled business contact data to our customers, organisations that have entered into a data licence agreement with Peach Data. Each customer is an independent data controller responsible for their own use of the data in compliance with UK GDPR and PECR.

We do not sell data to third parties outside of formal licence agreements. We do not share data with advertisers.

Our master database is hosted on servers located within the UK and European Economic Area. We use official government and public directory APIs to enrich our dataset. All third party processors are subject to appropriate data processing agreements. Where a service provider processes data outside the UK, the transfer is protected as described in section 15.

6. TPS and CTPS screening

All phone numbers in our dataset are screened against the Telephone Preference Service (TPS) and Corporate Telephone Preference Service (CTPS) prior to inclusion in customer downloads. Screening results shown in the customer portal are refreshed every 28 days.

Customers are contractually required to conduct their own TPS/CTPS screening before making marketing calls and bear full responsibility for compliance with the Privacy and Electronic Communications Regulations (PECR).

7. How long we keep data

We retain enriched records for a maximum of 12 months from the date of last verification, after which records are reviewed for accuracy and either updated or removed.

Suppression list entries (opt-outs) are retained indefinitely to prevent re-collection of opted-out individuals' data.

8. Your rights

As a data subject, you have the following rights under UK GDPR:

• Right to be informed: you have the right to know that we hold your data, which this policy fulfils
• Right of access: you may request a copy of any personal data we hold about you
• Right to rectification: you may request that inaccurate data be corrected
• Right to erasure: you may request deletion of your data. Where deletion is not possible (e.g. where data is sourced from public registers), we will add you to our suppression list to prevent re-collection and future sharing
• Right to object: you have an absolute right to object to processing for direct marketing purposes. We will action this within one month
• Right to restriction: you may request that we restrict processing of your data in certain circumstances

To exercise any of these rights, contact us at privacy@peachdata.co.uk. We will respond within one month. We will not charge a fee for reasonable requests.

9. How to opt out

To remove your details from the Peach Data database and all future customer exports, email privacy@peachdata.co.uk with the subject line "Opt Out Request" and include your name and the phone number or email address you wish to suppress.

We will process your request within 5 working days and add your details to our permanent suppression list.

10. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. This includes encryption of data in transit and at rest, access controls, and audit logging. Access to the Peach Data database is restricted to authorised personnel only.

11. Changes to this policy

We review this policy annually and following any significant change to our processing activities. The current version date is shown at the top of this page.

12. Complaints

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office:

We would appreciate the opportunity to address your concerns directly before you contact the ICO. Please email privacy@peachdata.co.uk first.

14. Data you give us directly

Separately from the business dataset described above, we process personal data that you choose to give us when you interact with Peach Data:

• Enquiries and demo requests: your name, work email address, company name and anything you write in the message. We use this to respond to you and take steps towards a contract at your request. Enquiry records are kept for up to 12 months after our last contact with you.
• Customer portal accounts: your name, work email address and organisation, used to operate your account, keep it secure and provide the service under our agreement with your organisation. Account data is kept for the life of that agreement.
• Billing: billing contact and payment details are handled by our payment provider. We keep invoicing records for 6 years as required by UK tax law.
• Support and email correspondence: kept for up to 12 months after the matter is closed.

We contact you only about your enquiry or the service. We do not add you to marketing lists and we do not share this information with anyone except the service providers listed in section 15.

15. Our service providers and international transfers

We use a small number of service providers to run Peach Data. Each acts as a processor under a data processing agreement and only on our instructions:

• Website hosting and content delivery (Vercel)
• Databases (Supabase)
• Sign in and account security (Clerk)
• Transactional email (Resend)
• Payments and invoicing (Stripe)
• Content management for our blog (Sanity)
• Spam protection on the demo form (Google reCAPTCHA)
• Business network lookup for visitor identification (ipinfo.io)

Some of these providers are based in the United States. Where personal data is transferred outside the UK, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework or by the ICO's International Data Transfer Agreement or Addendum, as applicable to the provider. You can request further detail on the safeguard used for any provider at privacy@peachdata.co.uk.