If your details are in Tradello

Why you might be reading this

You have probably found your name, your work email address or your direct dial number connected to this company, and you have no idea who we are. That is a reasonable thing to be annoyed about and this page is the answer to it.

The short version: we did not get your details from you. We captured a public notice — a contract notice, an award notice or a planning application — that the body you work for published, and your details were printed in it. We are a small company that turns published construction records into leads for builders.

This page is the notice we owe you. When a company gets your details from somewhere other than you, the law says it has to tell you certain things — who it is, what it has, where it came from, who it gives it to, how long it keeps it and what you can make it do. That is Article 14 of the UK GDPR, and everything it asks for is below. We have not written to you individually, and the last section says plainly what that does and does not settle.

Who we are, and who is answerable for this

Tradello is a construction lead service. We collect notices and planning applications that public bodies publish, work out which trades a project needs, and sell the resulting summary to building firms looking for work, as a monthly subscription. We are not a marketing list, we do not send email on anybody’s behalf, and we do not run campaigns.

The company behind it, its registered office and the address to write to are at the foot of this page, and that company is the data controller for everything described here. We have not appointed a data protection officer, so there is no separate officer to write to; the address at the foot reaches the people who decide these things.

Where your details came from

We only ever take what a public body or an organisation has already published. These are the kinds of source it comes from. Each one says what that kind of publisher prints about a person and what you can do at the origin, which is usually worth more than what we can do.

Published public procurement notices

The procurement contact a public body printed on a tender or contract notice — commonly a name, a job title, a work email address and a direct dial. This includes notices published by UK public bodies and by public bodies elsewhere in Europe.

The notice belongs to the public body that published it. Ask that body to amend or withdraw the notice, and the correction reaches everybody reading it rather than only us.

Contract award notices

The contact a public body printed when it announced who won a contract — the same kind of name, job title, work email address and direct dial.

As above: the public body that awarded the contract owns the notice and is the only party who can change what it says.

Planning applications

The richest personal data we hold. A case officer’s name, job title and direct dial; a planning agent, architect or consultant named on the application; and, where the applicant is a private person rather than a business, that person’s name and often the address of the property.

The council running the planning portal. Most councils publish a redaction or correction route for planning documents; it is worth using, because the published application is read by far more people than us.

Public registers

Registered names, numbers and registered addresses of companies and other registered bodies, used to work out what kind of body a contact belongs to. A registered address can be a person’s home address where a company is registered there.

The body that keeps the register. Statutory registers operate their own correction and suppression routes, including for a residential address.

An organisation’s own website

A contact address or number an organisation publishes about itself, taken as published from the page it is on.

The organisation controls the page. Changing it there changes what we read on the next pass.

The specific publisher your details came from is available on request to you, the person those details are about. Every contact detail we hold carries which publisher it came from, the notice it was printed in and the date we collected it, so we can tell you exactly where yours came from rather than pointing you at a list. To ask, use the request form and choose “Tell me where you got my data”, or write to the registered office at the foot of this page. Because the answer is about where one person’s details were published, we give it only to that person, once we have confirmed it is you — the form explains how.

Where the publisher gave us a direct link to the page your details are on we keep that too; where it did not, we keep the link to the notice the record was published with. The acknowledgements the publishers’ licences require are set out at Tritium 3.1 and licences.

Nothing is guessed and nothing is bought. We never build an email address from a pattern, never work one out from a colleague’s, and never buy contact data from a list vendor. A detail with no published source is not a record we hold. We have never added anything to a record about a private person, and we never look anybody up outside the kinds of source above.

What we hold about you

Depending on what the publisher printed, this can include:

• your name;
• your job title;
• your work email address;
• your direct dial or a switchboard number listed against you;
• a postal address for the office you work at, where it was published against your name;
• which published notice it came from, the date the publisher published it where the publisher printed one, and the date we collected it;
• which organisation we have matched you to, and how confident we are that the match is right.

That is the whole list. We do not hold your home address, your personal email, your personal mobile, your social media accounts, your date of birth, or anything about your health, beliefs, background or private life. We do not build a profile of you, we do not track you, and we have never contacted you.

Who can see it

This is the question most people come to this page for, so it is answered before anything else and it is answered exactly.

Nobody on the open internet, and nobody who has only signed in

Nothing that identifies a person appears on any page a visitor can reach, in any search result we produce, or on any screen somebody gets by creating an account. Signing in is not enough and never has been.

A paying customer looking at the specific project you are named on

If you are named on a notice as the person to contact about a piece of work, a customer who has bought that project can be shown your name, your job title and your work email address. That is a real disclosure to a real third party and we are not going to describe it as anything softer. The reason we think it is defensible is that your employer published those details attached to that piece of work, so that people with business about it could get in touch — and a builder asking about the tender is doing the thing the publication exists to enable.

What is never shown, at any price:

• a private person who has applied for planning permission on their own home, and anybody we cannot place as acting for an organisation;
• a personal mailbox at a consumer email provider, whoever is using it and for whatever;
• a mobile number, and any number our records cannot show reaches a business line;
• a named person whose professional role we could not establish from what the publisher printed.

And what is never done with it: your details are never included in a download, a spreadsheet or a bulk file, because a column of names in a spreadsheet is a marketing list however it was assembled. No text message and no messaging app, ever. A phone number always carries the warning that the caller has to screen against the Telephone Preference Service first. And every time a customer is shown a contact, we log it — so if you ask us who has been shown your details, that is a question we can answer.

A department inbox at your organisation

We also sell the company-level route — an address published for a job rather than for a person, like planning@, procurement@ or estimating@, and a head-office inbox or switchboard. These are professional contact details as published by the source, published by your organisation precisely so that people with business can use them.

Availability does not constitute consent to marketing. The fact that we can supply an address does not mean anybody has agreed to receive marketing at it, and we do not tell our customers otherwise. A customer who buys a package becomes responsible in their own right for whatever they send, and we say so to them in the same words we are using here — see which contact details Tradello holds. That does not move our own responsibilities onto them: if our collection, our classification or our decision to disclose is wrong, it is wrong, and it is ours.

We should be straight about the edge of this: at a very small firm, a department inbox and one person can be the same thing. We do not reliably tell a one-person business apart from a large contractor, and we have not measured how much of what we sell falls into that category. If that is your situation, say so when you write to us and we will treat the address as personal.

Where it is held, and who else handles it

We use outside suppliers to run the site, store the database, send our own email and take payments. They handle what we hold on our instructions and for no purpose of their own. None of them is sold your details and none of them is a customer.

We have not yet established where each of those suppliers actually stores the data, or whether any of them holds it outside the UK. Several of them are capable of holding data in other countries. That is an answer we owe you and do not have, we are not going to put a confident sentence over it, and it is on the list of things being settled with a solicitor. Who our suppliers are is set out in the privacy notice.

Why we hold it, and what we are relying on

Our legal basis is legitimate interests, and the interest is commercial. We run a service that tells small building firms which construction projects exist, who is on them and how to approach those organisations, and we sell it. We are not going to dress that up as a public service. What makes it more than a bare commercial interest is that the records we capture are published under transparency rules whose whole purpose is that suppliers can find work and bid for it, and a market where only firms with a bid team can find public work is not what those rules were for.

We do not have your permission and we are not claiming to. Nobody consented to anything here. Relying on legitimate interests means we have to weigh our interest against the effect on you, and we have done that in writing, including the parts that go against us — that you do not expect your details to be resold, and that one notice naming you is a document while a national index of everybody like you is a different thing. It also means you can object, and we expect objections to succeed.

There is a second reason we hold a record we would otherwise delete. If you write and ask what we have about you, we have to be able to tell you. A company that destroys the evidence of what it collected in order to look tidy has not stopped collecting it; it has destroyed the trail. That is a reason to keep a record, and it is not a reason to keep one forever — which is what the next section is about.

Whether a computer decides anything about you

Nothing we do makes an automated decision about you that has a legal effect or anything like one. We do not score you, rank you, assess you or profile you, and nothing in our system decides anything about your employment, your finances or your access to anything.

What is automatic is a decision about a contact detail. Software reads each detail we hold and works out three things from what the publisher printed: what kind of body published it, what role it reaches, and what kind of mailbox or line it is. A fixed table then decides whether that detail may be shown to anybody. It is the detail being classified rather than you, the answer is always to show less rather than more when the software is unsure, and if you think it has got your record wrong, tell us and a person will look at it.

How long we keep it

We keep a name, a job title and a personal contact detail for 12 months from the last time we successfully checked the detail was still published at its source — and each time we check it and find it still published, that clock starts again. When it runs out, the name, the job title and the personal contact value are deleted, and the company-level record, which is not about a person, is kept.

We have set that period and we have not yet built the deletion that carries it out, so nothing has been deleted under it. We would rather tell you that than print a period we do not keep.

One part of it does run, and one part does not, and you should have both. When the twelve months are up we stop showing the detail to customers — that is performed, on the read itself, every time. What we have not yet built is the deletion that follows. So the detail goes out of reach on time and is still held by us afterwards, which is less than the period above promises and is why we are telling you rather than printing a period we only half keep.

The clock is supposed to start when we last confirmed the detail was still published at its source, and we do not yet go back and re-check. So it starts from the day we collected the record instead — which is earlier, so the twelve months run out sooner rather than later, and no window can be extended by a check nobody has made. You do not have to wait for any of this: asking us to remove you works today and depends on none of it.

The company-level record underneath — which organisation is on which project, and the department inbox for it — is not about you and is kept for as long as we keep the project record.

What you can ask us to do

You can ask us for any of the following, free, and you do not need to give a reason for most of them:

• Tell you what we hold about you. We will send you the record, which publisher it came from and when we captured it.
• Tell you exactly where your details came from— the publisher, the notice and the date we collected it.
• Correct something that is wrong. We will change it, and tell anybody we have already given the old version to where that is possible.
• Take your details out. We remove your name, your job title and your personal contact details, keeping the company-level record that is not about you. This is the narrowest and quickest thing to ask for and it does not depend on anything else.
• Delete you, where the law requires it, and restrict what we do with the record while something is being sorted out.
• Object to us holding it at all. You can object at any time on grounds relating to your particular situation, and we have to stop unless we can show compelling grounds that override your interests. We expect objections to succeed here and we have built for that rather than against it.

Use the request form, or write to the registered office at the foot of this page. You do not need an account and you do not need to be a customer. By law we have to respond without undue delay and within one month. We only change or remove anything once we have confirmed the request comes from the person the details are about, so that nobody can have somebody else’s details taken down or changed; the form says exactly how that works. If the case store behind the form is not live on the deployment you are reading this on, that page says so and gives you the postal and email route instead of taking a submission it would lose.

When you tell us to stop, we keep a record of that outside the data we rebuild. That matters more than it sounds. Councils and procurement portals republish the same notice for weeks, and a removal that survives one collection run and dies at the next is worthless. The record of your objection is filed against what the publisher publishes, so the next run recognises you and refuses to bring you back — and the refusal happens where data is written rather than where it is shown, so it covers screens nobody has built yet. The full position is on your data protection rights.

What we do instead of writing to each of you

We have not written to you individually. The law lets a company in our position publish the information instead of sending it, in some circumstances, and it requires that company to do more than publish a page. These are the things we do, and every one of them is built rather than promised:

• This page, published openly, describing every kind of source we obtain personal data from and held out as the notice we owe you. The specific publisher is given to the person the details are about, on request.
• Every contact detail carries where it came from and when we collected it, so we can tell you the specific source rather than the general list.
• Nothing is guessed, worked out from a pattern or bought. An address with no published source is not a record we hold.
• Nothing that identifies a person is on the open web. It is never shown to a visitor and never shown to somebody who has merely signed in.
• A named person is never included in a download or a bulk file, because a column of names in a spreadsheet is a marketing list however it was made.
• No text message and no messaging app, ever, to anybody in these records — not by us and not through anything we sell.
• A private person on a planning application, and anybody we cannot place as acting for an organisation, is withheld outright.
• If you tell us to stop, the record of that sits outside the data we rebuild, so a council republishing you does not undo it.
• That decision is applied where data is written rather than where it is shown, so it covers screens nobody has built yet.
• Every time a customer is shown a contact, that is logged, so we can tell you who has been shown your details.
• We never tell a customer that a published address may lawfully be marketed to. The sentence saying availability is not consent is rendered beside the contact every time it appears.

We are not putting that list up as proof that publishing is enough. It is what we do so that a page is worth something to you. Whether publishing discharges what we owe you is the open question in the last section.

If you are not happy with our answer

You can complain to us, and you can complain to the Information Commissioner’s Office, which is the UK regulator for this. You do not have to complain to us first, and complaining to us does not use up your right to go to them.

Both routes, what we owe you by law when you complain, and how to reach the ICO are on complaining about how your data is handled.

What this page settles, and what it does not

This page is the notice the UK GDPR says you are owed when a company gets your details from a published source rather than from you. It covers every item the Article lists, and we have published it because you are entitled to it.

It has not been approved by a solicitor, and we are not claiming that publishing it means we no longer owe you anything. The law on when a company in our position must contact people individually, rather than publish a page like this one, was rewritten on 5 February 2026 by section 77 of the Data (Use and Access) Act 2025. Whether the exception we would need is available to an ordinary commercial business — rather than only to research and archiving — is genuinely unsettled, the regulator’s own guidance on it was still in draft, and we have asked a solicitor. We have not picked the answer that suits us in the meantime, and if the answer comes back that we owe you an individual notice, publishing this page will not have discharged it.

What we have done instead of guessing is publish everything the Article asks for, describe every kind of source and give the specific publisher to the person concerned when they ask, build an objection route that survives a rebuild, and keep anything that identifies a person off the open internet entirely. If you think that is not good enough, the complaint routes above are real and we would rather you used them than assumed nobody was listening.