Privacy notice

Tradello is a trading name of Mansell Media Limited, a company registered in England and Wales, company number 17335820.

Registered office: 184-200 Pensby Road, Heswall, Wirral, CH60 7RJ.

Mansell Media Limited is the data controller for everything described on this page.

Write to us about anything in this notice at support@tradello.co.uk, or by post to the registered office.

Nothing on this page is something you agree to. A privacy notice exists to tell you what we do with personal data, and our obligations under it are owed whether or not you have read it, accepted it, or bought anything.

The checkout currently asks you to confirm that you have read this notice before it will take a payment. That confirmation is a record that you were shown this page. It is not consent to anything, it is not relied on by us as a lawful basis for anything, and it does not limit your rights or reduce our duties. The one thing on this site we do ask consent for is marketing email, which is separate, optional, never pre-ticked and never a condition of a purchase.

Your rights, the statutory time limits and how far the route for exercising them has been built are set out at your data protection rights. If your own details are in our records because a public body published them, the page written for you is if your details are in Tradello.

The exact wording shown beside the checkbox. This page and the checkout read the same source, so they cannot disagree about what was confirmed.

I have read the privacy notice.

Business contact details come from published public records. They are business contact routes only, never consumer or residential details, and any person or organisation can ask to be suppressed.

Every contact route in a Tradello lead is obtained from a published public record — a public procurement notice or a local planning authority’s published application — or from a business email published on the organisation’s own website. Each one carries the date it was retrieved.

If your own details are in Tradello, the bodies that published them are named in our notice if your details are in Tradello, so that you can ask them to correct it at source. The licences the records are published under are set out at Tritium 3.1 and licences.

Nothing is guessed. An address is never constructed from a pattern, never inferred from a colleague’s address, and never bought from a list.

A package either includes a published company contact route or it includes none, and which one it is is stated before payment. A package with no route is a described product rather than a fault, and it is sold at the same price.

These are enforced in code, not policy statements.

A customer who has bought a package can be shown a named professional’s work email address, together with their name and job title, where an identified source published it against that project in that professional capacity. That is a disclosure of personal data to a third party and this site does not describe it as anything softer.

A professionally published UK landline can be in a package — a switchboard, a published duty line, or a named professional’s direct dial — where an identified source published it and that source is a page a human can open. Every telephone route carries the fact that screening against the Telephone Preference Service and the Corporate Telephone Preference Service is the caller’s own step: this business does not screen and holds no licence to.

A contact detail that reaches a named person is shown on that one project’s record and is never included in a download, a spreadsheet or any bulk export. The same detail in a spreadsheet column is a marketing list however it was assembled.

What is never held or never shown, whatever the source published:

• No mobile number reaches any customer, at any tier, at any price, whoever published it and whatever label sits beside it. A mobile that is held is retained so that a request from the person it is about can be answered, and it is disclosed to nobody.
• A private person’s contact details are never restored, never enriched and never sold. That applies whatever the source published, whatever any table says, and whatever company is named beside them on the same form.
• Consumer or residential contact details. Tradello holds business contact routes for organisations acting in a business capacity, and nothing else.
• Personal data volunteered by a member of the public in a planning objection or a consultation response.
• A constructed, pattern-matched or otherwise unverified email address. A route that cannot be traced to a published source is not a route.

A named professional contact stops being visible to customers 12 months after the last time the source was successfully read and the detail was still there. Reading it again restarts the period. It runs from that reading and not from the day we collected the record, because the day a page was read once is not evidence that the page is still right.

That period is performed on the read that would otherwise have disclosed the detail, every time, rather than by a sweep: a sweep that runs nightly leaves a day in which an expired detail is still sold, and a sweep that fails leaves a month. Because nothing yet goes back to a source and re-checks, a window can be closed by time but cannot yet be reopened by a fresh check — so the effect is stricter than the period as stated, never looser.

Nothing has yet been deleted under that period. The detail goes out of a customer’s reach on time and is still held by us afterwards, which is less than the period promises, and we would rather say so than print a period we only half keep.

The company-level record underneath — which organisation is on which project, and the department inbox for it — is not about a person and is kept for as long as we keep the project record.

Any person or organisation can ask for their details to be suppressed, and a suppression is applied at the source of the lead rather than at the screen: a suppressed route is withheld from every package, and a package whose only route has been suppressed stops being sellable rather than being sold without it.

Make a data protection request — There is a route for asking, it needs no account, and it is at /privacy/request. A letter or an email is treated exactly as the form is and on the same deadlines. Where a deployment has no durable case store the form is not shown at all and the page gives the written route instead, rather than accepting a submission it would lose on the next restart.

When somebody tells us to stop, the record of that is kept outside the data we rebuild and is keyed to what the publisher publishes rather than to a row we hold. So the next collection run recognises them and refuses to bring them back — and the refusal happens where data is written rather than where it is shown, which covers screens nobody has built yet.

Your rights in full, the statutory deadlines and what we have and have not built to service them are at your data protection rights. General questions about the product are on help and contact.

An account holds your name, your email address, your company name, an optional website, and a hash of your password — never the password itself. Payments are taken by Stripe; card details are never sent to Tradello and never stored by it.

Your session is a signed, HttpOnly cookie. It is not readable by any page in this product, it is never placed in a URL, and it is not held in browser storage.

Visits to Tradello, Plandello and Tendello are counted anonymously and without cookies: each visitor is counted by a code that changes every day, and network addresses are never stored. When you are signed in, the pages you use and the projects you open are recorded against your own account so that we can run and improve the service. None of it is ever sold or passed on.

If you ask to reset your password, we hold a one-way digest of the reset code and the times it was issued and used — never the code itself. Setting a new password ends every other session on the account.

Named rather than glossed over. Nothing on this page is a substitute for any of it.

The formal privacy notice

The controller, the lawful bases, retention periods, international transfers, the rights of a data subject and how each is exercised.

The UK GDPR Article 14 notice

The notice owed to a person whose business contact details were obtained from a published source rather than from them directly, including the categories of data, the sources by name, and the period within which the notice must be given.

The formal wording around a suppression or data-subject request

What identification is required before we answer, what response commitment we publish beyond the statutory one, and who inside the business is named as owning a case. The route itself is built and is at /privacy/request — it needs no account, it records the date a request arrives, and it runs the statutory clocks. What a solicitor has still to settle is the wording around it, not whether it exists.

The full list, including the items belonging to the terms of sale, is on the terms of sale.