Legitimate Interests Assessment

1. About this assessment

This is a summary of the legitimate interests assessment carried out by MIRA NOVUM LTD for its business database, under Article 6(1)(f) of the UK GDPR and the ICO’s guidance on legitimate interests. It covers the compilation of business records, the free public directory, and the supply of records to customers who unlock, export or use our API.

Most records describe companies and are not personal data at all. The assessment concerns the personal data that business records can contain: the details of sole traders and partnerships, named business email addresses and the names of people shown in a business role.

2. Purpose test

Businesses have a legitimate interest in finding and contacting other businesses for relevant commercial purposes: selling and buying, supply and distribution, partnerships and collaborations, sponsorship, recruitment of business partners, research and planning, and checking their own business lists. The public has an interest in finding businesses by category and place. Businesses that publish contact details generally do so to be found and contacted for these purposes.

Our own interest is running a lawful data business that serves these purposes. These interests are lawful, clearly stated and real, and they bring wider benefits by helping small and local businesses find trading partners.

3. Necessity test

Compiling published business information into one de-duplicated, checked record is a proportionate way to meet these interests: it saves each buyer from collecting the same information repeatedly, lets us remove records that fail checks, and gives every listed business one place to correct, restrict or remove its details. There is no less intrusive way to offer a searchable, checked business database.

We collect business-context details only, and only fields that serve the purpose. We do not collect home addresses kept for private purposes, private social activity, social metrics, dates of birth or special category data.

4. The data involved

Business names, categories, business addresses, business phone numbers, business email addresses, websites, links to official social profiles, opening hours, company registration details where published, website technology, AI summaries and indicative scores, compiled from public business websites, the structured data published on those websites, official business registers and AI analysis. Each field keeps its source reference and the date it was last checked.

5. Reasonable expectations

The information is published by the business itself so that it can be contacted about its business, and appears in a business context. People who publish business contact details would reasonably expect them to be found and used for relevant business contact, particularly when the contact is relevant to their trade and offers an easy way to object.

Expectations are lower for named and free webmail addresses, and for sole traders who may work from home. These are treated as higher risk below.

6. Balancing test

The likely impact on individuals is limited: the data is already public, is business-related, and contact made with it is business contact that can be stopped at any time. The main risk is unwanted marketing. That risk is reduced by our safeguards and by the obligations we place on buyers, who are independent controllers and must comply with PECR and the UK GDPR themselves.

We do not use the data to make decisions about individuals. Scores describe business records for prioritising leads and have no legal or similarly significant effect on anyone.

7. Higher risk data and how we handle it

Named and free webmail email addresses are flagged as such, masked on public pages and can be excluded by buyers with a single filter. Sole traders and partnerships are treated as individuals for electronic marketing, and our guidance tells buyers that consent is generally needed to email or text them. Full street addresses and phone numbers are part of the paid record only, and any business can hide them permanently through the verified removal process.

We do not screen phone numbers against the telephone preference registers, and every buyer must confirm before unlocking or exporting that they will screen numbers before any marketing call.

8. Records shared by users of our apps

Users of our browser extension and desktop app share business details they read on a business’s own public website; on a free account this is a condition of using the signed-in apps. The same assessment covers any personal data in those records, such as a business email address that names a person or a sole trader’s details: the purpose, the kinds of data and the safeguards are the same as for the rest of the database. Shared values are limited to details the website publishes for business contact (from the extension never free webmail or named people’s addresses, and from either app nothing behind a login), wait in review, and are used only after independent checks. We do not rely on the user’s agreement as the lawful basis for anyone else’s data, and the people concerned keep every right described in our notice Data Sources and Your Rights.

9. Safeguards

Contact values are masked on public pages and shown only to buyers who unlock or export a record. Buyers confirm their obligations before they obtain data, and we keep a record of each confirmation. Buyers receive a licence that limits use to their own business and forbids resale, publication and consumer targeting.

Any business can correct, restrict or remove its record free of charge, verified through its own business email so that competitors cannot remove it. Removals go on a suppression list and are not collected or supplied again. Verified owners can choose labels that exclude their business from every export and campaign. Records carry the date they were last checked; scores are described as indicators, and unknown information is never shown as a failed check. Exports exclude suppressed and removed records. Our outreach tools add unsubscribe handling, sending limits and global suppression.

10. Rights and transparency

Our notice Data Sources and Your Rights explains what we hold, where it comes from, why, who receives it, how long we keep it and how to object. It is linked from the footer of every page and from the removal form. Objections from listed people are treated as requests to stop supply and are acted on within 30 days, usually within two working days.

11. Outcome

Our assessment concludes that the legitimate interests of businesses, buyers and the public are not overridden by the interests or rights of the people concerned, provided the safeguards above stay in place. We have also considered whether a data protection impact assessment is needed and keep that decision under review as the Service develops.

12. Review and full copy

We review the assessment at least once a year and whenever we add a new type of data, a new source category or a new way of supplying data. A copy of the full assessment is available on request to [email protected].