Privacy Policy

The data controller is Remainder Research Ltd, a company registered in England and Wales under company number 17483163, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, trading as Turnbull Research.

For any question about this policy, or to exercise any of your rights, email us at office@turnbullresearch.com. That one address handles everything in this policy.

We are registered with the Information Commissioner’s Office (ICO) as a data controller under registration number ZC258836.

We process personal data about five groups of people.

Our clients, whose account details, target market and outreach results we hold in order to provide the service (section 3).

People who enquire through our website or ask for a sample (section 4).

Businesses we contact about our own service, and the people who reply to us (section 5).

Decision-makers at the businesses named in the research we prepare for clients (section 6).

Visitors to our website, whose use of the site we measure, without cookies (section 12).

For clients and enquirers, we process data because it is needed to answer them and to perform our contract. For the businesses we research and contact, we rely on our legitimate interest in business-to-business marketing and research, which we have assessed and documented, and which is always subject to the individual’s right to object.

This section applies if your firm subscribes to a Briefing, Managed Outreach or Custom Research, or is in discussion with us about doing so.

3.1 What we hold

We hold your firm’s name and address, the name, role and contact details of the people we deal with, your Plan (the services, fees, billing and delivery dates, trade, service area, target number of prospects and target criteria set out in your Plan Confirmation), and our correspondence with you.

We hold the information you give us so that we can research for you, which our Terms of Service call Client Materials: your target customer profile, the area you serve, your selling points, your pricing and your messaging.

We hold the Feedback you return to us, meaning your response tracker and anything else you tell us about how the businesses in a Briefing responded.

Where you pay by card, payment is taken by our payment provider, Stripe. We see the payment status, the last four digits of the card and the billing name; we never hold full card details.

3.2 Why, and our lawful basis

We use this information to provide the service, to deliver Briefings, to take payment, to respond to you, and to keep proper business and tax records. Our lawful basis is the performance of our contract with you, our legal obligations for record-keeping, and our legitimate interest in running and improving our service.

We use your Feedback and Client Materials to improve the research we do for you, and they may be used to improve the accuracy of our research engine and systems: for example, learning which kinds of business respond in a given trade. They are never used directly for other clients, we never identify you, and we never disclose your Client Materials to anyone else. This mirrors clauses 9.4 and 10.2 of our Terms of Service.

3.3 Confidentiality and where your data lives

Client Materials and Feedback are your confidential information. They are not shared with, sold to, or made available to any other client. They may be used to improve the accuracy of our research engine and systems, but they are never used directly for other clients. Our Terms of Service commit us to this.

Client data is stored in our database in London, encrypted at rest to the AES-256 standard and encrypted in transit. Access is limited to the people who need it to provide the service to you.

3.4 How long we keep it

We keep your account records and Client Materials for the duration of our relationship and for six months after it ends, in case you return or a query arises. We then delete your Client Materials and Feedback. Invoices, payment records and the correspondence needed to evidence them are kept for six years after the end of the relationship, as tax and company law require.

If you ask for a sample Briefing or a call back through our website, we store what you enter: your email address, your name and company if given, your description of your market, and the page of our site you sent it from. We use this to respond to you, to prepare the sample you asked for, and to follow up on your enquiry. Our lawful basis is our legitimate interest in responding to a request you have made, and, where you go on to become a client, the steps needed to enter into a contract with you.

If you become a client, section 3 then applies. If you do not, we delete your enquiry twelve months after our last contact with you.

We introduce our service to UK-based service businesses by email. This section explains what we hold about those businesses and the people at them, and how to stop hearing from us.

5.1 What we hold and where it comes from

We compile the firm’s name, address, website, trade and general business details from public business directories and the firm’s own website. We store text captured from the firm’s public website, and we use it to write a short profile of what the firm does and who it serves, so that the sample we offer is relevant. Where a named contact is publicly identified at the firm, we hold their name, role and business email address; otherwise we write to a general business address. We check that an address is deliverable before we use it, and we exclude some general inboxes as a matter of policy.

5.2 How we contact you, and what happens to replies

We write from our own Turnbull Research mailboxes on Google Workspace, and replies come back into our own system. Every message identifies us, explains why you are receiving it, tells you where to find this policy and offers a simple way to opt out.

If you reply, we store your reply so that we can respond and keep a record of the conversation. Our software also reads each reply, including any forwarded or quoted text and signature, for email addresses at your own firm’s domain. It does this so that, when a general inbox forwards our message to the right person, we can write to that person directly. It looks only for addresses at your firm’s domain; it does not analyse the content or tone of what you wrote, and it does not look for other people or businesses.

5.3 Our lawful basis

Our lawful basis is our legitimate interest in marketing our service to businesses that may benefit from it. This is business-to-business marketing to firms, about a business service, at business addresses, and it complies with PECR. We do not contact anyone who has asked us not to.

5.4 How long we keep it

We keep the firm’s details and contact records for twelve months after our last contact with the firm or the firm’s last reply, then delete them unless the firm has become a client or an enquirer. The text of replies is deleted ninety days after receipt, once any addresses have been noted. Captured website text is deleted with the firm’s record.

This section applies to people at the businesses named in the Briefings we prepare for our clients. This is the core of our service, and we set it out in full.

6.1 What we hold

For each business we hold the organisation’s name, address, website and category, and text captured from its public website. Where we can find one, we hold the name, job title, business email address and professional profile link (such as LinkedIn) of a decision-maker at that organisation. We hold the public event or circumstance that makes the business worth approaching now, such as a new director appointment or a person-with-significant-control notification at Companies House, an expansion, a relocation, or a contract coming up for renewal, together with a short written explanation of that reason and a suggested opening line for our client’s approach.

Everything we hold relates to a person in their professional role. We do not hold personal telephone numbers, home addresses, or any special category data such as health, ethnicity, political opinions or religious beliefs.

6.2 Where we obtain it

We compile this information from public and third-party sources, including:

1. (a)public business directories and map listings;
2. (b)Companies House and other public registers and statutory filings;
3. (c)the organisation’s own public website, which our software captures;
4. (d)web search indexes, used to find and confirm public information about the organisation;
5. (e)commercial business-contact databases (we maintain access to more than twenty), used to find and verify a decision-maker’s business email address.

We deliver a contact only if the email address has passed verification as a working business address. Unverified, unknown or invalid addresses are withheld.

Our clients may also tell us the right point of contact at an organisation they wish to approach.

6.3 Why we process it, and our lawful basis

Our purpose is to identify which organisations are relevant to a client and why, and to supply that research to the client so that they can make a business-to-business approach.

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): ours and our clients’ legitimate interest in the ordinary and lawful conduct of business market research and business development. Because the data did not come from you, we rely on this basis only where our interests are not overridden by your rights and freedoms, and we have carried out and keep a Legitimate Interests Assessment weighing that balance. The safeguards it relies on are those in this policy: professional data only, drawn from public sources; no special category data; a permanent right to be removed; and a limit on how widely any one contact is shared, described in 6.4.

Because we do not have a relationship with you, and because our clients, not we, make the approach, we tell you about our processing through this policy rather than by writing to you individually. We have concluded that individual notice would involve disproportionate effort and would itself add to the contact you receive; this policy and the removal route in section 7 are our means of keeping you informed.

6.4 Who receives it

The purpose of our service is to supply this information to the client who subscribes to the Briefing in which you appear. That client receives your details and may use the business email address to make contact. Our clients are independent data controllers of the personal data we supply to them, and are responsible for their own compliance once they receive it, including honouring any objection you raise with them.

We limit how widely a contact is shared. A business we have researched for one client is not included in a Briefing or sample for any other client in the same trade serving the same area for at least 12 months. The same organisation may appear in research for clients in different trades, for example a cleaning firm and a landscaping firm, each of which receives it separately.

Where a client subscribes to our Managed Outreach service, we send the approach ourselves, in the client’s name and on the client’s instructions. Every such message identifies who is writing and for whom and offers a simple way to decline further contact. In that case the client and we each remain responsible for our own part of the activity.

We also use service providers who process this data on our behalf, listed in section 9.

6.5 How long we keep it

Research is compiled fresh for each Briefing. We keep an organisation’s record and any contact details for twelve months from the later of the date we last verified them and the date they were last delivered to a client, then delete or refresh them. Captured website text is deleted with the record. The record of which client received which contact, and when, is kept for 12 months so that we can honour the sharing limit in 6.4 and pass on any removal request.

If you are one of the people described in section 5 or section 6, you have the right to object to our processing and the right to erasure, and exercising them is simple: email office@turnbullresearch.com and ask to be removed. You do not need to give a reason.

When you do, we will:

1. (a)acknowledge your request within five business days and complete it within one month;
2. (b)delete your details from our research and from any outreach lists;
3. (c)add you to our permanent suppression list, a “do not contact” record, which our systems check every time a business is collected, researched, delivered or contacted. Anyone on that list is rejected, so your details cannot re-enter our processing from any source;
4. (d)tell any client who received your details from us in the preceding 12 months that you have objected, so that they can stop as well. Our clients are contractually required to tell us within five business days of any objection they receive from you, and we act on those in the same way.

To make the suppression list work, it keeps the minimum needed to recognise you, which is your email address in a protected (hashed) form, even though the rest of your data is deleted. That limited retention exists solely to honour your objection and for no other purpose. We will confirm once your removal is complete.

We use software, including AI language models, to process and classify information where it is efficient to do so.

Everything produced this way is reviewed by a member of our team before it is delivered to a client or sent to a business. We do not make any decision about you by solely automated means that has a legal or similarly significant effect on you.

We use a small number of service providers to run our systems and to obtain, verify and deliver information. Each processes personal data on our behalf, under contract and only on our instructions, or supplies data to us as an independent source. The list below gives the provider, what it does for us, and the categories of data involved.

1. (a)Supabase: our primary database and application storage, holding all of the data described in this policy. Hosted in London, United Kingdom, encrypted at rest.
2. (b)Hetzner: the server on which our research software runs, in Falkenstein, Germany. Data passes through the server during processing.
3. (c)Cloudflare: domain name services, hosting, protection and cookieless analytics for our website, including the enquiry form. Sees website traffic and form submissions in transit.
4. (d)Business data providers: supply public business directory and map listing data, find and verify business email addresses for named decision-makers, and check that addresses are deliverable (sections 5 and 6).
5. (e)Web search providers: search indexes used to find public information about organisations (section 6).
6. (f)Anthropic and OpenAI: AI language models (section 8) and web search (section 6).
7. (g)Instantly: schedules our own marketing emails, which are sent through our Google Workspace mailboxes, and brings replies back to us (section 5).
8. (h)Google (Google Workspace): our business email and document services, including the mailboxes from which we write to businesses and clients.
9. (i)Stripe: payment processing for clients (section 3).
10. (j)Pushover: sends operational alerts about our systems to our phones. An alert can occasionally include an email address from a record that has failed processing.
11. (k)Companies House and other public registers: independent public sources of the information described in 6.2, not processors of data on our behalf.

We do not sell personal data. Supplying research to the client who has subscribed to it, as described in section 6, is the service itself and is explained there.

Our database is hosted in London, so the personal data described in this policy is stored in the United Kingdom. Our research server is in Germany; the UK recognises the European Economic Area as providing an adequate level of protection, so no additional safeguard is required for that processing.

Several of the providers in section 9 are based in the United States or process data there: Cloudflare, Anthropic, OpenAI, Instantly, Google, Stripe and Pushover, and some of our business data and web search providers. Where personal data is transferred to a country not covered by UK adequacy regulations, we ensure an appropriate safeguard is in place as required by UK GDPR: either the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), or we have entered into the UK International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses with that provider, in each case within the provider’s data processing terms. You can ask us at the address in section 1 for details of the safeguard in place for any provider.

We take technical and organisational measures appropriate to the data we hold. Data is encrypted in transit and, in our database, encrypted at rest to the AES-256 standard. Access to systems is limited to those who need it to provide the service, protected by strong authentication. Our website holds no direct access to our database: the enquiry form can only write a single enquiry record and cannot read anything. We review these measures regularly. No system can be guaranteed completely secure, but we work to protect your information and will tell you and, where required, the ICO if a breach affects you.

We use one kind of measurement on our website, and no advertising or tracking cookies.

Cloudflare Web Analytics measures how the site is used: which pages are visited, how quickly they load, and the visitor’s browser type, operating system and country. It does not use cookies or any other storage on your device and does not identify you. It works by processing your IP address and browser details on our behalf as the page loads, and we rely on our legitimate interest in understanding and improving our site. Cloudflare Web Analytics is always on.

The only cookies the site may set are:

1. (a)__cf_bm and similar security cookies, which Cloudflare may set to protect the site from automated abuse, kept for up to thirty minutes, strictly necessary and not requiring consent.

Our server and hosting provider keep standard technical logs of requests to the site, including IP addresses, for security and troubleshooting. These are kept for ninety days.

Under UK data protection law you have the right to:

1. (a)be informed about how we use your data, which is the purpose of this policy;
2. (b)access a copy of the personal data we hold about you;
3. (c)have inaccurate or incomplete data corrected;
4. (d)have your data erased in certain circumstances;
5. (e)restrict our processing in certain circumstances;
6. (f)object to processing based on legitimate interests, including for direct marketing; where you object to direct marketing, or to being included in our research, we will always stop;
7. (g)data portability in certain circumstances;
8. (h)not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.

To exercise any of these, email office@turnbullresearch.com. We will acknowledge within five business days and respond within one month. Exercising your rights is free, and we will not treat you differently for doing so. We may ask you to confirm your identity where that is needed to protect your data.

If you have a concern about how we handle your data, please contact us first so that we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator, at ico.org.uk, by telephone on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

We may update this policy from time to time. The current version is always available on our website at turnbullresearch.com/privacy, and the date at the top shows when it was last revised. Where a change materially affects how we use your data, we will tell our clients by email.