Privacy notice

1. Who we are

Firmspotter is run by Lewis Scott Consulting Ltd, a company registered in England and Wales (company number 13487437), whose registered office is at Civic Hall, Station Road, Barnoldswick, Lancashire, BB18 5NA. You can reach our privacy contact at privacy@firmspotter.com.

For the business contact details in section 3 we are the “controller”: we decide why and how they are used. For the website visit information in section 4 our customer is the controller and we act on their instructions.

2. Who this notice is about

• People whose business contact details we hold, because a customer’s search found them (section 3).
• People who visit the website of one of our customers (section 4).
• Our customers, their staff, and people who use this website (section 5).

3. Business contact details we hold

What we hold

• Your name, your job title, the function and seniority level of your job, and the company you work for.
• The address of your public LinkedIn profile, and your work email address where our data provider has one.
• The country you work in, and the dates your job was last verified and last changed.
• A short message suggested for the customer to send you, and a note of whether they found it useful (for example “replied” or “wrong person”).

What we never hold

Personal email addresses, phone numbers, home addresses, or anything about your health, beliefs, politics or private life. We never visit or collect anything from LinkedIn ourselves: your LinkedIn address comes from our data provider.

Where it comes from

From People Data Labs, a company that supplies professional contact data. We ask it for a small number of people at a company, in job roles our customer has said it wants to reach, only when a company our customer sees fits that customer’s ideal customer profile or the customer asks us to look. Read its privacy notice for how it collects the data in the first place.

Why we use it, and our legal basis

Our legal basis is legitimate interests (article 6(1)(f) of the UK GDPR). Our customers are businesses that want to talk to other businesses. We help them find the right professional at a company that may care about what they sell, so that their outreach is relevant and focused rather than broad and untargeted. We think this is fair to you because: it is your professional details at your place of work; we keep as little as we can; we keep it for a short time; we explain it here; and you can object at any time and we will stop at once.

What we do with it

• We show a customer up to three people at a company, ranked by how well their job fits what that customer sells, labelled “likely interested”.
• We use an AI service to write a short suggested first message for each person, from their job title, their company and public facts about the company. It is a suggestion: the customer chooses whether to use it, and we never send a message to you ourselves.
• We keep a note when a customer tells us the person was the wrong one, or did not suit, so the suggestions get better.

What we do not do

• We do not work out which person visited a website, and we never tell a customer that you did. A customer sees, at most, that someone at your company may have.
• We do not make decisions about you that have legal or similarly significant effects, and we do not sell your details.

Who sees it

The customer whose search found you, and the companies that help us run the service (see the list of sub-processors). We disclose details to authorities only when the law requires it.

How long we keep it

• We delete a company, and the people found for it, 90 days after that company was last seen on a customer’s website. A clean-up runs every night, and also deletes anyone who is no longer listed for any company.
• If you opt out, we delete you from every customer’s account straight away. We then keep a scrambled copy of your email address and LinkedIn address (a hash, which cannot be turned back into the address) with no time limit, so that we can keep you out.

4. People who visit our customers’ websites

Our customers install a small script on their own websites. The customer decides to do that, and is responsible for telling its visitors and asking for their consent. We process the information below on the customer’s behalf and for no other purpose.

• The script runs only after a visitor has agreed to analytics or marketing cookies on that website, and does nothing at all if the browser sends a Global Privacy Control signal.
• It stores a random identifier in the visitor’s browser, and records the pages visited, how long the visitor was active on each, where they came from, and any campaign tags in the address.
• It never reads form fields, key presses, clicks or the text on the page.
• Your IP address is used once, to ask our data provider which company, if any, the connection belongs to. We keep it in encrypted form only until it has been used, and always delete it within 24 hours. A scrambled version (a hash, which cannot be turned back into the address) stays with the visit record for 90 days. We ask only for companies, never for a person. Connections that cannot be tied to a company, such as mobile, VPN and proxy connections, are discarded.
• We delete visits 90 days after they happen.

To use your rights about a visit to a website, contact the owner of that website. If you contact us instead, we will pass your request to them and help them answer it.

5. Our customers and visitors to this website

• Our customers’ staff: your name and work email address to sign you in, your role in the account, a record of what you did in the service, and your billing details. Card details are held by our payment provider, Stripe, and never by us. We use this to provide the service you have signed up for, and for security and to prevent misuse.
• This website uses only the cookies that keep you signed in and remember which of your sites you were looking at. It has no advertising or analytics cookies. The sign-in, sign-up and opt-out pages use Cloudflare Turnstile to check that a visitor is a person.
• We keep account details while the account is open. If a customer asks us to close its account we delete its details within 30 days, except records of payments, which the law requires us to keep.

6. Your rights

You can ask us to tell you what we hold about you and give you a copy; to correct it; to delete it; to restrict how we use it; and to stop using it because of your particular situation. You can object to our use of your details for direct marketing, and when you do we must stop. If you are unhappy with how we have handled your details, you can complain to the ICO at ico.org.uk or on 0303 123 1113. It would help us if you came to us first.

• Opt out: the quickest way. Enter your work email address, your LinkedIn address, or both. We delete you from every customer’s account straight away and never include you again. You do not need an account, and we do not tell you whether we held anything.
• To ask for a copy of what we hold, or to use any other right, email privacy@firmspotter.com. We aim to answer within 7 days and always within one month. There is no charge.

7. Sending details abroad

Our database and the servers that run the service are in London. Some of the companies that help us are based in the United States, or can reach data from there. The list of sub-processors says who they are and what they do.

Where a company outside the UK handles personal data for us, we make sure a safeguard the UK GDPR recognises applies: the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses with the UK Addendum, or the ICO’s International Data Transfer Agreement.

8. How we protect it

• The database and servers are in London.
• IP addresses and customers’ webhook links are encrypted before they are stored, with keys held outside the database.
• Every customer’s data is separated from every other’s by the database itself, not only by our code.
• Our own administrators sign in with two-factor authentication, and every search, export and deletion they make across accounts is written to a log that cannot be changed.

9. Changes to this notice

We will change this notice when what we do changes, and will say so on this page. This version was last changed on 10 November 2026.