RFQ Comparelive price matrix for materials

Privacy notice

UK GDPR & PECR · BUSINESS CONTACT DATA · LAST UPDATED [OPERATOR: date this notice was published]

This page explains, in plain English, what we hold about the businesses we contact, why we are allowed to hold it, how long we keep it, and how to make us stop. If you received an email from us that you did not ask for, the opt-out box at the bottom is the fastest route — no login, no reply needed.

Who we are

RFQ Compare is operated by [OPERATOR: registered company name], registered in England & Wales, company number [OPERATOR: company number], registered office [OPERATOR: registered office address]. We are the data controller for everything described here. ICO registration: [OPERATOR: ICO registration number].

Privacy contact: [OPERATOR: privacy contact email address]. We have not appointed a Data Protection Officer; that address reaches the person accountable for this notice.

What we hold about a business we have contacted

  • The business name and trading details as published by the business itself or by Companies House.
  • A business email address — we prefer role addresses (info@, sales@, enquiries@) over a named individual's mailbox, and we record whether the address is a role address.
  • The company number and entity type from the Companies House public register, which we use to check whether the business is an incorporated company or a sole trader.
  • Content from the business's own public website — what it sells, where it delivers, published prices — so we only invite businesses to tenders they can actually quote for.
  • Whether a privacy notice has been sent, whether the business has opted out, and when the record is due for deletion.

We do not buy contact lists, we do not hold payment details for contacted businesses, and we never send cold text messages. A business email address that identifies a person (for example jane@firm.co.uk) is personal data, and everything on this page applies to it.

Where we got it

From public sources only: the business's own website, public business directories and mapping data, and the Companies House public register. We did not get it from you, which is why we send a notice like this one — Article 14 of the UK GDPR requires us to tell you within one month of collecting it.

Why we are allowed to hold it

Our lawful basis is legitimate interests (UK GDPR Art. 6(1)(f)): connecting a trade buyer who needs materials with suppliers who sell them. We have carried out and documented a Legitimate Interests Assessment before any contact is made, and a contact record cannot be emailed unless a current, approved assessment covers it — that is enforced in the database, not by policy.

For marketing email specifically, PECR reg. 22 lets us contact corporate subscribers (limited companies, LLPs, partnerships) without prior consent, provided we identify ourselves and give a working opt-out. It does not let us cold-email sole traders, who count as individual subscribers — so every contact is checked against Companies House first, and sole traders are not cold-emailed. Countries with prior-consent regimes are excluded until consent is properly modelled.

You can object to processing based on legitimate interests at any time. The opt-out below is that objection, and we act on it immediately.

How long we keep it

A contact record we never do business with is deleted automatically at its retention expiry — [OPERATOR: retention period, e.g. 12 months from collection] — by a scheduled job, not by anyone remembering to do it. If a business becomes a supplier on the platform, its records are kept for as long as that relationship needs and then under the normal accounting retention rules.

One thing deliberately survives deletion: the opt-out record. It is a keyed hash of the address, never the address, and keeping it is the only way to guarantee we do not re-collect and re-contact you later (Art. 17(3)(b) — keeping it is what lets us comply).

Who we share it with

Our infrastructure and email providers process data on our behalf under contract — [OPERATOR: list processors, e.g. Cloudflare (hosting), Neon (database), Resend (email)]. We do not sell contact data and we do not pass a contacted business's details to buyers unless that business chooses to quote.

Your rights

  • Object / opt out — stop all contact. Use the box below; it takes effect at once.
  • Access — ask for a copy of what we hold about you.
  • Rectification — have anything wrong corrected.
  • Erasure — have your record deleted.
  • Restriction and portability where they apply.

Email [OPERATOR: privacy contact email address]for any of these. We answer within one calendar month and we do not charge. If you are not happy with how we handled it you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113 — you do not have to come to us first.

If you use the site

Visitors and account holders: we set a first-party session cookie so the site can remember your workspace. There are no advertising pixels and no analytics that run before consent. We keep the materials lists and quotes you create so we can show them back to you.