How Salenovo uses personal data

Salenovo sells information about newly registered UK companies to firms that want to contact them. This notice covers two groups of people: the visitors, trial users and subscribers who use this site, and the people who may be identifiable through a company that appears in our data. It says what we hold, why, on what legal basis, for how long, and what you can do about it.

Last updated 12 September 2026

1. Who we are

The data controller is Salenovo Ltd, a company registered in England and Wales (company number 17455275), registered office 10 George Close, Canvey Island, Essex, SS8 9PU. You can reach us at hello@salenovo.com for anything in this notice. Our ICO registration reference is ZC246652.

2. Visitors, trial users and subscribers

What we collect

• When you start a free trial or a free weekly alert: your work email address, the council, region or UK tier you chose, the buyer type you picked (for example "accountants"), the page you signed up from, and the date. If you tell us your name we keep that too.
• When you subscribe: the same, plus your billing name and address and a record of payments and invoices. Card payments will be taken by Stripe; we never see or store card numbers.
• When you email us: the message and your address, so we can reply.
• When we email you: a log of which weekly list was sent to which address on which date, so that nothing is sent twice and so we can show what you received.
• When you use the site: we use GoatCounter, a privacy-focused analytics service that counts page views, referrers and the events "form submitted" and "button clicked". It sets no cookies, does not identify individual visitors, and does not share data with anyone else. This site sets no cookies of its own. Fonts are loaded from Google Fonts, which means your browser sends its IP address to Google to fetch them, in the same way as for any image or script on the web.
• If we email you: links in our emails carry a short code, so we can see that an email was worth clicking and which link was used. The code identifies the mailbox we wrote to — not you as a person, and nothing you do anywhere else. It is removed from the address bar as soon as the page opens, so it is not passed on if you share the link, and if you go on to start a trial it tells us which email brought you. We do not use tracking pixels or read receipts, so we cannot tell whether an email was opened or read. Codes are kept for twelve months. Reply "stop" to any email and we will stop writing to you and stop using the code.

Why, and on what legal basis

• To deliver the trial, the weekly lists and the subscription you asked for, and to tell you before a trial ends whether and how to continue — performance of a contract (UK GDPR Article 6(1)(b)).
• To answer your questions and to send service messages (a change to the lists, a problem with delivery, a change to these terms) — legitimate interests in running the service (Article 6(1)(f)).
• To keep invoices and payment records — legal obligation (Article 6(1)(c): tax and accounting law).
• To understand which pages and buyer types bring sign-ups, and whether the emails we send are useful — legitimate interests. Site analytics are anonymous; the only identifier we add is the link code in our own emails, described above.

We do not sell or share your details with anyone for their marketing, and we do not send marketing about anything other than Salenovo itself. Every email we send tells you how to stop it: reply "stop", or use the link in the email.

Firms we contact about Salenovo

We occasionally email accountancy practices and other firms to tell them about Salenovo. Those emails go to generic mailboxes (such as info@ or hello@) published on the firm's own website, to limited companies and LLPs only, and each one says who we are and how to opt out. This is B2B marketing under the Privacy and Electronic Communications Regulations (PECR) and our basis is legitimate interests. If you ask us to stop, your address goes on a suppression list so that we do not email it again; that list is the one record we keep of you.

Who processes your data for us

• Formspree (United States) receives sign-up form submissions and forwards them to us.
• Google Workspace (Google LLC, United States, with UK/EU data centres) hosts our email and the sign-up records.
• Stripe Payments UK Ltd will process card payments and subscriptions once card payment is live; Stripe is a controller in its own right for payment data and publishes its own privacy notice.
• GoatCounter (operated from Ireland, data held at Hetzner in Germany and Finland) provides the site analytics described above; it stores no IP addresses. The link code from our emails is recorded there as an event, and only we can match it back to a mailbox — the list that does so stays on our own machine and is never uploaded.
• Render (United States) hosts the website; it sees the ordinary server logs (IP address, page requested, time) that any web host sees, kept for a short period for security.

Where a provider is outside the UK, transfers rely on the UK Extension to the EU–US Data Privacy Framework (for certified US providers), the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK adequacy regulations for the EEA, as set out in each provider's terms.

How long we keep it

• Trial sign-ups that do not become subscriptions: deleted twelve months after the trial ends.
• Subscriber records and send logs: for as long as you subscribe, then twelve months.
• Invoices and payment records: six years after the end of the financial year they relate to, as tax law requires.
• Suppression ("do not email") entries: kept indefinitely, because deleting them is what would cause us to email you again.

3. People connected with companies in our data

This section is the information UK GDPR (Article 14) requires us to give to people whose personal data we obtain from sources other than themselves. We cannot write to every company individually, so we publish it here and link to it from every list we send.

What we hold

For each company incorporated in the UK we hold what the Companies House public register publishes about the company: name, number, date of incorporation, company type, SIC codes and registered office address. We deliberately do not take director names, dates of birth, nationalities, residential addresses or persons-with-significant-control details from the register, and we do not buy data from list brokers.

From the company's own public website, where we find one, we take what it says the business does, a generic business mailbox if one is shown (info@, hello@, enquiries@ and similar — never a named person's mailbox), and whether the telephone number shown is a landline, mobile or non-geographic number. Our crawler identifies itself as SalenovoBot, obeys robots.txt, and fetches only the home, contact and about pages.

From other public sources we add the local authority and region of the registered office (ONS Postcode Directory), whether the company appears on the ICO's register of data-protection fee payers, and whether a food business is registered at its address (Food Standards Agency hygiene-rating data). We then compute our own score, band, classification and formation-channel labels.

When this is personal data

Most of what we hold is information about a company, not a person. It becomes personal data where it identifies an individual — typically a one-person company named after its founder, or a registered office that is someone's home. We treat every record as if it might, and apply the safeguards below to all of them.

Why, and on what legal basis

We process this data to provide business information services: telling firms which newly registered companies are likely to become trading businesses and how to reach them. Our legal basis is legitimate interests (Article 6(1)(f)): ours and our customers' interest in reaching new businesses, and new businesses' interest in hearing from accountants, insurers, suppliers and others at the moment they need them. We have carried out and documented a legitimate-interests assessment. The safeguards that keep the balance in favour of processing are:

• only public-register facts about the company, and fewer of them than the register itself publishes;
• generic business mailboxes only, taken from the company's own site, with the page and date recorded;
• customers are contractually bound to use the data for business-to-business contact only, to say who they are, to offer an opt-out, and never to resell the data (terms);
• a simple opt-out: any company can have its contact details, or its whole record, removed from our lists by asking — see Is your company listed?

Who receives it

Subscribers — firms that pay for a weekly list for a council, region or the UK — receive the company-level records for their area under the licence in our terms. Aggregate counts (how many companies were formed in each area) are published on this site for anyone. Company names and numbers for each council, which are already public on the register, appear on the council pages of this site.

How long we keep it

Register facts are kept indefinitely as part of our historical index of company formations. Website-derived contact details are refreshed when we re-check a company and are dropped when the site no longer shows them. Removal requests are honoured within five working days and the company is suppressed permanently unless it asks to be reinstated.

4. Your rights

Under UK GDPR you can ask us for a copy of the personal data we hold about you (access); ask us to correct it; ask us to delete it; ask us to restrict how we use it; object to processing based on legitimate interests — which for a listed company means asking to be removed; and, for data you gave us under a contract, ask for it in a portable form. Email hello@salenovo.com. We answer within one month and there is no charge. If you are unhappy with our answer you can complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, ico.org.uk/make-a-complaint, 0303 123 1113. We would rather you raised it with us first.

5. Security, children and changes

The site is served over HTTPS. Sign-up records and subscriber data are held in the operator's Google Workspace account and on the operator's own equipment, protected by two-step verification and encryption at rest, and are accessible only to the operator. The service is for businesses and is not intended for anyone under 18. We will post any change to this notice here with a new date, and tell subscribers by email if the change matters to them.