Privacy notice

How Salenovo uses personal data

Salenovo sells information about newly registered UK companies to firms that want to contact them. This notice covers two groups of people: the visitors, trial users and subscribers who use this site, and the people who may be identifiable through a company that appears in our data. It says what we hold, why, on what legal basis, for how long, and what you can do about it.

Last updated 21 October 2026

1. Who we are

The data controller is Salenovo Ltd, a company registered in England and Wales (company number 17455275), registered office 10 George Close, Canvey Island, Essex, SS8 9PU. You can reach us at hello@salenovo.com for anything in this notice. Our ICO registration reference is ZC246652.

2. Visitors, trial users and subscribers

What we collect

When you start a free trial or a free weekly alert: your work email address, the council, region or UK tier you chose, the buyer type you picked (for example "accountants"), the page you signed up from, and the date. If you tell us your name we keep that too.
When you subscribe: the same, plus your billing name and address and a record of payments and invoices. Card payments are taken by Stripe; we never see or store card numbers.
When you email us: the message and your address, so we can reply.
When we email you: a log of which weekly list was sent to which address on which date, so that nothing is sent twice and so we can show what you received.
When you use the site: we use GoatCounter, a privacy-focused analytics service that counts page views, referrers and the events "form submitted" and "button clicked". It sets no cookies, does not identify individual visitors, and does not share data with anyone else. This site sets no cookies of its own. Fonts and images are served from this site itself; the only other service a page contacts is GoatCounter, for the counts described here.
If we email you: links in our emails carry a short code, so we can see that an email was worth clicking and which link was used. The code identifies the mailbox we wrote to, not you as a person, and nothing you do anywhere else. It is removed from the address bar as soon as the page opens, so it is not passed on if you share the link, and if you go on to start a trial it tells us which email brought you. We do not use tracking pixels or read receipts, so we cannot tell whether an email was opened or read. Codes are kept for twelve months. Reply "stop" to any email and we will stop writing to you and stop using the code.

Why, and on what legal basis

To deliver the trial, the weekly lists and the subscription you asked for, and to tell you before a trial ends whether and how to continue: performance of a contract (UK GDPR Article 6(1)(b)).
To answer your questions and to send service messages (a change to the lists, a problem with delivery, a change to these terms): legitimate interests in running the service (Article 6(1)(f)).
To keep invoices and payment records: legal obligation (Article 6(1)(c): tax and accounting law).
To understand which pages and buyer types bring sign-ups, and whether the emails we send are useful: legitimate interests. Site analytics are anonymous; the only identifier we add is the link code in our own emails, described above.

We do not sell or share your details with anyone for their marketing, and we do not send marketing about anything other than Salenovo itself. Every email we send tells you how to stop it: reply "stop", or use the link in the email.

Firms we contact about Salenovo

We occasionally email accountancy practices and other firms to tell them about Salenovo. Those emails go to a generic mailbox (such as info@ or hello@) published on the firm's own website. Where a firm's site shows no generic mailbox, only a named one, we may write to that address instead, and only to an address on the firm's own website. We write to limited companies and LLPs only, and each email says who we are and how to opt out. This is B2B marketing under the Privacy and Electronic Communications Regulations (PECR) and our basis is legitimate interests. If you ask us to stop, your address goes on a suppression list so that we do not email it again; that list is the one record we keep of you.

Who processes your data for us

Formspree (United States) receives sign-up form submissions and forwards them to us.
Google Workspace (Google LLC, United States, with UK/EU data centres) hosts our email and the sign-up records.
Stripe Payments UK Ltd processes card payments and subscriptions; Stripe is a controller in its own right for payment data and publishes its own privacy notice.
GoatCounter (operated from Ireland, data held at Hetzner in Germany and Finland) provides the site analytics described above; it stores no IP addresses. The link code from our emails is recorded there as an event, and only we can match it back to a mailbox. The list that does so stays on our own machine and is never uploaded.
Render (United States) hosts the website; it sees the ordinary server logs (IP address, page requested, time) that any web host sees, kept for a short period for security.

Where a provider is outside the UK, transfers rely on the UK Extension to the EU-US Data Privacy Framework (for certified US providers), the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK adequacy regulations for the EEA, as set out in each provider's terms.

How long we keep it

Trial sign-ups that do not become subscriptions: deleted twelve months after the trial ends.
Subscriber records and send logs: for as long as you subscribe, then twelve months.
Invoices and payment records: six years after the end of the financial year they relate to, as tax law requires.
Suppression ("do not email") entries: kept indefinitely, because deleting them is what would cause us to email you again.

3. People connected with companies in our data

This section is the information UK GDPR (Article 14) requires us to give to people whose personal data we obtain from sources other than themselves. We cannot write to every company individually, so we publish it here and link to it from every list we send.

What we hold

For each company incorporated in the UK we hold what the Companies House public register publishes about the company: name, number, date of incorporation, company type, SIC codes and registered office address. We do not take director names, dates of birth, nationalities, countries of residence, occupations or residential addresses, and we do not buy data from list brokers.

From an officer's record we keep only what a company did, never what a person is: the role, the dates of appointment and resignation, whether the officer is itself a company, and how many other companies on the register that officer is recorded against. The last of those is what the score is built from, it is never shown to anyone, and it never leaves our own systems. From a person-with-significant-control record we keep only how the company is controlled: whether control sits with an individual or with another company, and the share and voting bands. Nothing that says which individual.

Companies House now also shows, for each director, whether they've verified their identity with it, the date by which they must, and the name of the authorised agent that verified them. From that we keep only a summary for the company: how many of its directors still have an identity verification statement due, the earliest date one is due, and whether any of its directors was verified through an agent (yes or no). We don't keep the dates for each person, the agent's name, or the name a director gave the agent. Subscribers to an accountancy list see that a company has a statement due, by when, for how many of its directors, and whether any of them was verified through an agent (yes or no), until that date passes. It never says or suggests that anyone has failed to do what the law asks.

From the company's own public website, where we find one, we take what it says the business does, a generic business mailbox if one is shown (info@, hello@, enquiries@ and similar). Where the site shows no generic mailbox, only a named one, we record that address for our daily lead feed only, described below; it never goes into the weekly lists. We also take the address of its contact page when it shows no mailbox, and the telephone number shown, with whether it is a landline, mobile or non-geographic number. Subscribers to the weekly lists see the number only when it's a landline or an 03 number. A mobile is often someone's own phone, so for a mobile they see only that there's one, with a link to the page of the company's site that shows it: the number itself isn't copied into their list. Customers of our daily lead feed are the exception, described below. Our crawler identifies itself as SalenovoBot, obeys robots.txt, and fetches only the home, contact and about pages.

From published business listings: Overture Maps Places, a free monthly release of business listings from the Overture Maps Foundation (its sources are named in each row we use, and it may be passed on under the CDLA Permissive 2.0 and Apache 2.0 licences). Where a business is listed under the company's own name at the company's own postcode, we take the listing's landline or 03 number and its website, and say on the row where the number came from. For the weekly lists we never take a mobile number from a listing, or a number listed at an address shared by many companies, such as a formation agent's.

From other public sources we add the local authority and region of the registered office (ONS Postcode Directory); whether the company appears on the ICO's register of data-protection fee payers; whether a food business is registered at its address, and its latest hygiene rating (Food Standards Agency); figures from the accounts the company files at Companies House (employees, assets, turnover where it's filed, whether it owns land or buildings, and whether the accounts are dormant); its registered charges (the lender, the dates, and the postcode and a short description of any property a charge names, never anyone's name); filings as Companies House receives them (a new director, new shares, a change of name, or a new person with significant control: the kind of filing and its date, never who); public contracts the company has won (Contracts Finder and Find a Tender, Cabinet Office); and whether the Home Office has licensed it to sponsor workers from overseas, with the route and rating as the Home Office publishes them (its register of licensed sponsors; we keep it only for companies, never the name of a sole trader on the register). Flood risk (Environment Agency) and recorded crime (police.uk) describe the area around an address, never the company or the people there. We then compute our own score, band, classification and formation-channel labels, and the events we report, such as "first employees" or "moved away from an accountant's address".

Our daily lead feed. A few business customers, such as energy suppliers, take a daily file of businesses that have just taken on premises: a care home, nursery, pharmacy, garage, depot or shop newly on a public register (the Care Quality Commission, Ofsted, the NHS, the DVSA, the Traffic Commissioners, the Care Inspectorate in Scotland, Care Inspectorate Wales, Public Health Scotland, and councils' food, licensing and business rates registers where their licence or their permission allows), or a new company with a trading address. It also carries what a building's energy certificate says about the building (its floor area, heating and rating, never the certificate's address details), Ofcom's broadband figures for the postcode, and the public contracts and changes of control described above. Each row is the business, its premises and how to reach it. Where the only number a business publishes, on a public register, on its own website or in a business listing under its own name, is a mobile, the feed includes it in a column of its own, marked as a mobile, so it's never mistaken for a switchboard. In the same way, where a business's own website shows no generic mailbox, only a named one, the feed includes that address in a column of its own, marked as a named address. The feed's customers are told to write only about their business service, to say who they are, and to stop the same day if asked. The feed's customers are told to screen every number against the TPS and Corporate TPS, to ring a mobile rather than text it, and to try the landline or a letter first. The feed leaves out sole traders and partnerships, and every company on our removal list.

When this is personal data

Most of what we hold is information about a company, not a person. It becomes personal data where it identifies an individual: typically a one-person company named after its founder, or a registered office that is someone's home. We treat every record as if it might, and apply the safeguards below to all of them.

Why, and on what legal basis

We process this data to provide business information services: telling firms which newly registered companies are likely to become trading businesses and how to reach them. Our legal basis is legitimate interests (Article 6(1)(f)): ours and our customers' interest in reaching new businesses, and new businesses' interest in hearing from accountants, insurers, suppliers and others at the moment they need them. We have carried out and documented a legitimate-interests assessment. The safeguards that keep the balance in favour of processing are:

only public-register facts about the company, and fewer of them than the register itself publishes;
generic business mailboxes only in the weekly lists, taken from the company's own site, with the page and date recorded; in the daily lead feed, a named address only where the site shows no generic one, in its own marked column;
mobile numbers never copied into the weekly lists; in the daily lead feed, only a number the business published itself, in its own marked column, with the advice to ring rather than text;
customers are contractually bound to use the data for business-to-business contact only, to say who they are, to offer an opt-out, and never to resell the data (terms);
a simple opt-out: any company can have its contact details, or its whole record, removed from our lists by asking (see Is your company listed?)

Who receives it

Subscribers (firms that pay for a weekly list for a council, region or the UK) receive the company-level records for their area under the licence in our terms. Customers of our daily lead feed receive the records described above for the businesses in their file, under written terms that limit their use to contacting those businesses from inside their own business. Aggregate counts (how many companies were formed in each area) are published on this site for anyone. Company names and numbers for each council, which are already public on the register, appear on the council pages of this site.

How long we keep it

Register facts are kept indefinitely as part of our historical index of company formations. Website-derived contact details are refreshed when we re-check a company and are dropped when the site no longer shows them. Removal requests are honoured within five working days and the company is suppressed permanently unless it asks to be reinstated.

4. Your rights

Under UK GDPR you can ask us for a copy of the personal data we hold about you (access); ask us to correct it; ask us to delete it; ask us to restrict how we use it; object to processing based on legitimate interests (which for a listed company means asking to be removed); and, for data you gave us under a contract, ask for it in a portable form. Email hello@salenovo.com. We answer within one month and there is no charge. If you are unhappy with our answer you can complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow SK9 5AF, ico.org.uk/make-a-complaint, 0303 123 1113. We would rather you raised it with us first.

5. Security, children and changes

The site is served over HTTPS. Sign-up records and subscriber data are held in the operator's Google Workspace account and on the operator's own equipment, protected by two-step verification and encryption at rest, and are accessible only to the operator. The service is for businesses and is not intended for anyone under 18. We will post any change to this notice here with a new date, and tell subscribers by email if the change matters to them.

15 October 2026. Where a business's own website shows no generic mailbox, only a named one, we may now write to that address ourselves, and our daily lead feed includes it in a column of its own, marked as a named address. The weekly lists still carry generic mailboxes only.

5 October 2026. We started keeping a company-level summary of whether its directors have an identity verification statement due at Companies House, and by when, as described in section 3. Nothing about any one director is kept.

21 September 2026. We stopped keeping officers' birth month and year, nationality, country of residence and occupation, and the same details for people with significant control. They were never used to score a company, never shown and never sold, and the records we held were deleted on this date. An earlier version of this notice said we did not hold them.