Privacy notice

Who we are

GetStockists is run by Goto-Tender Limited, company number 16627586, registered office 27 Bates Lane, Helsby, Frodsham, England, WA6 9LN. We are the data controller for everything described here. Questions about this notice go to privacy@getstockists.com.

The short version

• We hold public register data about UK shops, and business contact addresses found on their own websites, so that product brands can approach the shops that fit them.
• We contact limited companies and LLPs only, never sole traders, and every email we send names who sent it and has a one-click unsubscribe.
• We hold what you give us as a customer: your email, your brand's website and what it says, the shops you approach and what you log about them. We never see your card number.
• We do not sell data to anyone, we do not use tracking pixels in email, and there are no advertising cookies.

1. Data about shops and the people who run them

What

• From the Companies House register, which is public: company name, number, registered office address, incorporation date and SIC codes, for active limited companies and LLPs in the retail, wholesale and food codes.
• From the Food Standards Agency register, which is public: business name, address and type for new food businesses awaiting inspection.
• From a shop's own website: a trading website address, a business contact email address (a role address such as hello@ or info@ where one exists, otherwise a named address published on the site), whether the site describes a physical shop, and the brands the shop lists as stocking.
• From a verification service: whether that address is deliverable, and the date we checked.
• From our customers: a buyer's name if the customer records one, and the customer's own notes about the shop, which only that customer can see.

Why, and on what basis

Our legitimate interest, and our customers', in helping UK product businesses find and approach the shops that sell their kind of product; and the shops' interest in hearing from suppliers that fit them. We weighed this against the interests of the people concerned: the data is business data, published by the businesses themselves or by a public register, and the contact is a business-to-business approach about stocking a product. Under the Privacy and Electronic Communications Regulations, limited companies and LLPs are corporate subscribers who may be emailed on this basis with an opt-out; we exclude sole traders and partnerships, who may not.

Who sends the emails

Our customers do, from their own email accounts, in their own name. We draft the message and find the address; we do not send to shops on a customer's behalf. For our own cold email to brands (see section 2) we send in our own name.

Opting out

Every email carries an unsubscribe link, and an address on our do-not-contact list is never emailed by us or by a customer through us again; the list is checked before every send. A shop can also write to optout@getstockists.com, and we will add every address for that business.

How long

Register data is refreshed monthly and kept while the business is active on the register. A contact address is kept while it verifies; an address that fails is marked and not shown. Do-not-contact entries are kept permanently, because that is what they are for.

2. Data about brands we write to

We email UK product brands whose details are public (a limited company, a published business address on their site or in a trade-show directory) to show them the shops that fit them. For that we read the brand's public website with a language model to describe its products and prices, build a reading, and send up to three emails. The basis is legitimate interest as above. Reading the site stops the sequence; unsubscribing stops it and puts the address on the do-not-contact list. Readings that are never opened are deleted after twelve months.

3. Data about you, our customer

What

• Your email address and, if you give it, your name. Sign-in is by an emailed link; we hold no password.
• Your brand's website and what our reading of it says: products, prices, where you are based, who stocks you.
• Your wholesale pack: products, prices, terms, images from your site.
• The shops you unlock, watch, hide or approach; the drafts we write; what you log about replies and orders; emails you Bcc to your private logging address or forward to it, which we store to log them against the shop and, for a forwarded reply, read with a language model to classify it.
• Your plan, invoices and the card type and last four digits. Stripe holds the card itself.
• Which pages of the app you use and when, so we can see what works. Opens of your pack link by a shop are recorded against that shop's card, without any personal data about the person who opened it.

Why, and on what basis

To provide the service you pay for (contract). To keep it secure, to bill you and to keep the records the law requires (legal obligation). To understand how the product is used and improve it (legitimate interest). We do not use your data for advertising and do not sell it.

How long

While your account is open and for thirty days after it closes, so you can copy what you need; then it is deleted, except invoices and payment records, which we keep for six years as the law requires, and the do-not-contact list.

4. Who else touches the data

These companies process data for us, under contracts that bind them to this notice. None may use it for their own purposes.

• Supabase: the database that holds everything. EU, Ireland.
• Vercel: hosts the app and serves its pages. EU and US edge, US.
• Cloudflare: DNS, the marketing site, and the inbound email route. global network, EU processing.
• Stripe: takes payments and holds card details; we see the card type and last four digits. EU and US.
• Resend: sends our emails to you: sign-in links, the Monday email, the sequence. US, EU sending region.
• OpenAI: reads your site and writes your drafts and the brand sheet; nothing is used to train their models. US.
• Reoon: checks that an email address is deliverable when you unlock a shop. US.
• postcodes.io: turns a postcode into coordinates for the radius. UK.

Where a processor is outside the UK, transfers rest on the UK International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses, or on an adequacy decision. We will name any new processor here before it starts.

5. Cookies

The app sets one cookie, which keeps you signed in; it is strictly necessary and needs no consent. The marketing site uses Cloudflare Web Analytics, which sets no cookie and holds no personal data. Nothing else. See the cookie notice.

6. Your rights

You can ask for a copy of what we hold about you or your business, have it corrected or deleted, object to our using it, ask us to restrict what we do with it, or take it elsewhere. Write to privacy@getstockists.com; we answer within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

7. Changes

When this notice changes we say so at the top, and if the change matters to you we email you first.