# The 2 documents you need before you send A companion to winnowed.co.uk/guide, step 03. Holding a list of business contacts makes you the data controller for it. Two short documents follow from that. Neither is hard, both are usually skipped, and the first one is the only thing that helps if anybody ever asks. Fill in everything in [SQUARE BRACKETS]. Delete what does not apply. Keep document 1 in a folder; publish document 2 on your website. **This is a starting structure, not legal advice.** It is written for an ordinary business-to-business list built from the public register. If your case is unusual, or you are processing at large scale, get someone qualified to look at it. The Information Commissioner's Office publishes its own template and it is worth reading alongside this one. --- # Document 1 - Legitimate interests assessment Keep this one. Nobody asks to see it until something goes wrong. **Controller:** [Your company name, company number, address] **Prepared by:** [Name, role] **Date:** [Date] **Review date:** [12 months from now] **What this covers:** [e.g. a list of 2,000 United Kingdom limited companies in the [trade] sector, built from the Companies House register and each company's own website, used for business-to-business marketing by email and telephone] There are 3 parts and you need all 3. An assessment with only the first is the most common way this is got wrong. ## Part 1 - The purpose test *Why do you want to process this data, and is that a legitimate interest?* - **The interest:** [e.g. finding [trade] businesses who may want [what you sell], so we can tell them it exists] - **Who benefits:** [Us, through new customers. The recipient, if what we sell is useful to them - say plainly how.] - **Is it lawful and ethical:** [e.g. Yes. Business-to-business marketing to corporate subscribers is permitted under the Privacy and Electronic Communications Regulations without prior consent, provided we identify ourselves and offer an opt-out in every message. We do both.] - **How important is it:** [Do not overstate this. "Commercially important to us, not urgent, not a public interest" is a perfectly good answer.] ## Part 2 - The necessity test *Is the processing actually necessary for that purpose?* - **Why we need these details:** [e.g. We cannot contact a business without a way of reaching it. The address we hold is the one that business publishes on its own website for enquiries.] - **Could we do it with less:** [e.g. We hold only what we need to make contact and to know who we are contacting: company name, number, website, a published contact address or telephone number, and the trade code. We hold no personal details of any named individual.] - **Is there a less intrusive route:** [e.g. We considered [advertising / inbound / a trade body list]. Say why it does not reach the same businesses, or say that it does and this is additional.] ## Part 3 - The balancing test *Do the interests of the people involved override yours?* - **Whose data is it:** [e.g. Registered companies only. Sole traders do not appear on the register and are not in this list. Where the only published address belonged to a named individual it was withheld at source and we hold the company's telephone number instead.] - **What is their relationship to us:** [e.g. None. This is cold contact, and we do not pretend otherwise.] - **Would they expect this:** [e.g. A business that publishes an enquiries address on its own website expects enquiries at it. That is what the address is for.] - **What is the impact on them:** [e.g. One email, and at most 2 follow-ups, to a business address, which they can stop with one reply. Low.] - **Is any of it sensitive:** [e.g. No special category data, no children, no vulnerable individuals.] - **How do we reduce the impact:** [e.g. Opt-outs honoured permanently and across every future campaign. Hard bounces suppressed. No more than 3 messages in a sequence. We say where we found them in the first message.] ## The conclusion [e.g. We can rely on legitimate interests for this processing. The interest is genuine and commercial, the data is the minimum needed to act on it, it is published by the businesses themselves for this purpose, and the impact is small and reversible at the recipient's request.] **Signed:** [Name] **Date:** [Date] --- # Document 2 - The privacy notice Publish this at a fixed address on your website, e.g. [yourdomain.co.uk/privacy], and link it from the first message. Article 14 of the United Kingdom General Data Protection Regulation asks you to tell people their details came from a public source, and this is where you do it. --- ## How we use business contact details **Who we are:** [Company name], [company number], [registered address]. Contact us at [email address]. **What we hold:** Business contact details - company name and number, website, a published contact address or telephone number, trade classification and registered location. [Add anything else you hold. Delete what you do not.] **Where we got them:** From the free Companies House register, and from each company's own website, where the details are published for enquiries. We did not buy this list and we did not collect it from you directly. **Why we hold them:** To tell [trade] businesses about [what you sell]. Our lawful basis is legitimate interests. [If you want to: you can ask us for a copy of our assessment.] **How long we keep them:** [e.g. Until they are no longer accurate or useful, and no longer than [24] months, after which the list is rebuilt from the register. Opt-out records are kept indefinitely, because that is the only way to honour them.] **Who we share them with:** [e.g. Our email sending platform, [name], which sends on our behalf. Nobody else. We do not sell or pass on contact details.] [Name any other processor.] **Your rights:** You can ask us what we hold about you, ask us to correct it, ask us to delete it, or object to us using it. Email [address] and we will act on it. You can also complain to the Information Commissioner's Office at ico.org.uk. **To stop hearing from us:** Reply to any message with STOP, or email [address]. We keep a permanent record so it holds across every future campaign, not only this one. **Last updated:** [Date] --- ## The line for the first message One sentence, in the body, not buried in the footer: > I found your details on your own website, via the Companies House register. > How we handle them is at [yourdomain.co.uk/privacy], and you can stop this > with a one-word reply. That single sentence, plus a reachable notice, is what the Article 14 duty comes to for most senders.