Business outreach privacy notice
This notice explains how we use business contact information when we introduce Phoenix SFX services to relevant organisations and professional contacts.
Who is responsible for your information
Phoenix SFX Ltd is the controller for the processing described in this notice. Our company number is 16462167 and our registered office is Hill Park Farm, Wrotham Hill Road, Wrotham, Sevenoaks, Kent TN15 7PX.
For privacy questions, rights requests or complaints, email ollie@phoenixfireworks.co.uk, reply to our message, or write to the registered office above.
What information we use
- the organisation’s name, type, website and business location;
- a published business email address, telephone number, contact name, job title or department where relevant;
- the public source and date on which contact information was checked;
- our assessment of whether the address and organisation are suitable for business outreach; and
- messages, replies, contact dates, follow-up dates and communication preferences.
We do not intentionally collect special-category information or children’s information for prospecting.
Where the information comes from
Details may come directly from you, from your organisation’s website, a public venue or business directory, a sports governing-body or league directory, another published professional source, or earlier correspondence with us. You may ask us which source is recorded for your details.
Why we use it and our lawful basis
We use relevant business contact information to introduce our special-effects, production and firework services, discuss suitable projects, respond to enquiries, follow up appropriately and maintain accurate communication preferences.
For appropriate contacts at corporate subscribers, we may rely on our legitimate interests in developing relevant business relationships. Before doing so, we consider the purpose, whether using the information is necessary, and the effect on the individual. We limit outreach to relevant organisations and roles and stop if someone objects.
Where the Privacy and Electronic Communications Regulations require consent for electronic marketing — including many sole traders, ordinary partnerships and unincorporated organisations — we only send marketing where we have recorded valid consent or can document that a lawful exception applies. Publication of an address online is not treated as consent.
Where we need to retain information to comply with law, handle a complaint or establish, exercise or defend legal claims, the relevant legal obligation or legitimate interest also applies.
Who receives the information
Access is restricted to authorised people within Phoenix SFX Ltd who need the information for their work. We use Microsoft 365 to send and receive email and a company-controlled local contact register to manage outreach. We may also use carefully selected IT, website, security and backup providers acting under appropriate contractual and confidentiality obligations. We do not sell the outreach contact list.
We may disclose information where the law requires it, or where reasonably necessary to protect legal rights, investigate misuse or respond to a lawful request.
International processing
Some technology providers may process information in the UK, the European Economic Area or other countries. Where information is transferred outside the UK, we require an applicable UK adequacy regulation or another lawful safeguard, such as approved contractual protections. Contact us if you would like more information about the safeguard relevant to your information.
How long we keep it
We review active prospect details and their public source at least every six months. We remove or anonymise information that is inaccurate, no longer relevant or no longer needed for a justified purpose. We assess correspondence according to why it must be retained; project, complaint and legal-claim records may be kept for longer where necessary, normally no longer than six years after the relevant relationship or matter ends.
When someone opts out, we retain a minimal suppression record for as long as reasonably necessary to prevent accidental future marketing. Suppression does not give us permission to use the address for another purpose.
Your rights
Depending on the circumstances, you may ask us for access to your personal information or request correction, erasure, restriction or portability. You may object to processing based on legitimate interests. Your right to object to the use of your personal information for direct marketing is absolute. Where we rely on consent, you may withdraw it at any time.
We may ask for proportionate information to confirm identity or authority before acting on a request. Rights requests are normally answered within one calendar month, subject to any lawful extension.
Complaints
You can make a data-protection complaint using the contact details above. You do not need a special form or legal wording. Tell us what happened and what you would like us to investigate. We will acknowledge a complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome and any action taken.
You may also complain to the Information Commissioner’s Office. We would appreciate the opportunity to address your concern directly first.
Automation and security
Our outreach register can schedule one message at a time, record confirmed sends, match replies and stop follow-ups. It flags uncertain replies, privacy questions and complaints for human review. It does not make decisions that produce legal or similarly significant effects about people. We do not add tracking pixels to these outreach messages.
We use access restrictions and other proportionate technical and organisational measures to protect the information. No method of storage or transmission is completely secure, so we review the controls as our systems and risks change.
Changes to this notice
We will update this notice when our processing or the law changes. The current version will remain available at the same public address.