Privacy notice
Version 18 October 2026
Provider: NewFoodLeads.com is part of the Nimbus Labs Group (Nimbus Labs Ltd), registered in {{COMPANY_COUNTRY}}, no. {{COMPANY_NUMBER}}. Registered office: {{REGISTERED_OFFICE}}. Contact: {{CONTACT_EMAIL}}
Controller: Nimbus Labs Ltd, the provider named above. UK GDPR and PECR. ICO registration number: {{ICO_REGISTRATION}}.
What we collect
- Sign-up: your email, the councils and business types you pick, when you signed up and the exact wording you saw, a hashed (scrambled) IP address and a hashed browser string. Hashed values are not your IP address but are still personal data, so we treat them as such.
- Payments: handled by Stripe. We keep the Stripe customer id, plan status and the date your period ends. We never see your card number.
- Email activity: when we queue or send you an email, and unsubscribe requests. We do not use tracking pixels or open tracking.
- Campaign labels (utm_source, utm_campaign) if you arrive from a link of ours, so we can see which marketing works.
You must give us your email and at least one council to receive the service; everything else is optional.
Why we use it (lawful basis)
| Purpose | Basis |
|---|---|
| The weekly email you signed up and pay for; sign-in/confirm messages; receipts | Contract (Art. 6(1)(b)) |
| Do-not-email record after you unsubscribe | Legitimate interests (Art. 6(1)(f)): so we do not email you again |
| Sign-up record (what you agreed to), kept 6 years with your email hashed | Legitimate interests: in case of a legal claim |
| Accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Offers or news | We do not send these. If we ever do, we will ask first with a separate unticked box. |
How we use the public food hygiene register
We read the FSA's open data (Open Government Licence v3.0) every night. It lists food premises, which can include the names and home addresses of sole traders, who are not our customers. We did not collect this directly from them (UK GDPR Art. 14). To protect them: we keep and show only the business type, council, postcode district and rating status; we remove street addresses, phone numbers and emails; we hide any name that looks like a personal name; and we hide premises with no postcode. Company names (Ltd, Limited, LLP, PLC) are shown. Basis: legitimate interests (Art. 6(1)(f)): helping food suppliers find new businesses, with these safeguards (our assessment is available on request). You can ask us to remove or hide any entry, or object, by emailing {{CONTACT_EMAIL}}; we will act within a month. Source: Food Standards Agency, ratings.food.gov.uk.
Emails (PECR)
We send the weekly list you signed up and pay for and service messages about your account. We only send once you have confirmed your email (double opt-in) and your payment is active. Every weekly email has an unsubscribe link (and a one-click header). Unsubscribing stops emails; it does not cancel billing.
How long we keep things
| What | How long |
|---|---|
| Unconfirmed sign-ups | 30 days |
| Emails we sent you (record, not the body) | 180 days; dry-run previews and one-time links 30 days or less |
| After you cancel or unsubscribe | Account data deleted within 30 days; email kept on a do-not-email list for 3 years |
| Billing and sign-up record | 6 years after your account ends, with your email hashed |
| Register entries for premises that leave the FSA file | 90 days |
| Backups | Deleted within 90 days |
Who handles your data for us
- Cloudflare, Inc.: hosts the website and the database (D1), runs our scheduled jobs and sends our email. Processor. The database runs outside the UK (location to be confirmed: {{D1_LOCATION}}).
- Stripe Payments Europe/Stripe, Inc.: takes payment. Independent controller for its own payment and fraud records; processor for the billing portal.
- We use no advertising, analytics or AI service on your data. We do not sell data.
International transfers
Cloudflare and Stripe may process data in the USA and elsewhere under the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.
Your rights and complaints
You can ask to see, correct, delete, restrict or move your data, or object, by emailing {{CONTACT_EMAIL}}. We reply within one month. Complaints: tell us first and we will acknowledge within 30 days and reply promptly. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.