Privacy notice
Last updated 8 September 2026.
Who I am
CBT Consulting Ltd, trading as Cited Search, registered in England and Wales, company number 15359662. I am the data controller for the personal data described here.
Contact: 07710 997650, or the contact form.
If you contacted me
When you send the profile check form I collect your name, email address, business name, location, and your phone number and notes if you give them. I use this only to carry out the check you asked for and to reply to you. The basis is your request, which is a step taken at your request before entering into a contract, and my legitimate interest in answering enquiries.
I keep enquiries for two years so I can pick up a conversation you started, then delete them.
If I contacted you first
This is the section that matters if you received an unsolicited email from me and came here to find out why.
Where your details came from
I build a list of businesses in south west Wales from public sources:
- The Companies House public register: company name, number, registered address, nature of business, and status.
- Google Maps and Google Business Profile: the publicly listed business name, category, address, phone number, website and review information.
- The business's own website, where one exists, including a published business contact address.
I do not buy lists, and I do not guess or generate email addresses.
Why I am allowed to email you
Two separate rules apply and I meet both.
Marketing rules. The Privacy and Electronic Communications Regulations treat companies and limited liability partnerships as corporate subscribers, who may be sent business-to-business marketing without prior consent. I filter my list against the Companies House register and contact only incorporated bodies. Sole traders and ordinary partnerships are excluded. Every message identifies me and gives you a way to opt out, as regulation 23 requires.
Data protection rules. A named person's work contact details are still personal data under the UK GDPR. My basis is legitimate interests under Article 6(1)(f): my interest in offering a relevant service to a business likely to want it. I have assessed this against your interests. The contact is business-to-business, the details are already published by the business, the message is relevant to something specific and verifiable about that business, the volume is low, and you can stop it in one reply. If you object, that ends it.
What I hold, and for how long
The business name and number, the registered and trading address, the nature of business, the public contact details, what I found when I looked at the profile, and a record of anything I sent you and any reply.
I delete records for businesses I have not contacted after twelve months. Where I have contacted you, I keep the record for two years so I do not contact you twice about the same thing.
The suppression list
If you opt out, I keep the minimum needed to honour that: your business name and contact details on a do-not-contact list. This is itself a legitimate interest, because the only way to reliably never contact you again is to remember not to. I will not use that record for anything else.
How to stop hearing from me
Reply to the email and say so, or ring 07710 997650. No form, no unsubscribe portal, no reason needed. I will confirm it and add you to the suppression list the same day.
Your rights
- Object to my use of your data for direct marketing. This is absolute: if you object I must stop.
- Access a copy of what I hold about you.
- Rectify anything inaccurate.
- Erase your data, subject to the suppression list above.
- Restrict or object to processing on other grounds.
Ask by phone or by replying to anything I have sent you. I will respond within one month.
If you are unhappy with how I have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. I would rather you told me first so I can put it right.
Who else sees your data
My email and file storage is provided by Google Workspace. Form submissions are processed by Netlify, who host this site. Both act on my instructions as processors. I do not sell or share your data for anyone else's marketing.
This website
This site sets no cookies, runs no analytics, and embeds no tracking. Web fonts are loaded from Google Fonts, which means Google receives your IP address in order to serve the font files. Your browser records the pages you visit locally, as it does for any site.
Changes
If I change how I use personal data I will update this notice and change the date at the top.