Privacy & Data Policy

Last updated: 27 August 2026 · Version 1.0

1. Who we are

ExpansionIQ is operated by Aiden Wadsworth, a sole trader based in the United Kingdom, trading as ExpansionIQ (“we”, “us”). We are the data controller for the personal data described in this policy.

You can reach us about anything in this policy, or to exercise any of your rights, at privacy@expansioniq.co.uk. A postal address for written correspondence is available on request.

We are registered with the Information Commissioner’s Office (ICO) under registration reference ZC232812.

Where we build and deliver records into a client’s own systems, that client is the controller for their subsequent use of the data, and we act as a separate controller for the sourcing and verification we carry out.

2. The personal data we process

a. Business contact data in our intelligence records

Our core product identifies commercial sites that are expanding and the decision-makers responsible for them. To do that we process business-role contact data: an individual’s name, job title or role, employer, corporate email address and corporate telephone number, and the site or project they are associated with. This is professional information about people acting in a business capacity, not their private lives.

Lawful basis: UK GDPR Article 6(1)(f) – legitimate interests. Our legitimate interest is enabling business-to-business sellers to reach the right person about a relevant commercial project; we balance this against the individual’s interests and rights, and process only role-based data proportionate to that purpose. For business-to-business electronic marketing, we rely on the corporate subscriber exemption in Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR).

b. Enquiries you send us

If you use the enquiry form or email us, we process the details you provide – typically your name, work email address, company, and the content of your message – so that we can respond and, if it goes further, scope a piece of work with you.

Lawful basis: Article 6(1)(f) legitimate interests (responding to a request you initiated) and, where relevant, Article 6(1)(b) (taking steps at your request before entering into a contract).

3. Where the record data comes from

The business contact data in our products is built from named, primary sources – for example planning applications and approvals, published corporate releases, licensing and lodgement records, and other publicly available business information. Every record traces back to an identifiable source reference. We verify contact details before delivery rather than relying on scraped bulk lists.

4. Who we share data with

We do not sell your personal data. We share data only with:

• Our clients – the business-role records we produce are delivered to the client who commissioned that work, for their own business-to-business outreach.
• Web3Forms – the enquiry form is delivered to our inbox through Web3Forms, which processes the form contents in transit on our behalf. See their privacy terms at web3forms.com/privacy-policy.
• Our email and IT providers – Google Workspace hosts the inbox that receives enquiries and our business correspondence.
• Google Fonts and Cloudflare – this site loads fonts and icons from Google Fonts and Cloudflare’s CDN. When your browser fetches those files it sends your IP address to those providers as part of the request. We set no cookies and receive no analytics from them.

We are UK-based. Some of the third-party services above may process data outside the UK on our behalf; where they do, it is under the safeguards required by UK data protection law.

5. Cookies and tracking

This website uses no cookies and no analytics, advertising, or fingerprinting technologies. Nothing about your visit is stored on your device by us, and we do not build a profile of you from your browsing. That is why you will not see a cookie banner – there is nothing to consent to.

6. How long we keep data

• Enquiries: kept for 24 months after our last contact, then deleted, unless they become part of a client relationship.
• Record data: reviewed and refreshed on an ongoing basis; records that are no longer accurate or relevant are removed.
• Suppression list: if you opt out, we keep the minimum information needed to keep you suppressed (so we don’t re-add you) for as long as we operate.

7. Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing, and to data portability where it applies. Because we rely on legitimate interests, you have the right to object to our processing at any time, and an absolute right to object to direct marketing – if you do, we will stop.

To exercise any right, email us at the contact address in section 1. We will respond within one month. You will not be charged, and you do not have to give a reason to opt out of marketing.

If you are unhappy with how we have handled your data, you can complain to the ICO at ico.org.uk/make-a-complaint, though we would appreciate the chance to put things right first.

8. Opting out and suppression

Opt-out is honoured on first request and suppressed across every territory we operate in. One request is enough – you do not need to repeat it for different brands, regions, or sites. Email us at the contact address in section 1 and we will remove you and add you to our suppression list so you are not re-added.

9. Responsible disclosure & security contact

10. Changes to this policy

We may update this policy as our processing or the law changes. The “last updated” date at the top reflects the current version. Material changes will be reflected here before they take effect.