Privacy Policy

1. Scope and our role

This Privacy Policy explains how we collect, use, disclose and retain personal information in connection with our website and our downloadable business databases and datasets. “We”, “us” and “our” refer to the operator of the b2blistsg.com website, which is the controller of the personal information described in this Policy.

The Policy covers two different groups: people who visit our website, open an account, place an order or contact us; and people whose publicly available professional or business contact information is included in a Dataset. You do not need to be our customer to request information about, correct, object to or seek removal of a record concerning you.

Information relating only to a legal entity may not be personal information. A named employee's business email address, a sole trader's details or another record identifying a person may be personal information even when published in a business context. Public availability does not automatically permit unrestricted collection, resale or marketing use.

We determine the purposes and means of our own collection, preparation and licensing of Datasets and are responsible for that processing. Customers who download a Dataset normally determine their own subsequent uses and act as separate controllers or equivalent responsible entities. A customer does not become our processor merely by purchasing a Dataset. We do not transfer our own privacy obligations to customers.

This Policy is a transparency notice. Visiting the website, accepting our Terms of Service or purchasing a Dataset does not by itself constitute consent to every use of personal information described here.

2. Information about website users and customers

Depending on how you use the service, we process the following categories:

• Account and contact information: name, email address, company, business contact details, account identifier and authentication information.
• Order and billing information: products purchased, prices, currency, invoice details, billing address, relevant tax details, transaction references, payment status and refund history.
• Acceptance and delivery records: the Terms version accepted, required immediate-supply choices, timestamps, Dataset identifiers, access and download events, file-transfer status and related technical records.
• Support information: messages, attachments you choose to provide, complaint or refund details, privacy requests and our responses.
• Technical information: IP address, browser and device information, operating system, session identifiers, pages requested, security events and approximate location derived from an IP address.
• Preference information: cookie choices, marketing subscriptions and opt-out or suppression records.

Optional analytics or advertising, where enabled, can generate additional information about website interactions or identifiers, as explained in Section 7 and the relevant cookie information. We do not use private customer account, billing or payment-dispute information as material for commercially licensed contact Datasets.

Payments are processed through the payment provider identified at checkout. We use transaction references, payment status and necessary billing details to administer orders. Do not send full payment-card details or card security codes to us in support messages. The payment provider's own privacy notice explains its processing and responsibilities.

Information needed to process an order, deliver a file or satisfy a legal billing requirement is necessary for those purposes. If it is not provided, we may be unable to complete the order. Optional marketing and optional tracking are not conditions for buying a Dataset.

3. Information contained in Datasets and its sources

Our Datasets contain the business information described on their product pages. Depending on the Dataset, records can include an organisation's name, industry, location, business address, website, business email address, telephone number and publicly listed professional contact details. Records relating to an individual can also include a name, role, employer or business affiliation, professional profile link and associated source information.

Sources include publicly accessible business websites, business directories, public company or professional registers, public business listings and publicly visible professional profiles, where collection and subsequent use are lawful. An individual or organisation may also provide corrections directly to us. The product description identifies relevant source categories; you may contact us to request available information about the particular source of a record concerning you.

Our intended Dataset scope is professional and business information. We do not intentionally collect intimate or sensitive information, private credentials, private messages or information obtained by circumventing account-access restrictions for inclusion in these Datasets. If you believe a record contains inappropriate or sensitive personal information, contact us so that we can investigate and, where required, remove or restrict it.

Source information can be inaccurate, incomplete or outdated. Our Terms of Service explain the limitations of public-source data and any product-specific commitments. Those limitations do not remove an individual's privacy rights, including applicable rights to correction or deletion.

4. Purposes and legal grounds

We process information only for a defined purpose and a legal ground permitted by applicable law. Where the EU or UK GDPR applies, the relevant grounds are described below; other applicable laws may use different terminology or requirements.

Our interests in Dataset processing are organising relevant professional information into usable business directories, supporting lawful business research and supplying the described data products. Commercial benefit or public availability alone does not establish a valid legal ground.

5. Who receives information

We disclose only information necessary for the relevant purpose, subject to applicable legal requirements:

• Service providers: providers of hosting, storage, account infrastructure, email delivery, customer support, security and payment processing; and analytics or advertising providers only where those tools are enabled lawfully. Their role may be a processor, service provider or separate controller depending on the service and applicable law.
• Dataset customers: organisations and professionals purchasing the relevant Dataset for business research and other permitted professional activities. Delivery of a Dataset can include the business contact information described in Section 3.
• Professional advisers and authorities: legal, accounting or other advisers, courts, regulators and public authorities where necessary and lawful.
• A business successor: a prospective or actual purchaser in a merger, acquisition or restructuring, subject to appropriate safeguards, applicable restrictions and any notice or consent required by law.

We license Datasets for a fee. Where a Dataset contains protected personal information, supplying it to customers may constitute a “sale” or another regulated disclosure under applicable privacy law. We do not describe such disclosure as “not a sale” merely because it is structured as a licence or the original source was public. Statutory exclusions for particular public information apply only where their requirements are met.

Our licence restricts unauthorised redistribution and requires customers to use information lawfully; it does not remove our responsibilities for our own disclosure.

6. International processing and transfers

Our service is international. Information may be processed by us or our service providers in Germany, where our servers are hosted, and Georgia, where we are established. Dataset delivery to a customer in another country can also be an international transfer of personal information where applicable law treats it as such.

Where a transfer requires safeguards, we establish an appropriate legal mechanism before making it. Depending on the applicable law and destination, this can include an adequacy decision, approved standard contractual clauses, the applicable UK transfer mechanism or another legally available safeguard or exception. A recipient's contract with us does not itself satisfy every international-transfer requirement.

You may contact us for information about relevant transfer safeguards and how to obtain a copy or an explanation, subject to necessary redactions. The governing-law clause in our Terms does not override mandatory privacy protections or transfer restrictions.

7. Cookies, analytics and marketing

Cookies and similar technologies can be used for authentication, account security, remembering necessary settings, managing checkout and recording privacy choices. Optional analytics or advertising technologies are used only where enabled and in accordance with applicable law.

Where consent is required, optional tracking is not activated before that consent, and you can refuse or withdraw it without losing access to ordinary purchase functionality. A cookie banner or preference control, when required, must provide the relevant choices. We provide the names or categories, providers, purposes and lifetimes of active technologies in the “Cookie settings” panel, available from the link at the bottom of every page.

You can also manage cookies in your browser, although blocking necessary cookies may affect login or checkout. Browser settings are not a substitute for a consent control where one is required.

Where we send promotional messages, you can unsubscribe using the method in the message or by contacting us. Essential order, security and legal notices may still be sent. An unsubscribe request relating to our promotional emails and a request to remove your contact from a Dataset are different requests; you can ask for either or both.

Where applicable law requires us to honour a recognised universal opt-out signal, including Global Privacy Control, we do so for the processing and identifiers to which that signal legally applies. If a browser signal does not identify a separate Dataset record, you can also provide the minimum professional contact details needed to locate that record through the request method in Section 10.

8. Retention and deletion

We retain personal information only for as long as reasonably necessary for its specified purpose and applicable legal obligations. The criteria depend on the type of record:

• Account information: while the account is active and, after closure, only to the extent needed for unresolved orders, legal obligations or the establishment or defence of claims.
• Billing and transaction records: for the applicable tax and accounting retention period, and for a longer period only where a lawful retention obligation or unresolved claim justifies it.
• Delivery and acceptance evidence: for the relevant payment-dispute and legal-claim periods, limited to information reasonably necessary to verify an order and protect legal rights.
• Routine technical and security logs: for 14 days, unless specific entries need to be retained for an active security incident, legal obligation or dispute.
• Dataset records: while relevant and lawful for the described business-information purpose, assessed against currency, reliability, stated collection dates, source changes and requests for correction, restriction or removal. Historical snapshots are retained only for a continuing lawful purpose and must be identified as historical where relevant.
• Suppression and preference records: the minimum information necessary to continue honouring an opt-out, objection or removal request and prevent accidental re-inclusion.

Deletion of an account does not automatically require deletion of an invoice, a necessary suppression record or other information that we must or may lawfully retain. We explain applicable exceptions when responding to a request.

9. Your privacy rights

Depending on applicable law and the legal ground for processing, you may have rights to:

• obtain information about processing and access a copy of personal information concerning you;
• correct inaccurate or incomplete information;
• request deletion or restriction of processing;
• object to processing based on legitimate interests;
• receive or transfer eligible information in a portable format;
• withdraw consent without affecting processing that was lawful before withdrawal;
• opt out of a legally defined sale, sharing, targeted advertising or certain profiling;
• use an authorised agent or appeal a request decision where applicable; and
• complain to the competent privacy authority without first obtaining our permission.

Rights are subject to the conditions and exceptions of the applicable law. We do not impose a blanket waiver through our Terms or charge a fee merely because you are not our customer.

10. Requesting access, correction, removal or an opt-out

Email [email protected] with a subject such as “Privacy request”, “Dataset correction”, “Remove my contact” or “Do not sell or share my personal information”. Include a brief description of the request and the minimum information needed to locate the relevant account or Dataset record, such as the email address, business name or public source link concerned. An account or purchase is not required.

We may take proportionate steps to confirm identity or authority where necessary and legally permitted, but do not routinely require a government identity document or unrelated sensitive information. We do not require identity verification for a sale or sharing opt-out where applicable law prohibits it. We may ask limited clarifying questions needed to find the right record.

We respond within the period required by applicable law, explain any permitted extension and give reasons for a refusal or partial refusal. Where applicable, we explain how to appeal. You may submit a complaint to the authority competent for your location, including the Personal Data Protection Commission of Singapore, an EU/EEA supervisory authority, the UK Information Commissioner's Office or the appropriate US state privacy authority, where those laws apply.

For an upheld Dataset removal or restriction request, we remove or restrict the relevant information in the copies and future supplies under our control and retain only the minimum lawful suppression or audit information. We notify recipients and seek corresponding action where applicable law requires. We cannot physically recall a file already downloaded by an independent customer, but that technical limitation does not excuse any notification, cooperation or other obligation imposed on us. Independent recipients remain responsible for their own use and applicable requests.

11. Additional information for applicable regional laws

Where EU or UK data-protection law applies, the controller, purposes, grounds, source categories, recipients, retention criteria, transfer safeguards and rights are described above. Any required regional representative or data protection officer is identified in the contact details. This Policy does not claim that those laws apply to every person or every order.

Where the California Consumer Privacy Act or another applicable US state privacy law covers us and the information concerned, commercially licensed Dataset information can include identifiers such as names, business email addresses and telephone numbers, professional or employment-related information and associated publicly sourced profile or source information. The sources, purposes and recipient categories are described in Sections 3–5. We may disclose these categories to Dataset customers for payment where lawful; hosting and other service providers receive relevant categories for the services they perform. The exact treatment of public information depends on the applicable statutory definition.

You may use the method in Section 10 to request access, correction, deletion or an opt-out of covered sales or sharing. We do not require a purchase and do not retaliate against you for exercising protected rights. Where required, we also provide a dedicated opt-out link or control and process recognised universal opt-out or deletion mechanisms. Statutory restrictions on selling or sharing information about minors apply where relevant.

Applicable regional supplements or additional disclosures take precedence where needed to satisfy a mandatory requirement. A privacy-law exemption for a particular record or customer relationship is assessed on its actual facts, not assumed from the label “business data”.

11.1 Singapore: Personal Data Protection Act 2012

Where the Personal Data Protection Act 2012 of Singapore (“PDPA”) applies to us, this Policy is our data protection notice under it.

Most records in our Singapore Datasets describe organisations or contain business contact information — an individual's name, position or title, business telephone number, business address, business e-mail address, business fax number and similar information that the individual did not provide solely for personal purposes. Under section 4(5) of the PDPA, the data protection obligations of the Act do not apply to business contact information. We nevertheless apply this Policy to such records and honour requests to correct or remove them.

For other personal data, such as the details of our website users and customers, we collect, use and disclose it with consent or under an exception permitted by the PDPA, for the purposes described in Section 4. You may ask us for access to, and correction of, personal data about you (sections 21 and 22 of the PDPA) and withdraw your consent on reasonable notice (section 16). We respond to an access or correction request within 30 days or, if we need longer, tell you within that time when we will respond.

When we transfer personal data outside Singapore, we take appropriate steps so that the recipient protects it to a standard comparable to the PDPA (section 26). If a data breach is notifiable under Part 6A of the PDPA, we notify the Personal Data Protection Commission and, where required, the affected individuals. Our data protection officer can be contacted at [email protected]. You may also complain to the Personal Data Protection Commission (www.pdpc.gov.sg).

12. Security and automated processing

We use technical and organisational safeguards appropriate to the information and the risks, and limit access to people and providers who need it for authorised purposes. No online system, email transmission or downloaded file can be guaranteed absolutely secure. Customers are responsible for protecting the files they download, while we remain responsible for security obligations applicable to our own processing.

Automated tools can help collect, organise, deduplicate or classify business information and detect security or payment anomalies. Such processing can produce errors. If an automated security restriction affects your account or order, contact support to request review.

Our Dataset service is not intended to make decisions about an individual's eligibility for employment, credit, insurance or another similarly significant outcome. If we introduce a processing activity that involves legally regulated automated decision-making, we provide any required additional information and safeguards before using it; this Policy alone does not authorise that activity.

13. Children

The service is intended for business users and people able to enter into a valid purchase contract, and is not directed at children. We do not knowingly include children's personal information in commercially licensed contact Datasets. If you believe a child has provided information or appears in a Dataset, contact us so that we can investigate and take the action required by applicable law.

14. Third-party websites and customer use

Our website and Datasets may refer to third-party websites. Their privacy practices are governed by their own notices. A public source website does not automatically endorse our service or a customer's use of its information.

Dataset customers are responsible for their own processing of the information they receive. These customer responsibilities do not limit our obligations for collecting, preparing or supplying a Dataset.

15. Changes to this Policy

We update this Policy when our processing or legal obligations change and show the revised date above. We provide additional notice or obtain renewed consent where required before a material change takes effect. Continued website use is not treated as consent to a new activity for which separate consent is legally required.

16. Contact

For questions or to exercise your privacy rights, contact us at [email protected]. If your message concerns an order, you may include the order number. If it concerns a record in a Dataset, you do not need an order number, account or proof of purchase.