Sourcing: who is responsible for what.

You decide which businesses to approach and what to say to them. That makes you the controller of that information under UK data protection law. We store it, format it and send it where you tell us to, which makes us your processor.

It matters because the obligations sit mostly with you. We can give you a tool that behaves properly; we cannot decide on your behalf whether writing to a particular person is reasonable.

The underlying records come from public registers: Companies House, The Food Standards Agency hygiene register, The DVSA MOT testing station register, The Environment Agency waste carrier register, The Care Quality Commission register, Postcodes.io and to turn a postcode into an area to search.

• Process this data only on your instructions, and not for our own purposes.
• Keep it confidential, and ensure anybody with access is under the same duty.
• Secure it appropriately — encrypted in transit and at rest, with your provider credentials encrypted separately and never shown back to you.
• Use only the sub-processors listed below, and tell you before adding another.
• Help you respond if one of your prospects exercises a right — asks what you hold, or asks you to stop.
• Tell you without undue delay if there is a breach affecting your data.
• Delete or return it when you stop using sourcing or close your account, except where we have to keep something by law.
• Make available what you need to show you are meeting your own obligations.

You are responsible for the decisions. In particular:

• Having a lawful basis for contacting the businesses you choose — usually legitimate interests for business-to-business post, which you should be able to justify.
• Telling people what you are doing with their information when you first contact them, and honouring it if they ask you to stop.
• Respecting the suppression list. The platform enforces it, and working around it is a breach of these terms.
• Complying with direct marketing law. Posted mail is treated differently from email and calls under PECR, and the engine is built for post for that reason.
• Keeping your own records if the volume you send means you need them.

The platform helps — suppression, cooling-off periods, a record of what was sent to whom and when — but these are guardrails, not a legal opinion about your campaign.

Only these, and only for sourcing:

The print provider is your account, connected with your own credentials. You pay them directly, we take no cut, and we never hold your postage money.

If you need to satisfy yourself that we are doing what this page says, email darren@dealclub.online and we will answer reasonable questions and provide what we can. For a small company that is a conversation rather than a formal audit process, and we would rather say so than pretend otherwise.

If you drop to a plan without sourcing, your prospect lists are not deleted — they become read-only and come back if you add it again. If you close your account, or ask us to delete them, we will.

These terms form part of our terms of sale and use and apply in addition to our privacy policy, which covers the data we hold about you as a member — a different thing from the data you process about other people using the engine.