An enquiry is not a data licence.

Who is responsible and what this notice covers

CEOBuySell determines how personal information submitted through this website is used to handle supplier, buyer and contact enquiries. For this activity we act as the controller under GDPR and, where POPIA applies, the responsible party. Contact [email protected] about this notice or your privacy rights.

This notice covers website visitors, assessments and enquiry correspondence. The regional rights below apply where the relevant law covers the person and processing concerned; visiting this website does not by itself make every law applicable. An enquiry does not authorise access to, sale of, or training on an underlying business dataset.

Information we collect and its sources

You provide contact identifiers such as your name and email; professional and business details such as organisation, role, website and optional operating region or workforce range; and commercial information such as buyer requirements or licensing preferences. Assessment answers describe systems, record groups, approximate volumes, history, languages, outcomes, restrictions and preparation needs. Avoid including anyone else’s personal information in these descriptions.

We also record acknowledgements, the submission date and reference, questionnaire and privacy-notice versions, review notes and status, and preliminary readiness findings derived from your answers. Our hosting provider processes connection, device/browser and request information to operate and secure the site; transactional email providers process delivery information. These are the categories used by the current enquiry service and, where collected, during the preceding 12 months.

We collect enquiry details directly from you or an authorised representative, and technical/delivery information through service providers. Fields marked required are needed to process the particular enquiry; optional fields may be left blank. If necessary contact or qualification details are not supplied, we may be unable to assess or respond. Do not send raw datasets, identification documents, payment details, sensitive personal information, confidential records or credentials through our forms. This business enquiry service is not directed at children.

Purposes and lawful grounds

We use the information to assess an opportunity, respond to questions, arrange discussions, manage potential engagements and maintain records of communications. We also use limited technical information to prevent abuse and protect the service. Under GDPR, the grounds are our legitimate interests in responding to business enquiries and keeping the service secure, or steps you request before entering a contract where applicable. Legal obligations may require some records to be retained. Where processing relies on consent, it may be withdrawn without affecting earlier lawful processing.

Permission to respond is not a marketing subscription or a data licence. We do not sell website enquiry personal information, share it for cross-context behavioural advertising, or use form contents to train AI models. The same no-sale/no-sharing practice applies whether or not your browser sends a Global Privacy Control signal. There are no advertising pixels or marketing mailing-list enrolment in the enquiry flow.

The supplier assessment automatically produces preliminary review findings from self-reported answers, for example a need to clarify permissions or record quality. It does not determine licensing rights, confirm earnings or make a solely automated decision with legal or similarly significant effects. You can correct your answers or ask the desk for human review.

Access and disclosure

Authorised CEOBuySell administrators and the licensing desk can review enquiries. Cloudflare provides hosting, database and transactional sending services; email providers deliver correspondence to the desk and your address. These providers process the categories needed for those services. We may also disclose necessary information to professional advisers or authorities where required by law or needed to establish or defend legal claims.

We do not publish enquiries or automatically send them to potential data buyers. A proposed introduction or disclosure of a business description is scoped with you first. Giving a company permission to discuss records does not resolve the privacy or other rights of people described in them.

Retention and security

New or closed enquiries are removed by scheduled maintenance once older than 365 days, together with their linked email-job records. Reviewing or qualified engagements may be retained longer where needed for the relationship, legal duties or claims, and are subject to review. Inbox copies, provider logs and backups have separate retention arrangements; removal from the enquiry database does not mean every provider backup or email copy is immediately erased. We consider these locations when handling an applicable deletion request.

The application uses HTTPS, authenticated administration, restricted backend access and server-side validation. Its short-lived rate-limit keys are hashes derived from an IP address and hourly window; raw IP addresses are not stored in enquiry tables. Hosting providers still process connection information. Application error logs use event names and enquiry references rather than full form answers. We assess suspected security incidents and notify affected people and regulators where the applicable law requires it.

UK and European Economic Area: GDPR

Where UK GDPR or EU GDPR applies, we limit collection to the stated purposes and relevant information, keep information accurate, restrict retention and access, and use an applicable lawful basis. Depending on the basis and circumstances, your rights include access, correction, erasure, restriction, portability and objection, including objection to processing based on legitimate interests. You may withdraw consent where it is the basis for processing; these rights have lawful limits and exceptions.

We normally respond to rights requests within one month, subject to legally permitted verification, clarification and extensions. If more time is allowed and needed, we explain why within the applicable period. You can complain to the UK Information Commissioner’s Office or the relevant EEA supervisory authority, including in your place of habitual residence, work or an alleged infringement.

California: CCPA as amended by CPRA

If you are a California resident and the CCPA applies to the processing, you may request the categories and specific pieces of personal information held about you, its sources, purposes and categories of recipients; request correction or deletion subject to exceptions; and exercise applicable rights to opt out of sale/sharing and limit certain uses or disclosures of sensitive personal information. We will not discriminate against you for exercising these rights.

The collection, purpose, source, recipient and retention disclosures above describe this website enquiry service. We do not sell enquiry personal information or share it for cross-context behavioural advertising within the meaning of the CCPA. We do not use sensitive personal information to infer characteristics about you. We do not offer financial incentives for providing enquiry personal information. If a future service introduces sale, sharing or additional sensitive-information uses, the required notice and choice mechanisms must be in place before that change.

Submit a request by email using the contact instructions below. An authorised agent may act for you, subject to permitted verification of their authority. For qualifying access, correction or deletion requests, the normal CCPA response period is 45 calendar days from receipt; we explain any legally permitted extension. You can raise a concern with the California Privacy Protection Agency.

South Africa: Protection of Personal Information Act (POPIA)

Where POPIA applies, our handling must follow its conditions for lawful processing: accountability, limited and justified collection, defined purposes, compatible further use, information quality, openness, appropriate safeguards and participation by the data subject. Processing requires an applicable justification, such as consent, necessary contractual steps or a legitimate interest recognised by POPIA; consent is not assumed merely because you visit the site.

You may ask whether we hold your personal information and request access, correction or deletion of inaccurate, irrelevant, excessive, outdated, incomplete, misleading or unlawfully obtained information, subject to applicable requirements and exceptions. You may object to certain processing on the grounds allowed by POPIA and withdraw consent where relied upon. We do not use enquiry permission to enrol you in unsolicited electronic direct marketing.

Send POPIA requests to [email protected]. We will explain any applicable identity checks, prescribed procedure or lawful access fee before proceeding and respond within the period required by the applicable law. You may complain to South Africa’s Information Regulator.

International processing and transfers

Cloudflare and email providers may process information outside the UK, EEA or South Africa. A hosting-region setting alone does not keep all email, support or operational processing within a particular country.

Where UK/EU GDPR restricts a transfer, an applicable adequacy decision, appropriate safeguards or another lawful transfer condition is required. Safeguards may include EU Standard Contractual Clauses, a UK International Data Transfer Agreement or UK Addendum, with the required assessment and additional measures where needed. Where POPIA applies, an overseas transfer must satisfy section 72, for example adequate protection through law or a binding agreement, or another applicable statutory condition. Contact us for information about the safeguards relevant to your enquiry.

How to make a privacy request

Email [email protected] with the subject “Privacy request”. Tell us the right you want to exercise and enough context to locate the information, such as the email address or enquiry reference used. You do not need to create an account. Please do not send passwords, raw datasets or identity documents in your initial request. We may ask for proportionate information to verify identity or an agent’s authority before releasing or changing records.

We use request information to handle and document the request and protect against unauthorised disclosure. Requests are normally free; we explain any fee or refusal only where the applicable law allows it. If a right is limited by an exception, we explain the reason and any available complaint route. You may ask to stop further enquiry follow-up, without affecting processing already lawfully completed or records that must be retained.

Separate business-data licensing engagements

This notice is not a blanket authorisation to broker personal information. Before source records are accessed, disclosed or licensed, the parties must establish their controller/responsible-party and processor/operator roles, lawful grounds, notices, individual rights, security, retention, transfers and permitted uses. Any AI training, evaluation or research must be addressed expressly. Removing names does not by itself make a dataset anonymous or eliminate other rights.

A future engagement involving personal information may require a separate privacy notice, agreements, additional safeguards or statutory registrations and opt-out mechanisms. Those requirements must be addressed before the activity begins; an initial assessment does not replace them.