Legal

Privacy Notice

How The Trusted Source Ltd collects, uses, shares and protects personal data, in line with the UK GDPR and the Privacy and Electronic Communications Regulations 2003 (PECR).

Draft notice — requires legal review

This page is a prepared template, not a final legal document. It must be reviewed and approved by a UK data protection lawyer before the site goes live, and the contact details above must match the registered office of the company.

Who we are

The Trusted Source Ltd ("we", "us") is a company registered in England and Wales under company number 72482773, with its registered office in 21 Park Royal Rd, London NW10 7LQ, United Kingdom. For the purposes of UK GDPR we are the data controller for the personal data described in this notice.

Questions about this notice, or about the way we handle your data, can be sent to [email protected].

What we collect

We collect only the data we need to operate the network and to answer enquiries:

  • Enquiry data — your name, work email, company and the content of messages you send through the contact form.
  • Membership application data — name, work email, phone, country, company name, job title, company website, UK company number, stated monthly volume and the nature of your requirement.
  • Trading data — for verified members, records of quotations, orders, invoices and delivery notes held against each deal.
  • Technical data — limited to what is necessary to operate and secure the site, such as server log records of IP address, browser type and pages requested.

Lawful bases for processing

We rely on the following lawful bases under Article 6(1) UK GDPR:

  • Contract — processing necessary to take steps at your request before entering a membership contract, and to perform that contract once you are a member.
  • Legitimate interests — operating and securing the network, verifying companies, and maintaining the commercial standing of member businesses. We have assessed that these do not override your rights, given the limited data involved.
  • Legal obligation — retaining trading records for tax and accounting purposes, and responding to lawful requests from regulators.
  • Consent — only where we specifically ask for it, for example to store a marketing preference. Consent can be withdrawn at any time.

How long we keep it

  • Enquiries that do not lead to an application: 24 months from last contact.
  • Unsuccessful membership applications: 12 months, so that you can be re-contacted if circumstances change.
  • Active membership records: for the duration of membership, then 6 years after the final trade, for tax and dispute purposes.
  • Verification review records: 12 months from the date of each review.

Who we share it with

We do not sell personal data. We share it only where necessary:

  • With other verified members, but only the company-level information a counterparty needs to transact: trading name, verification status, categories supplied and stated volumes.
  • With suppliers and service providers who host, secure or support the service, under written data processing terms.
  • With HMRC, Companies House and other regulators where we are legally obliged to disclose information.

Note

We never share personal contact details of your staff with other members without your instruction. If you ask a supplier to contact a colleague directly, that instruction is recorded against the deal.

International transfers

We are established in the United Kingdom and store data on infrastructure located in the UK or the EEA. If a supplier or sub-processor operates outside the UK, we rely on the UK IDTA Addendum or Standard Contractual Clauses together with a transfer risk assessment.

Your rights

Under UK GDPR you have the right to:

  • be informed about how we use your data and access a copy of it;
  • have inaccurate data corrected and incomplete data completed;
  • have data erased where we no longer have a basis to keep it;
  • restrict or object to processing based on legitimate interests;
  • receive your data in a portable, machine-readable format;
  • object to direct marketing at any time.

Write to [email protected] to exercise any of these rights. We respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies and analytics

This site sets no advertising or tracking cookies and runs no analytics in its current form. If analytics are introduced in future, we will request consent through a cookie banner before any non-essential cookie is set, as required by PECR regulation 22.

Security

Data in transit is protected with TLS, and access to member trading records is restricted on a role basis and logged. Member companies are required to notify us immediately of any suspected compromise affecting credentials on our platform.

Changes to this notice

We update this notice when our processing changes. The current version is always published on this page, and material changes are notified to members by email.

Last updated: 6 October 2026