Privacy Policy
Last updated: 3 July 2026
1. Who we are
ExitLeads (“we”, “us”, “our”) provides a UK business acquisition intelligence platform that helps users identify companies that may be suitable acquisition targets. This policy explains how we handle personal data.
For the purposes of UK data protection law, the data controller is Exit Leads. Data protection contact: [email protected]. ICO registration: pending.
We are committed to protecting personal data and handling it in accordance with the UK GDPR and the Data Protection Act 2018.
2. The short version
- We collect the information you give us when you create an account and pay for a subscription or credits.
- We record how you use the platform (searches, the leads you view and unlock, notes you make, exports) to operate the service and improve it.
- We hold a database of UK companies and the individuals associated with them, sourced from Companies House and enriched from other sources, which is the core of our service.
- We do not sell your personal data. We share it only with the processors needed to run the service.
- You have rights over your data, and so do the individuals featured in our database.
3. Information we collect about you (our users)
Information you provide: account details (name, email address, securely hashed password); profile details (company name and other information you add); communications you send us.
Information generated when you use the service:
- Usage and behavioural data: we log actions you take on the platform — searches you run, filters you apply, leads you view, leads you unlock, status changes and notes you make on leads, and exports you perform, together with timestamps and the lead score at the time of the action. We use this to operate the service, populate your account, and improve our lead-scoring model.
- Payment data: payment is processed by Stripe. We do not receive or store your full card details. We store a Stripe customer reference, your subscription status and plan, your credit balance, and a record of transactions.
- Technical data: IP address, browser and device type, and session information, including data stored in cookies necessary to keep you logged in.
4. Information we hold about individuals in our database
A core part of our service is a searchable database of UK companies and the people associated with them. This includes personal data about company directors and Persons with Significant Control (PSCs), such as name, year of birth, nationality, role, appointment dates, and — where we have obtained or derived it — business contact information.
Sources: this data is sourced primarily from Companies House (public register) and supplemented with information from third-party enrichment sources and publicly available business information.
Lawful basis: we process this data on the basis of our legitimate interests (and those of our users) in providing business intelligence that helps identify potential acquisition opportunities. We have assessed that this processing is proportionate and conducted in a business-to-business context. We balance this against the rights and interests of the individuals concerned.
If you are an individual featured in our database, see section 11 for your rights.
5. How we use your data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account; providing the service | Performance of a contract |
| Processing payments, subscriptions and credit top-ups | Performance of a contract; legal obligation |
| Recording and analysing how you use the platform to operate and improve it, including retraining our lead-scoring model | Legitimate interests |
| Sending service and transactional emails | Performance of a contract |
| Sending product or marketing updates (where applicable) | Consent, or legitimate interests |
| Maintaining the company and individual database that powers the service | Legitimate interests |
| Keeping records for tax and accounting | Legal obligation |
| Protecting the security and integrity of the platform | Legitimate interests |
Where we rely on legitimate interests, you have the right to object — see section 10.
6. Behavioural analytics — explicit notice
We want to be clear and transparent about this: we record the actions you take on the platform (listed in section 3) in an events log tied to your account. We use this data to run the features you rely on, to understand how the platform is used, and to improve and retrain the model that scores and ranks leads. We rely on our legitimate interests for this analytics processing. You can object to this processing by contacting us, though please note some logging is necessary to provide core features (such as showing you the leads you have unlocked).
7. Who we share your data with
We do not sell your personal data. We share data only with service providers (“processors”) who help us run the platform, under contracts that require them to protect it:
- Stripe — payment processing
- Supabase — database hosting (EU)
- Hetzner — server and application hosting (Germany, EU)
- Google — business verification (Places API) and email services
- Hunter.io — business contact enrichment
We may also disclose data where required by law, to enforce our terms, or in connection with a sale or restructuring of our business.
8. International transfers
We host the core of our data within the EU (Supabase and Hetzner). Some of our processors (such as Stripe and Google) may process data outside the UK/EU. Where they do, appropriate safeguards are in place, such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision.
9. How long we keep data
- Account data: while your account is active, and up to 6 years afterwards to meet legal and accounting obligations.
- Payment and transaction records: 6 years, as required for tax purposes.
- Behavioural/usage data: while your account is active and for a reasonable period thereafter for analytics and model purposes.
- Database (company and individual) data: retained and periodically refreshed from source while it remains relevant to the service; removed or updated in line with source records and valid erasure/objection requests.
10. Your rights (users)
Under UK data protection law you have the right to: access your data; have inaccurate data corrected; have your data erased; restrict or object to processing; data portability; and to withdraw consent where we rely on it. You also have the right to object to processing based on legitimate interests. To exercise any of these, contact [email protected]. We will respond within one month.
11. Rights of individuals featured in our database
If you are a company director, PSC, or other individual whose information appears in our database, you have the same rights set out above. In particular you may object to our processing, request that we erase or correct your data, or request access to the personal data we hold about you. To make a request, contact [email protected], providing enough detail for us to identify the relevant records (e.g. your name and company). We will action valid requests promptly and in line with our legal obligations.
12. Cookies
We use cookies and similar technologies that are strictly necessary to operate the platform — principally to keep you securely logged in and maintain your session.
13. Security
We take appropriate technical and organisational measures to protect personal data, including encryption in transit, hashed passwords, access controls, and row-level security on our database. No system is completely secure, but we work to protect your data and to notify you and the ICO of any breach where legally required.
14. Children
Our service is intended for business users and is not directed at anyone under 18. We do not knowingly collect data from children.
15. Changes to this policy
We may update this policy from time to time. We will post the updated version here and update the “last updated” date. Significant changes will be notified to account holders.
16. Contact and complaints
Questions or requests: [email protected]
Formal data protection complaints: If you believe we have handled your personal data unlawfully or in a way that does not respect your rights, you can raise a formal complaint using our data protection complaint form. We will acknowledge your complaint within 30 days and provide a substantive response as promptly as possible. You can also email [email protected] directly with the subject line “Data Protection Complaint”.
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113
See also: Terms of Service