How Mansell Media Limited, trading as Tradello, handles personal data.
Last updated 27 July 2026.
We are a UK company, so the UK GDPR and the Data Protection Act 2018 govern what we do. Where you are in the EU or EEA, the EU GDPR applies to you as well, and every right described on this page is available to you under it — the article numbers are the same in both. You may complain to the ICO in the UK or to the supervisory authority in your own country, whichever you prefer.
Separately, the rules on unsolicited business-to-business contact differ by country: the UK and Ireland apply an opt-out standard (PECR), while Germany, Austria, Italy, Spain, Belgium, Poland and Denmark among others require prior consent. Our leads outside the UK and Ireland therefore contain company team inboxes only — published on the official notice to receive tender enquiries — and no personal contact details at all. Customers are told which regime applies to a lead before they buy it.
Mansell Media Limited, company number 17335820, registered in England & Wales, trading as Tradello. We are the data controller for the processing described here. You can reach us at privacy@tradello.co.uk.
| Whose data | What | Why | Lawful basis |
|---|---|---|---|
| Customers | Email address, payment reference, which leads were bought and when | To take payment, deliver the lead pack, honour the replacement promise, and meet our tax and accounting duties | Contract (Art 6(1)(b)); legal obligation (Art 6(1)(c)) for accounting records |
| Procurement contacts | A team or department email address, and a department telephone number where the notice published one alongside it, exactly as published on an official public procurement notice. Where a notice names an individual, we take no contact details from it at all. | So a specialist contractor can make contact about the specific project that notice concerns | Legitimate interests (Art 6(1)(f)) |
| Website visitors | Standard server request logs | To keep the service running and secure | Legitimate interests (Art 6(1)(f)) |
We do not use advertising cookies, we do not track you across other websites, and we do not build profiles of individuals.
Every contact detail in a Tradello lead is taken verbatim from a statutory public procurement notice published under the Open Government Licence. We never guess, construct, infer or enrich a contact detail. If a notice does not publish a usable contact, the lead does not carry one.
The full Article 14 explanation, including your right to object and a one-step removal form, is on Where our data comes from.
We measure how the site is used so we know which trades and regions people are looking for. We do not use Google Analytics, advertising pixels, or any third-party tracker, and nothing at all is written to your device — no cookies, no local storage. That is why you see no cookie banner here.
Our own server counts page views, how long a page was open, which filters were used on the shelf, and which searches returned nothing. To count people rather than page loads, your IP address and browser are combined with a secret that changes every 30 days and run through a one-way hash. We store only that hash. Your IP address is never written down, the hash cannot be turned back into it, and it cannot be matched across salt periods. Free-text searches are only kept when they look like a trade or place name; anything containing an email address or a long run of digits is discarded before it reaches us.
Our lawful basis is legitimate interests (Article 6(1)(f)) — understanding demand for our own service. Because no information is stored on or read from your device, PECR regulation 6 does not require your consent. If your browser sends a Do Not Track or Global Privacy Control signal we record nothing at all. Counts are deleted automatically after 400 days.
Our payment processor (Stripe), our email delivery provider (ZeptoMail, EU region), and our hosting provider (Vercel). Each processes data on our instructions only. Customers who buy a lead receive the contact details in that lead and become independent controllers of that data from the moment they use it — their outreach is their responsibility, not ours, and we tell them so before they buy.
We do not sell customer data. We do not share data with advertisers.
| Data | Retention |
|---|---|
| Procurement contact details on unsold leads | Deleted as soon as the tender deadline passes, the contract completes, or the notice is cancelled — checked on every pipeline run |
| Purchase and accounting records | Six years from the end of the relevant accounting period, as required by the Companies Act 2006 and HMRC |
| Objection / opt-out records | Kept indefinitely as a one-way cryptographic hash, so we can keep honouring the objection without storing the address itself |
| Server logs | As retained by our hosting provider, typically under 30 days |
You have the right to be informed, to access a copy of your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, and to data portability. Where we rely on legitimate interests you can object at any time, and for direct marketing purposes that objection is absolute — we act on it without asking why.
Ask by emailing privacy@tradello.co.uk, or remove yourself immediately using the form on Where our data comes from. We respond within one month.
If you are unhappy with how we have handled it you can complain to the Information Commissioner's Office at ico.org.uk, or to your own national supervisory authority if you are outside the UK.
Our mail provider operates in the EU region. Our hosting and payment providers may process data outside the UK under the UK International Data Transfer Addendum or an adequacy decision.
If we change how we use personal data we will update this page and change the date at the top.