If we emailed you out of the blue

You are probably reading this because you received an email from us that you did not ask for. This page is the full version of the short notice in that message: what we hold, why we think we are allowed to, and how to end it. It covers outreach only. If you have used the site or bought something, the main privacy policy is the one that applies to you.

Where we got your address

From your own website. We record the exact page an address was published on at the moment we collect it, and the email we sent you quotes that URL back to you, so you can check our answer rather than take it on trust.

We do not buy lists, use data brokers, scrape social networks, or guess addresses from a pattern. If the address we used is not published on your site, we have made a mistake and would like to know.

What we hold

• The domain of your store.
• One contact email address, and the URL it was published at.
• What we could determine about the business behind it: the country, whether it is a company or a sole trader, and a company number where an official register gave us one.
• The result of a public scan of your storefront, which reads the same pages any visitor or search engine can read.
• Whether we have written to you, and whether you told us to stop.

We do not hold anything about you as an individual beyond a work address, and we never see anything behind a login.

Why we think we may do this

Our lawful basis is legitimate interests: offering a business a paid service directly relevant to a defect we measured on its own public storefront. We are required to weigh that interest against your rights, in writing, before we send anything, and a message goes out only once a person has recorded that assessment for your business specifically.

Where the law requires consent rather than a balancing test, we do not send. That is why some businesses hear from us and others in the same list never do: a sole trader in the UK is treated as an individual subscriber under PECR, and Canadian rules require consent before a commercial message at all.

How long we keep it

The contact record is deleted 14 days after we found it, whether or not we ever wrote to you, and whether or not anyone reviewed it. If we still want to reach that business later, we look it up again rather than holding an ageing list.

Our record of the email itself is kept longer, because we need to be able to say what we sent and to whom. After 2 years the address and the subject line are removed from it and what remains is that a message of that kind went out on that date.

Two things deliberately outlive both. If you tell us to stop, that record is permanent - it is the only way to guarantee we do not write to you again after the contact record above has been deleted and the business is found a second time. And once we have written to you once, we keep a note of that permanently too, for the same reason: the message promises we will not write again, and a promise we forget is not one.

Your rights

You can ask us to do any of the following, and we will do it within one month:

• Object to direct marketing. This one is absolute. There is no balancing test and we do not get to weigh anything against it - if you object, we stop, permanently. The unsubscribe link in the email does this immediately and needs no reply from you.
• See what we hold about you.
• Have anything inaccurate corrected.
• Have it deleted.
• Have processing restricted, or object to it on other grounds.
• Receive a copy in a portable format.

Email hello@sextantscan.com for any of these, or use the complaint form if you would rather it went through a route that acknowledges itself automatically. You do not need an account and you do not need to explain why.

If we emailed you within the last 30 days, our email provider also holds a copy of that message. Ask us to delete it and we will instruct them to delete theirs as well, rather than leaving you to chase a company you have never dealt with.

Complaining

If you are unhappy with how we have handled your data, you can complain to us directly. We acknowledge every complaint straight away and tell you what happens next. You do not have to come to us first, but we would rather have the chance to fix it.

You also have the right to complain directly to the Information Commissioner's Office, the UK's data protection regulator, without going through us at all. They can be reached at ico.org.uk, by phone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We are registered with the ICO under registration number ZB644996.

Who we are

Adcock Stanton Limited, trading as Sextant, a company registered in England and Wales, company number 14869761. Registered office 72 Stoneyfields Lane, Edgware, Middlesex, HA8 9SW.

We are the data controller for everything described on this page. Contact us at hello@sextantscan.com.