Privacy notice for businesses we research

Bricks and Pixels Ltd

Last updated: 8 October 2026

In short

Bricks and Pixels designs websites for small businesses.

We research established local businesses and may create a private website concept before contacting them. We then offer the business the opportunity to review and purchase the concept. There is no obligation to buy it.

We use publicly available business information for this work. Sometimes that information includes personal information, such as a named business contact or an email address identifying a person.

This notice explains what we collect, why we use it, which organisations help us process it, how long we keep it and how to ask us to stop.

You can object to our use of your personal information for direct marketing at any time. We will stop using it for that purpose. You do not need to give a reason.

Email [email protected] or use the unsubscribe link in any marketing email.

1. Who is responsible for your information

Bricks and Pixels Ltd is the data controller for the prospect research and marketing activities covered by this notice.

• Company: Bricks and Pixels Ltd
• Trading name: Bricks and Pixels
• Company number: 17499294
• Registered in: England and Wales
• Registered office: 71-75 Shelton Street, London WC2H 9JQ
• Trading address: 90 Front Street, Slip End, Luton LU1 4BS
• ICO registration number: ZC266933
• Email: [email protected]
• Website: https://bricksandpixels.co.uk

We do not currently appoint a separate data protection officer. Privacy enquiries and complaints can be sent to the email address above.

2. What information we collect

We collect information needed to identify suitable businesses, assess their existing websites and make a limited business-to-business approach.

Information about businesses

This may include:

• The business name and trading name.
• Its address, service area and published business contact details.
• Its website address and the services it advertises.
• Its Companies House registration number, registered name, company type, incorporation date and active status.
• Its Google Place ID.
• Our assessment of its website and the reasons for that assessment.
• A prospect suitability score and the decision made about approaching the business.
• Dates and outcomes of any contact, including replies and opt-out requests.

We use Google Places ratings and review counts during business surveys. We do not retain those ratings or review counts after the survey, and we do not copy Google review text into our prospect records.

Information about people

Where necessary for a genuine business purpose, we may process:

• The name of a person publicly identified in a professional business role.
• A business contact email address that identifies a person.
• Professional contact information the business has published.
• Personal information included in a reply or enquiry sent to us.
• Information about a person appearing in material considered for a speculative website preview.

We do not record the names of company directors or other officers from Companies House. Our system is built to refuse them. We may record how many active officers a company has, as a number only.

We do not seek private residential contact details, private email addresses, private telephone numbers, information about personal lives, special category information or criminal offence information for marketing.

Some published business addresses may also be residential addresses. We treat those carefully and do not use them to contact people in a private capacity.

3. Where we obtain information

We use the following sources where relevant to the business being researched:

Google Maps and Google Business Profile: To discover businesses and obtain permitted business identification and discovery information.

Companies House: To check that the business is an active limited company or limited liability partnership and verify its corporate details.

The business's own website: To understand the services it provides, where it operates, its current website and its published business contact routes.

We do not buy marketing contact lists, guess personal email addresses or scrape social media.

Where we contact a business, the message identifies the source from which we obtained the relevant contact address.

4. Why we use the information

We process relevant business and personal information to:

• Identify established businesses that may benefit from our website design services.
• Check that a business is eligible for our corporate business-to-business outreach.
• Assess its existing website and publicly advertised services.
• Select businesses for a possible speculative website concept.
• Prepare a private website demonstration where appropriate.
• Send a limited number of relevant marketing emails to eligible corporate subscribers.
• Receive and answer replies.
• Record sales enquiries and the outcome of our approaches.
• Honour objections, unsubscribe requests and other privacy rights.
• Investigate complaints and protect our legitimate legal interests where necessary.

Our usual lawful basis for personal information used in prospect research and direct marketing is legitimate interests, under Article 6(1)(f) of the UK GDPR.

Our legitimate interest is to identify businesses that may be interested in our design services and show them a working example of what we offer.

We have assessed the necessity and possible effects of this activity. We restrict the information collected, use professional business contact routes, limit follow-ups and provide a straightforward way to object.

Where we must retain or process information to meet a legal obligation, the applicable lawful basis may instead be legal obligation. Where information must be retained for a genuine legal claim, we assess the appropriate basis and retention need separately.

Public availability does not, by itself, remove a person's data protection rights.

5. Business-to-business marketing

We approach only businesses that we have verified as active UK limited companies or limited liability partnerships.

We do not send unsolicited marketing emails to sole traders or ordinary partnerships under this programme.

The Privacy and Electronic Communications Regulations 2003 allow unsolicited email marketing to corporate subscribers without prior consent, subject to the applicable requirements.

Every marketing email clearly identifies Bricks and Pixels and provides a way to stop further contact.

We ordinarily send one introductory email and no more than two follow-ups if there is no response.

A meaningful reply pauses the automatic sequence. An objection or unsubscribe request stops marketing.

If you do not want us to use your personal information for marketing, email [email protected] or use the unsubscribe link. We will stop. You do not need to explain why.

6. Speculative website previews

We may create a website concept for a selected business before it has commissioned any work.

The concept is a demonstration of the design we propose. It is not the business's official website and does not mean that the business has approved or endorsed Bricks and Pixels.

A speculative preview is access-restricted and is not intended to appear in public search results.

The preview carries a persistent notice stating:

Concept, not a live website.

It does not accept customer enquiries, orders or bookings on behalf of the business.

Material used in a preview

To show a business what its website could look like, a preview may use the business's own name, logo, photographs and other material published on its existing website or business listing.

We use that material only inside the private preview made for that business. It is never published on a public website, never used in our own marketing and never shown to anyone other than the business, unless the business buys the website and approves the material for its live site.

If the business does not want its material used, it can ask us to remove the preview at any time and we will take it down straight away (see below).

Where a photograph shows identifiable people, we avoid using it in a preview.

Requests to remove a preview

If you represent a business and want its preview taken down, email [email protected].

We will take the preview down straight away; you do not have to wait for us to review the request. Every removal request is also brought directly to the director of Bricks and Pixels.

We will remove the preview from active publication and take appropriate steps concerning the related material.

Where a complaint or legal claim requires us to preserve limited evidence, we will restrict that information rather than continue using it for marketing.

You do not have to purchase the website or provide a reason for asking us to remove the preview.

7. Automated tools and AI

We use automated software, including AI services, to assist with business research, website assessment, writing and building website concepts.

Our AI provider includes Anthropic, which provides Claude.

AI tools may process limited business information and, where necessary, personal information included in the material we provide to them.

We seek to minimise personal information passed to AI systems and do not need directors' names for routine website scoring.

The owner approves each speculative website build and each first marketing approach.

We do not use automated prospect scores to make decisions that have legal or similarly significant effects on individuals.

Our use of AI remains subject to our privacy, security and supplier arrangements. Any applicable provider retention, training or international transfer terms depend on the actual services and agreements in use.

8. Who receives information

We use service providers and public information services for our business operations.

These include:

• Cloudflare, for website hosting, application infrastructure and data storage.
• Anthropic, for AI processing through Claude.
• Google, for relevant Maps and Places services.
• Companies House, for company register checks.
• Our contracted email provider, for sending and receiving communications.
• Other necessary technical providers where their use is required for a specific service.

The legal role of each organisation depends on the service. Some act as processors under contractual arrangements; others may act as independent controllers for their own services.

We do not sell prospect information or supply it for another company's marketing.

We may disclose information where required by law or where reasonably necessary to establish, exercise or defend legal claims.

9. International processing

Some service providers operate outside the United Kingdom or use international infrastructure.

Where an international transfer of personal information is subject to UK data protection transfer rules, we use an applicable lawful mechanism, such as UK adequacy regulations or appropriate contractual safeguards.

You can ask us for information about the safeguards relevant to your personal information by emailing [email protected].

10. How long we keep information

We do not retain prospect information indefinitely.

Our usual retention arrangements are:

Suppression information is not used for marketing.

It may include a protected identifier derived from an email address, together with enough business information to prevent accidental repeat contact.

We periodically review suppression records to ensure they remain necessary, accurate and appropriately protected.

Retention periods may be extended where a genuine legal obligation, dispute or claim requires it. Any extension is limited to the information and period necessary for that purpose.

11. Your data protection rights

Depending on the circumstances, you may have the right to:

• Access personal information we hold about you.
• Have inaccurate personal information corrected.
• Ask us to erase your personal information.
• Ask us to restrict its use.
• Object to processing based on legitimate interests.
• Object to direct marketing at any time.
• Ask for information about how your personal information is used.
• Exercise other rights available under the UK GDPR where applicable.

Your right to object to the use of your personal information for direct marketing is absolute. We will not continue using it for that purpose after a valid objection.

There may be circumstances where we must retain limited information to comply with a legal obligation or protect a legitimate legal claim. We will explain where an exemption applies.

Send rights requests to [email protected].

We normally respond to rights requests within one calendar month, subject to applicable legal rules and any permitted extension.

There is normally no charge.

12. Data protection complaints

If you are concerned about how we have collected or used your personal information, you can complain directly to us.

Email [email protected] with the details of your concern.

We will acknowledge your data protection complaint within 30 days, investigate it appropriately, keep you informed and communicate the outcome without undue delay.

You can also complain to the Information Commissioner's Office:

Website: https://ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

You do not have to obtain our permission to contact the ICO.

13. Keeping this notice up to date

We update this notice when our processing changes materially or when an update is necessary to keep the information accurate.

The current version is published at:

https://bricksandpixels.co.uk/privacy-prospects

We record the date of changes and provide any additional privacy information required by law.

Bricks and Pixels Ltd
Company number 17499294
ICO registration number ZC266933

Want a preview we made for your business removed? Email [email protected] and we take it down straight away.

Generated from the source document. Do not edit this page by hand.