We collect publicly listed contact details for UK businesses, check every number against the do-not-call registers before we supply it, and supply them to companies who want to ring them.
We keep them for thirty days and then delete them.
If you would rather we never held yours again, tell us and we will make sure of it. Permanently, free, and without asking you why.
1. Who we are
CallWave is the trading name of Richard Regan, a sole trader in Devon, England.
We are registered with the Information Commissioner's Office under registration number ZC089683. That is a public entry and you can look it up on the ICO's own website.
| Data protection questions | |
| To be removed from our data | |
| General enquiries | |
| By post | CallWave, at the address published on the ICO's register of fee payers |
Our addresses are removals, privacy and hello, each at callwave dot co dot uk. They are written this way on the page so that automated harvesters cannot collect them. You can also write to us on paper, at the address published on the ICO’s register of fee payers.
You can write to us on paper if you would rather not email. It is answered the same way and on the same clock.
You do not have to contact us first about anything. You can go straight to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
2. What we hold
For a UK business we may hold:
- the business name, telephone number, trading address and the type of work it does
- its website address
- where it is a registered company: the company number, when it was incorporated, information from its filed accounts, and the names of its directors, all from the Companies House register
- an indication of size, age and whether the public register shows any sign of financial difficulty
- a record of when we last checked the number against the do-not-call registers, which are the Telephone Preference Service and the Corporate Telephone Preference Service
- one page of the business's own website
- where the public register names nobody, a suggested name for the likely decision maker, worked out from the business's own website and its public listings by a service based outside the UK. Those pages are read and not kept
We do not hold email addresses. We do not collect them, store them or supply them.
We do not hold anything about anyone's private life, and we do not build profiles of individuals.
3. Where we get it
Three kinds of source, all publicly available:
- Public business listings and directories
- The businesses' own websites
- The Companies House register
The area marks on a record describe the area, not the business. They come from published Crown copyright datasets covering that area, used under the Open Government Licence.
We do not buy data from brokers or data warehouses.
4. Why we are allowed to hold it
Our lawful basis is legitimate interests: supplying accurate, screened business contact details to companies selling business-to-business.
We have written that assessment down. If you want to read it, ask and we will send it to you.
Most of what we hold is information about a company, which is not personal data. It becomes personal data where a business is run by a named individual, such as a sole trader, or where a director is named. This notice is written for those situations.
5. Who we give it to
Businesses who buy a batch from us in order to make live sales calls.
Once we supply it, that business is responsible for the data in its own right. Before we supply anything, each one agrees in writing that it will:
- screen the numbers again if calling more than 28 days after the screening date
- use the data only for business-to-business telephone calls
- not resell it, share it, or pass it on to anyone else
- not use automated or pre-recorded calling systems
- honour any objection you make to them, and tell us about it
6. How long we keep it
Thirty days. Every batch of data we collect has thirty days to live. At the end of it the data is deleted, whether it was supplied to anyone or not, and we keep a note recording that it happened. That note contains no personal information.
The deletion is automatic. It is not something anyone has to remember to do.
The only contact details we keep permanently belong to businesses that asked us not to contact them again.
7. Being left alone
Write to our removals address. Any wording is fine. You do not have to give a reason and it costs nothing.
You will get a reply. We are a one-person business and we answer these ourselves, usually the same day. The outside limit is one calendar month and it is a limit, not a target.
We will:
- log it with the date and confirm to you in writing, within one calendar month
- delete you from the live data
- keep the minimum needed on a suppression list: your business name, and the telephone number, website address or company number
Step three is the one that matters. Deleting a record without remembering it means the next search finds you all over again and sells you again. Keeping the identifier is the only way to make sure that never happens, and the business name is kept beside it so a person can read the list and check it is doing its job. We keep nothing else, nothing about anyone as an individual, and we never use a suppression entry for anything except keeping you out.
A batch already sent to a client cannot be recalled. From the moment you ask you will never appear in another one, and that client is required by contract to honour your objection directly and to tell us about it.
8. Your rights
- To object to direct marketing. Absolute, free, immediate. Ask and you are out, permanently.
- To see what we hold about you. We will tell you within one calendar month.
- To have it corrected if it is wrong.
- To have it erased, subject to the suppression note above.
- To restrict what we do with it while a question is being resolved.
- To complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. You can do that directly and at any time.
9. Automated decisions
We do not make automated decisions that produce legal effects or similarly significant effects about anybody.
10. Why you are reading this rather than hearing from us individually
We collect information from public sources rather than from you, so you have not heard from us before.
The law expects us to tell each person individually. It also recognises that where that would take disproportionate effort, publishing the information instead can be appropriate, and it requires that anyone relying on that must publish. This page is us publishing it.
We hold data on thousands of businesses at a time, for days rather than years, screened against the do-not-call registers, deleted after thirty days, with a free permanent removal route. Contacting every business individually to say we briefly held a telephone number that the business itself publishes would be a considerable effort producing very little benefit.
You may disagree with that. If you do, the removal route above is free, immediate and permanent, and we will not ask you to justify it.
11. Security
The data sits on one computer in the United Kingdom, in a local database. There is no copy in the cloud and no third party has access to that database. Files delivered to clients are excluded from the backup, so a batch cannot outlive its thirty days by sitting in one.
12. Changes to this notice
If this notice changes we will publish the new version here and date it.
Version 1.1 · 5 August 2026 · Next review 2 August 2027
1. Who we are 2. What we hold 3. Where we get it 4. Why we are allowed to 5. Who we give it to 6. How long we keep it 7. Being left alone 8. Your rights 9. Automated decisions 10. Why you are reading this 11. Security 12. Changes