Privacy Policy

for visitors and customers of the datalistshop.com online store, and for data subjects whose data has been collected from public websites

Version: 1.4 · Effective: October 25, 2026 · Prepared: October 25, 2026

This notice has been prepared pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter the GDPR) and Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.). For data subjects living or operating in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply; the related additions are set out in Part D/GB. This English text is a translation; in the event of any discrepancy, the Hungarian version prevails.

1. Who processes your data?

1.1. The controller

In this notice, “we” means the controller, and “you” means the data subject (the person whose data is concerned).

1.2. Who is this notice for?

It covers two separate processing activities, and the country-specific additions that relate to them:

• Part A: visitors to the online store, people requesting samples, newsletter subscribers, and customers (or the contact persons of customer companies) — they provide their data themselves.
• Part B: people whose data publicly disclosed on their own website (e.g., a business email address or telephone number) has been included in the databases we compile and sell, or to whose business address we ourselves have sent a business offer (B8). If you arrived here because of your website’s address, or you received an email from us, this part is for you.
• Part D: country-specific additions — currently the United Kingdom (D/GB).

A) Visitors and customers of the online store

A1. What data do we process, for what purpose, on what legal basis, and for how long?

Providing the data required for an order is a condition of entering into the contract: without it, we cannot fulfill the order. Subscribing to the newsletter and accepting statistics or advertising cookies is voluntary and is not a condition of purchase.

The free sample, however, is provided in exchange for subscribing to the newsletter: on the sample request form, giving consent is a condition of receiving the sample. We send the sample by email, via the link in a confirmation email (double opt-in) — this is how we verify that the address really belongs to you. If you do not wish to subscribe, the sample preview image and the description of the columns are available on the product page without consent. You can withdraw your consent at any time, free of charge, using the unsubscribe link at the bottom of every email or by writing to adatvedelem@datalistshop.com; withdrawal does not affect the lawfulness of emails sent before it.

If you requested the sample but did not click the button in the confirmation email, we send nothing to your address other than the confirmation email, and your address is not added to any newsletter list. We keep the data of the request (email address, time, IP address, version of the consent text) for 10 years, so that we can prove that only the requested confirmation email was sent to the address and recognise abuse in a later request. After that, it is deleted automatically.

A2. Cookies

We use cookies necessary for the website to function without consent; statistics and advertising cookies are used only after you give your consent in the cookie banner. You can withdraw or change your consent at any time in the cookie settings at the bottom of the page. A detailed list of cookies: https://datalistshop.com/cookies/. Without your consent, Google Analytics and Google Ads may send cookieless, aggregated signals (see the table in A1 and the Cookie Policy).

A3. About the newsletter

Subscribing to the newsletter is voluntary. You can unsubscribe with one click at the bottom of every email; after you unsubscribe, we place your address on a suppression list so that a later import does not add it again. We measure email opens and link clicks in order to improve our communications. The measurement takes place on our own server operated in Hungary (t.datalistshop.com), and IP addresses are stored in truncated form. Brevo, which delivers our emails, also records email opens and link clicks in its own system (this is why the links pass through a Brevo redirect address); we do not use this data. The sample request, the confirmation and the email series are also handled by our own server; traffic between the website and our server travels encrypted over the Cloudflare network.

A4. Who has access to your data? — processors and recipients

The table also lists the processors for Parts A) and B).

We do not sell personal data to third parties and do not disclose it beyond the providers above and our legal obligations (e.g., requests from authorities). Customer data is not included in the database described in Part B.

A5. Transfers outside the European Union

With the services of Google, Meta, Defiant, Cloudflare and Microsoft, data may also be transferred to the United States. Such transfers take place on the basis of the adequacy decision under the EU–U.S. Data Privacy Framework or the standard contractual clauses adopted by the European Commission (Articles 45 and 46 GDPR).

B) Data collected from public websites

This part is for people whose contact details published on their website have been included in our database. We did not collect this data from you, so we provide this information on this public page in accordance with Article 14 GDPR.

B1. Where does the data come from?

Using an automated program (a crawler), we visit publicly accessible websites — typically the home page and the pages containing legally mandated disclosures (legal notice, contact, terms and conditions, privacy notice) — and collect the data publicly disclosed there. We compile the list of domains from publicly available sources. In some countries, we supplement the data collected from websites with data from the official public company register, where the register’s terms of use permit this — in the United Kingdom, from the Companies House register (D/GB).

• We do not access password-protected pages, do not circumvent access restrictions, and do not purchase data from third parties.
• The crawler identifies itself, respects the restrictions in the website’s robots.txt file, and operates with a low load.
• For each data item, we store the address of the page it comes from.

B2. What data do we process?

As published on the website: the name, registered office, tax number, and company or registration number of the business or operator, its email address and telephone number, the website address, the e-commerce or website platform used, the product categories offered, the website’s own description, and the address of the page from which the data comes. Data taken from the register: the company’s registered name, registration number, status (e.g., active, in liquidation), registered office and activity code.

This is typically business data. It qualifies as personal data where it relates to a natural person — for example, the name and contact details of a sole proprietor, or an email address containing a personal name (lastname.firstname@…).

We do not pass on email addresses containing a personal name in the lists delivered to purchasers: they are shown as “(törölt)”, or “(deleted)” in the English-language edition. We keep the original address as crawl data in our own database for the period stated in B5, so that we can link an objection or erasure request to the address and carry it out, and check that the filtering is correct. We use this address neither for sale nor for our own outreach.

We do not process special categories of data (e.g., health, religious, or political data), financial data, identity document numbers, or visitors’ IP addresses or browsing histories. We do not create profiles and do not make automated decisions about natural persons. We do not record email addresses and telephone numbers that appear on more than 20 websites (typically hosting or agency contact details).

B3. For what purpose and on what legal basis?

Our legitimate interest is to produce market information useful to businesses from publicly disclosed business data. Before starting the processing, we carried out a legitimate interest assessment, a summary of which we will send you upon request. We carried out a separate legitimate interest assessment for our own business outreach.

B4. Who receives the data?

• The data list may be purchased only by businesses (under our Terms and Conditions). The purchaser becomes an independent controller of the data and undertakes by contract to use it only in compliance with data protection and advertising rules — under the rules of the list’s country (Annex 2 to the Terms and Conditions) — to inform the data subjects itself in accordance with Article 14 of the GDPR (or the UK GDPR), and, if someone objects to it, to notify us within 15 days.
• The purchaser may not transfer or publish the list.
• The lists do not contain the names of representatives or contact persons.

B5. How long do we keep it?

We keep the data for 24 months from the last crawl; after that, it is deleted or overwritten by a newer crawl. Only the data needed to identify the request — the website address or the deleted contact detail — remains on the suppression list (B6), and only for as long as the suppression list serves its purpose. We keep the data of our own business outreach (B8) for 2 years from the last email sent, so that we can show whom we wrote to and when, and so that we do not contact the same address again. An unsubscribed address remains on the suppression list after that.

B6. Objection and erasure — what we do when you ask

If you do not want us to process your data, write to adatvedelem@datalistshop.com and include your website address (domain) and the email address or telephone number concerned. You may write in English.

• We carry out your request within 72 hours: we delete your data from our database and send you a confirmation.
• We place the website or contact detail on a suppression list so that a later crawl does not collect it again.
• If the data was included in a list already sold, we proceed under the country annex of our Terms and Conditions. For the Hungarian edition, we notify the purchasers who bought it, who are obliged to delete it from their own copies as well. For the United Kingdom edition, the purchaser is not obliged to delete it from a copy already delivered, but if you contact the purchaser, it must respect your objection (D/GB).
• We do not send our own business offers to an address on the suppression list either (B8).

B7. Why didn’t you receive a separate notification?

We collected the data not from you but from your public website. In such cases, Article 14 GDPR requires information to be provided, but contacting the operators of several hundred thousand websites individually would involve a disproportionate effort. Therefore, in accordance with Article 14(5)(b) GDPR, we publish this public notice and keep it continuously available; our crawler also refers to this page.

B8. If you received a business offer from us by email

From time to time we send businesses our own offer about our data lists.

• Whom we write to: only the general business address published on the business’s own website (e.g., info@, sales@, hello@). We do not write to addresses containing a personal name, to sole proprietors, or to addresses on the suppression list.
• Who sends it: we do, from the datalistshop.eu domain. This is a separate domain, so that the online store’s email is kept apart from it. The email states our name, our address, and where your address comes from.
• What we record: the address, the name and website of the business, the address of the page where the email address was published, the time of sending, the fact of delivery or bounce, your reply and your unsubscribe. We do not track email opens or link clicks.
• How many emails: at most three (one offer and at most two reminders). If you reply or unsubscribe, the sequence stops immediately.
• Unsubscribing: with one click at the bottom of the email, by replying “unsubscribe”, or at adatvedelem@datalistshop.com. We place the address on the suppression list and will not write to it again, in connection with any of our editions.
• Legal basis and retention: as set out in B3 and B5; you also have the right to object here (C1).
• Who has access: Microsoft (mailbox) and Woodpecker (sending), as processors (A4).

C) General provisions

C1. Your rights

You can send your request to adatvedelem@datalistshop.com. We respond within one month at the latest (Article 12 GDPR); where necessary, we may ask you to verify your identity.

C2. Remedies

If you believe that the processing of your data is unlawful, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH; Falk Miksa utca 9–11., 1055 Budapest, Hungary; mailing address: 1363 Budapest, Pf. 9.; telephone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; https://naih.hu), or bring an action before a court; you may also bring the action before the regional court (törvényszék) of your place of residence or stay. We ask that you contact us first so that we can resolve your complaint quickly. If you live or operate in the United Kingdom, you may also lodge a complaint with the ICO (D/GB).

C3. Data security and personal data breaches

We receive data over an encrypted connection (HTTPS), protect access with passwords and two-factor authentication, and make regular backups. In the event of a personal data breach that poses a risk, we notify the NAIH within 72 hours and, where the risk is high, we also inform the data subjects (Articles 33–34 GDPR).

C4. Automated decision-making

We do not make automated decisions about, or create profiles of, natural persons. The classification described in Part B (e.g., whether a website is an online store) relates to the website, not to a person.

C5. Changes to this notice

We may amend this notice if the law or our processing changes; the version in effect is always available on this page, and we will send previous versions upon request. The contractual terms of purchase are set out in the Terms and Conditions: https://datalistshop.com/terms-and-conditions/.

D) Country-specific additions

This part sets out the rules that differ from or supplement the above in a given country. Where a country is not listed, Parts A–C) above apply.

D/GB. United Kingdom

• Who this applies to: you, if your data is included in the United Kingdom edition; if you buy, request a sample or subscribe from the United Kingdom; or if, as a UK business, you received a business offer from us.
• Legislation: the UK GDPR and the Data Protection Act 2018; for electronic communications and cookies, the Privacy and Electronic Communications Regulations 2003 (PECR). Any reference in this notice to an Article of the GDPR also refers to the same Article of the UK GDPR.
• Source of the data: the business’s own website (B1) and the public Companies House register (Free Company Data Product): the company’s registered name, company number, status, registered office and SIC code.
• Legal basis: compiling and selling the list, and our own business outreach: legitimate interest, Article 6(1)(f) UK GDPR, supported by a legitimate interest assessment. The sample and the newsletter: consent, Article 6(1)(a) UK GDPR and PECR regulation 22. Cookies: consent given in the cookie banner, PECR regulation 6.
• Who is excluded: the United Kingdom edition contains only companies identified in the register. Sole traders and partnerships not verified by the register are excluded, and email addresses containing a personal name are shown as “(deleted)”.
• Who receives the data: the United Kingdom edition may be purchased only by businesses; the purchaser is an independent controller and notifies us within 15 days of any objection it receives.
• Objection and erasure: as set out in B6, at adatvedelem@datalistshop.com; English is fine. We carry out the request within 72 hours, and in any case within one month. For the United Kingdom edition, the purchaser is not obliged to delete the data from a copy already delivered, but if you contact the purchaser, it must respect your objection.
• Why you did not receive a separate notification: B7 applies here as well (Article 14(5)(b) UK GDPR).
• Complaints: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone: 0303 123 1113; https://ico.org.uk. We ask that you contact us first.

This notice is version 1.4, effective as of October 25, 2026. Changes from version 1.3: our own business offers to companies (B3, B5, new B8) and their processors (A4, A5); data taken from the register and the original email address kept internally (B1, B2); the effect of an objection on lists already sold (B6); country-specific additions, starting with the United Kingdom (new Part D, C2).