Ecommerce prospecting - compliance guidance

Stratford IQ is built so that you can prospect UK ecommerce stores legitimately. This page explains the legal basis we rely on, the decisions baked into the product, and your obligations as a customer.

Not legal advice. This is a plain-English summary of how we have designed the product to be compatible with UK data protection law. You are responsible for your own compliance programme.

Our lawful basis

We rely on legitimate interests under UK GDPR Article 6(1)(f) for indexing and surfacing UK business data. Our legitimate interest is to enable business-to-business intelligence and prospecting for UK agencies, sales teams and researchers. We have performed a documented Legitimate Interest Assessment that covers necessity, proportionality and a balancing test against the rights of data subjects.

Data about registered companies, their directors and PSCs comes from Companies House, which is published as public sector information. Director data for B2B prospecting is widely recognised as a legitimate interest use case, supported by the Experian tribunal precedent and the Data (Use and Access) Act 2025.

Sole traders and PECR

Not every online store is a UK limited company. Many are operated by sole traders or unincorporated businesses. In those cases, the person behind the business is a natural person, and direct marketing to them is governed by the Privacy and Electronic Communications Regulations (PECR).

PECR generally requires consent before sending unsolicited marketing to individuals by electronic means. Penalties are up to £17.5 million or 4% of global turnover. The safest way to stay on the right side of PECR is to prospect to incorporated businesses only.

We therefore flag any store that has no linked Companies House registration as a likely sole trader and hide unmatched stores by default in the Shopify Finder. You can turn them on - we'll warn you first, and we'll make sure you have confirmed you have read this page.

Data we index

Company data - from Companies House daily bulk feeds (companies, accounts, PSC, officer appointments).
Director and PSC data - names, role, month/year of birth, nationality, country of residence. We do not display the day component of date of birth, and we respect suppressed addresses.
Website crawl data - publicly reachable content from the .uk namespace, crawled respecting robots.txt. This includes the detected tech stack, page titles, meta descriptions, and contact details published on contact pages.
Extracted contacts - emails, phone numbers and social profiles that appear in the public HTML of each crawled site, tied to their source page for context.

Your obligations as a customer

When you use Stratford IQ to build outreach lists, you become the data controller for your use of that data. You must have your own lawful basis and comply with any restrictions that apply to your outreach.

Have a documented lawful basis (most likely legitimate interests for B2B, or consent for sole traders).
Comply with PECR for any electronic marketing - including keeping an internal opt-out/do-not-contact list.
Honour unsubscribe requests promptly.
Do not contact sole traders without consent.
Keep exports secure and delete them when no longer required.
Do not re-sell, re-publish or enrich this data and expose it to third parties outside of your own outreach.

Data subject rights

Anyone whose data appears in our indexes can request access, correction, restriction or deletion. We honour these requests within one month. See our GDPR compliance page for the opt-out form, or email the contact listed on the privacy policy.

Trademark disclaimer

Not affiliated with Shopify Inc. Shopify is a trademark of Shopify Inc. All other trademarks are property of their respective owners.