Privacy policy

Last updated: 12 July 2026 · Applies to fairlead.dsl4.com ("Fairlead", "we").

Who is responsible for your data

The data controller is Dominic Simon Ward, sole trader (autónomo), NIF Y2423461B, Calle Armiño, Arona, Santa Cruz de Tenerife, Spain. For anything in this policy, including exercising your data rights, write to legal@dsl4.com.

What we collect and why

If you start a review as a buyer. Through the "Start your review" form and the advisor conversation we collect: your company name, your name, work email, phone number (optional), sector, employee count, city/region, your project description in your own words, and the full conversation transcript. From that we compile a structured requirement, written advice, and match scores. Where you mention them, we also keep a durable account profile of your IT environment (systems in use, contract renewal dates) so we can check back when a renewal you told us about comes due. Legal basis: taking steps at your request before a contract (Art. 6(1)(b) UK GDPR / GDPR) and our legitimate interest in operating the matching service (Art. 6(1)(f)).

If we contact you proactively (B2B outreach). We process business contact details — name, work email, company, city — of people at UK/EU companies likely to need the IT services we cover, compiled from publicly available business sources. Legal basis: legitimate interest (Art. 6(1)(f) UK GDPR), consistent with PECR corporate-subscriber rules for business email. Before any contact we record a legitimate-interest assessment, and every message carries a one-click unsubscribe that is honoured immediately and permanently, across all channels. Before any phone call we screen the number against the TPS and CTPS registers, and calls are individually approved by a human. You can object to this processing at any time (see "Your rights") and we will stop.

If you join as a partner. We collect your company profile (name, website, location, services, sectors, size focus), contact name and email, case-study evidence you submit for vetting, and subscription and billing records. Legal basis: performance of the partner agreement (Art. 6(1)(b)).

Phone calls. If our voice agent feature is active and a call is placed, the call is carried by Vapi and we store the call outcome and transcript. Calls only happen after TPS/CTPS screening, suppression checks and explicit human approval.

Suppression list. When you unsubscribe or ask never to be contacted, we keep your email address, phone number or domain on a suppression list. We retain this indefinitely — it is the mechanism that guarantees we never contact you again, and we rely on legitimate interest and our legal obligation to honour your objection to keep it.

Website analytics. We use Cloudflare Web Analytics, which is cookieless and does not build individual profiles. This site sets no tracking or advertising cookies.

Audit log. Compliance-relevant events (messages sent, suppressions added, legitimate-interest records, match decisions) are written to an internal audit log so we can demonstrate the rules above were actually followed.

Who receives your data

• Matched partners. This is the core of the service: if you are a buyer and we match you, up to four partners receive your company name, contact details, location and stated need so they can contact you. We tell you who they are before they do.
• Cloudflare, Inc. — hosting, database storage and cookieless analytics.
• Resend, Inc. — email delivery.
• OpenAI — the advisor conversation and requirement text are processed via OpenAI's API to extract your requirement and draft advice. We do not permit our data to be used to train their models.
• Vapi, Inc. — voice call delivery, only when the voice feature is active.
• Stripe Payments Europe Ltd. — partner subscription payments, when card payment is enabled. We never store card data.

We never sell personal data, and we never share buyer data with anyone except the matched partners described above and the processors listed.

International transfers

Some of the providers above process data in the United States. Where that happens, transfers are protected by the EU–US Data Privacy Framework and/or Standard Contractual Clauses (with the UK Addendum / IDTA where UK GDPR applies).

How long we keep data

• Buyer review and match data: for the life of your engagement with the service, plus a reasonable period for follow-up you have agreed to (e.g. a renewal date you told us about).
• Outreach records and legitimate-interest assessments: retained as evidence of compliance for as long as we could be required to demonstrate it.
• Prospect data that never converts: reviewed periodically and removed when no longer relevant.
• Suppression list: indefinitely, as explained above.
• Partner billing records: statutory tax retention periods.

Your rights

Under the UK GDPR and the EU GDPR you can ask for access to your data, rectification, erasure, restriction, and portability, and you can object to processing based on legitimate interest. Your right to object to direct marketing is absolute: use the one-click unsubscribe in any message, or write to legal@dsl4.com, and we will stop immediately and add you to the suppression list.

To exercise any right, email legal@dsl4.com. If you are unhappy with our response you can complain to the UK Information Commissioner's Office (ico.org.uk) or the Spanish supervisory authority, the AEPD (aepd.es).