This notice covers AutoPitch: the service that sends letters. The archive that the data is read from is a separate purpose with its own notice, and the two say different things on purpose — see "Two purposes" below.
The controller for the processing described here is Wiramu Ltd (company number NI718907), United Kingdom.
Postal address: Office 514, 92 Castle Street, Belfast, Northern Ireland, BT1 1HE
Email: hello@wiramu.co.uk
ICO registration: Pending
Wiramu Ltd operates two things. One is an archive of UK public registers, which keeps a dated copy of what each register said on each day; that archive is not used to contact anyone or to build marketing profiles, and its notice says so.
The other is AutoPitch, which reads food hygiene data out of that archive and uses it to post commercial letters to food businesses. That is a different purpose with a different lawful basis, and it is the purpose this notice covers. Keeping them apart — separate notices, separate systems, separate records — is how both statements stay true.
Two groups.
People who buy a territory. We hold the email address you sign in with, your business name and letterhead, your letter copy, and a record of what was sent for you and what it cost. Basis: performance of a contract.
Business name, trading address, food hygiene rating and inspection date, all as published by the Food Standards Agency. Where the business's own website publishes a phone number or email address, we also hold that, together with the web page it came from and a Google Place ID used only to locate that page — never bought or sourced from a third-party contact database. Basis: legitimate interests. Postal contact relies on that basis alone; contacting a business by phone or email additionally requires it to be lawful under the Privacy and Electronic Communications Regulations, which we check before any contact detail is shown to a contractor — see "How we screen before disclosing contact details" below.
A phone number or email is only ever shown to a contractor once we have classified the business as one PECR permits electronic contact for — broadly, a registered company rather than a sole trader, and not currently subject to a telephone-preference screening hit. Until that classification exists, the detail is withheld and the contractor sees a note explaining why, not a guess. An objection recorded against a business withholds its contact detail from every contractor regardless of classification.
Not from you. It comes from the Food Standards Agency's published food hygiene
rating register, at ratings.food.gov.uk, which lists food
businesses, their trading addresses and their inspection results. We hold no
data about any food business beyond what that register publishes.
This paragraph exists because Article 14 of the UK GDPR requires it: when personal data is obtained from somewhere other than the person it concerns, that source has to be named.
Letters are addressed to a business at its registered trading address. The register carries no owner name, and our letter templates have no placeholder for one — a contractor cannot insert one even if they want to.
We are aware that a sole trader's business name is sometimes their own name, and that a small number of registered food premises are residential addresses. Two things follow from that, and both are enforced in code rather than by policy: premises categorised as childcare, caring premises or schools are never written to at all, and neither are mobile caterers or farm producers, whose registered addresses are disproportionately homes.
Use the reference code on the letter, or email opt-out@wiramu.co.uk. An objection is permanent and applies across every contractor using this service, not just the one who wrote to you. We will confirm within 2 working days.
You also have the right to ask what we hold, to have it corrected, and to complain to the Information Commissioner's Office. Because our copy comes from a public register, a correction at the register itself is usually the effective remedy, and our reply will say which body to approach.
A record of every letter sent — who it went to, when, on whose behalf, and the exact document — is kept indefinitely. That record is what lets us answer a complaint years later with the actual letter rather than a description of it. Suppression and objection records are also permanent, for the obvious reason: forgetting that someone objected would defeat the objection.
A phone number or email address found by enrichment is kept only while the business remains an active lead in a contractor's campaign. Once it drops out of active use — because it was written to, because the territory or subscription that would have used it ends, or because too much time has passed for the data to still be current — we delete it rather than holding it in case it becomes useful again. If you object, we delete it immediately regardless of campaign status; see "How to make it stop" above.
Stripe processes payments; card details never reach our systems. A print-and-post provider receives the name, address and letter content needed to produce and post the item. Where a business's phone number or email has cleared the screening described above, the contractor who holds that business's territory sees it. No other contractor does, and a business that has objected is never shown to any contractor. We do not sell data to anyone outside this list.
We do not sell data, and a contractor sees only the leads in the territory they are paying for.
UK and EEA only.