Privacy notice
What we hold, where it came from, and how to make us stop.
Most people reading this arrived because we emailed them. That section is first, and it tells you exactly what we knew about you before we wrote.
Last updated 23 September 2026 · Mercia Sales Engine Ltd · Company No. 16966606
1. If you want us to stop, start here
Reply to the email and say so, use the unsubscribe line at the bottom of it, or email privacy@merciasalesengine.co.uk. Any of the three works and none of them needs a reason.
Your address then goes onto a suppression list that is checked before every campaign we ever send. That list is the only thing we keep about you afterwards, and we keep it precisely so that we cannot contact you again by accident. You do not have to trust us on this — it is enforced by the software, not by someone remembering.
2. Who we are
Mercia Sales Engine Ltd, a company registered in England & Wales, Company No. 16966606. Registered office: 139 Solihull Road, Shirley, Solihull, West Midlands, B90 3HW.
We run outbound sales campaigns for UK managed service providers (MSPs). We are registered with the Information Commissioner's Office as a data controller, reference ZC240991 — you can check that on the ICO's public register at ico.org.uk.
For anything in this notice, or to exercise any right in it, contact privacy@merciasalesengine.co.uk. It reaches Mohammed Rahman, the director, who deals with these personally.
3. If we emailed you out of the blue
We are an independent controller of this data. We chose to collect it, we decided to write to you, and the responsibility is ours — not our client's, even though the email arrived in their name.
What we hold about you
Four things, and deliberately nothing else:
- Your name and job title.
- Your work email address at the company you work for.
- Public information about that company — its registered details, size band, sector, address.
- The public record that prompted us to write, kept with the source link and the date it was published.
We do not hold your home address, your personal email address, your personal phone number, your social media activity, or anything about you outside your working role. This is a deliberate limit in how the system is built, not a promise about intentions.
Where it came from
We did not buy a list. Campaigns are built from the public record first:
| Source | What we take from it |
|---|---|
| Companies House | Company details, director appointments, registered office changes, filed accounts |
| Find a Tender / Contracts Finder | Public contract and framework awards |
| SRA, FCA, CQC, Charity Commission | Regulated-firm details and register changes |
| UKRI Gateway to Research | Published grant awards |
| Get Information About Schools (DfE) | School and academy details |
| Business contact data providers | Names, job titles and work email addresses — currently Apollo and FullEnrich |
| MillionVerifier | Checks the address is real and deliverable before anything is sent |
If you want to know which of these your record came from, ask. We keep the source and the date against every row, so we can answer specifically rather than generally.
Are you being profiled?
Not in any sense that affects you. We match companies against a client's stated customer profile and we look for dated public events that suggest a conversation might be timely. The personalised line in our emails is built from that source record by a template — it is not a judgement about you, and no decision with legal or similarly significant effects is made about you by automated means.
4. Why we are allowed to do this
Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): our interest, and our client's, in reaching businesses that may need their services. We have weighed that against your interests, and these are the limits that came out of it:
- We write only to limited companies and LLPs. Sole traders and partnerships are excluded before a campaign is even built, because under the Privacy and Electronic Communications Regulations 2003 they are treated as individuals rather than corporate subscribers.
- We write only to work addresses, about work, to people whose role plausibly covers the subject. Personal-domain addresses are rejected by the system.
- Every email says who we are and who it is on behalf of, and carries a working opt-out.
- We contact a company for one client only — you will not receive the same campaign from several of our clients.
- Volumes are low and deliberate. This is not bulk mail.
You can object to any of it at any time, and for direct marketing that objection is absolute: there is no balancing test we get to apply, and no case we get to make. See section 1.
5. Who else sees it
Two categories, and it matters that you can tell them apart.
Suppliers who process data on our instructions. The email platform that delivers our campaigns (Instantly), the verification and contact-data providers named above, our email and file storage (Google Workspace), our website host (Netlify), and our booking system (Cal.com). Each is under a contract that restricts them to what we ask of them.
Our client — but only if you engage. If you reply with interest or book a meeting, we pass your reply and your details to the MSP whose campaign it was, so they can hold the conversation. That is the whole point of the email. If you ignore us, or opt out, your details are never passed to anyone. We do not sell data and we do not share it for anyone else's marketing.
Some of the suppliers above are based outside the UK. Where personal data leaves the UK, we rely on the Information Commissioner's International Data Transfer Addendum to the EU Standard Contractual Clauses, or on UK adequacy where it applies to that country.
Email privacy@merciasalesengine.co.uk and we will tell you which supplier holds what, and on what safeguard.
6. How long we keep it
| What | How long |
|---|---|
| Prospect records | Reviewed at least once a year; deleted when the record is no longer relevant to any active or planned campaign |
| Suppression list | Kept indefinitely — this is what makes an opt-out permanent |
| Enquiries that go nowhere | 12 months |
| Client records and correspondence | Duration of the contract, then 12 months |
| Invoices and accounting records | 6 years, as company and tax law requires |
The suppression list is the one entry that looks like an exception and is not. Deleting your address entirely would remove the only thing stopping us from sourcing it again from a public register and writing to you a second time.
7. If you are a client, or you contacted us
If you book a call, fill in a form or email us, we hold your name, work contact details, your company's details and our correspondence — to reply, to deliver the service, and to invoice. The basis is performance of a contract, or legitimate interests where there is no contract yet.
If you are a client, we also hold the suppression list you give us at onboarding. We use it for exactly one thing: making sure we never contact the people on it. It is not used for anything else and it is not merged into anything.
8. This website
This site sets no cookies and runs no analytics. We do not know that you visited, and there is no banner to dismiss because there is nothing to consent to.
One honest caveat: the typefaces are served by Google Fonts, so your browser fetches them from Google and Google receives your IP address in the process. Our host, Netlify, keeps standard server logs.
Booking a call takes you to Cal.com, which has its own privacy notice and its own cookies.
9. Your rights
Under the UK GDPR you can ask us to give you a copy of what we hold, correct it, delete it, restrict what we do with it, or hand it over in a portable form. You can object to processing based on legitimate interests — and where the purpose is direct marketing, that objection is absolute and we must stop.
Email privacy@merciasalesengine.co.uk. We respond within one month, and there is no charge. We may ask you to confirm who you are, but only where we genuinely cannot tell.
If we get it wrong, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you gave us the chance to fix it first, but that is your call, not ours.
10. Changes to this notice
The date at the top is the date this version took effect. If we change how we use personal data in a way that affects you, we will update this page and change that date. We do not keep a copy of who read which version, so if a change matters to you, the current page is the one that governs.