In plain English: If you received a pen and letter from us, you're reading this because we'd like to introduce our service. We found your business details on public UK registers. We never sell your data, and you can stop all future mail in one step — reply "STOP" by post, or email hello@lumpymailpens.co.uk. We'll never contact you again.
1. Who we are
We are Lumpy Mail Pens — a trading name of Paul Jones (sole trader), a UK direct-mail marketing business. We send personalised promotional items (a branded pen with a short letter) to UK businesses we think may be interested in our service. We are the data controller for the personal data described in this notice.
- Operator: Paul Jones (sole trader), trading as Lumpy Mail Pens
- Address: Level One, Basecamp Liverpool, 49 Jamaica Street, Liverpool, L1 0AH
- Email: hello@lumpymailpens.co.uk
- Data protection contact: Paul Jones, at the same address and email
- ICO registration number: ZC174907
2. Why you've received this
You're reading this for one of these reasons:
- You scanned the QR code on a piece of mail we sent you, or
- You typed in the short URL printed on that letter, or
- You arrived here directly by searching for us.
If we sent you mail, we obtained your business details from a combination of UK public registers and, optionally, licensed business-to-business data providers. This notice explains what we hold, why, and your rights.
3. Where we got your data
For prospecting mail, we use publicly available business information, for example:
- Companies House (company name, number, registered/trading address, directors of limited companies, SIC code)
- Public regulators and registers (e.g. Charity Commission, FCA, CQC, FHRS, Ofsted, EPC, The Gazette)
- Royal Mail PAF address data (where licensed)
- Optional licensed B2B data providers
We also generate our own records about whether our letter was sent, whether the QR code was scanned, and whether you contacted us or opted out.
4. What data we hold
| Type | Example |
|---|---|
| Business identity | Business name, company number, trading name |
| Address | Registered and/or trading address |
| Sector / activity | SIC code, regulator category, permissions |
| Director / officer (limited companies only) | Name, role (from Companies House Open Data) |
| Regulatory status | FHRS rating, Ofsted outcome, CQC rating, EPC rating |
| Our interactions with you | Whether our letter was sent, if the QR was scanned, if you contacted us or unsubscribed |
What we do NOT hold
- Home addresses (unless they are also the business address)
- Health, sexual orientation, religious, political or trade-union data
- Criminal-conviction data (except publicly published insolvency, for suppression only)
- Data about children
- Special-category data of any kind
5. Why we process your data, and our lawful basis
We process your data to: send you one personalised mailing introducing our service; decide whether to mail you (we screen out opt-outs and "do not mail" signals); measure whether our letter reached you and was of interest (via the QR scan); provide our service if you respond; and honour your objections by keeping a suppression record so we never contact you again.
Our lawful basis is Legitimate Interests under UK GDPR Article 6(1)(f) — promoting our direct-mail pens service to UK businesses that may benefit from it. We have balanced this interest against your rights and concluded the processing is proportionate. A copy of our Legitimate Interests Assessment (LIA) is available on request to hello@lumpymailpens.co.uk.
6. Who we share your data with
We do not sell your data and we do not share it with unrelated third parties for their own marketing. We use the following processors, each under a data processing agreement:
| Processor | Purpose | Location |
|---|---|---|
| Hostinger | VPS hosting + transactional email | Lithuania (EEA) |
| Backblaze B2 | Encrypted backups | US (UK IDTA) |
| Anthropic (Claude API) | AI copy drafting (no prospect PII sent — anonymised context only) | US (UK IDTA) |
| Royal Mail | Postal delivery | UK |
| Monzo Business | Payment account + invoicing (bank transfer and card payments, only if you purchase) | UK |
| Stripe | Card processing via Monzo's connected Stripe (only if you purchase) | US / EU (UK IDTA) |
| Cloudflare | DNS, CDN, security | Global (UK IDTA) |
International transfers to non-EEA countries are covered by the UK International Data Transfer Agreement (IDTA) or the UK Addendum to Standard Contractual Clauses. EEA transfers rely on the UK's adequacy decision for the EEA.
7. How long we keep your data
- Active prospects: 24 months since last engagement, then moved to suppression.
- Suppression records: kept indefinitely — this is how we guarantee we never re-contact someone who opted out. It holds the minimum needed (business name, address hash), not full PII.
- Customer records (if you purchase): 7 years for tax compliance.
- Backups: 30 days rolling.
8. Your rights
You have all the rights under UK GDPR: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), and rights around automated decisions (Art. 22 — not applicable; we use human judgement for all campaigns).
You also have an absolute right to object to direct marketing (Art. 21). If you tell us to stop, we must stop — and we will. To exercise any right, email hello@lumpymailpens.co.uk; we respond within 30 days.
9. How to opt out (stop all future mail)
Any one of these stops all future mail from us — you only need to do one, and we action it within 30 days and confirm in writing:
- By post: reply "STOP" on a postcard or letter to: Level One, Basecamp Liverpool, 49 Jamaica Street, Liverpool, L1 0AH.
- By email: email hello@lumpymailpens.co.uk with "STOP" in the subject.
10. Complaints
If you're unhappy with how we've handled your data, please contact us first — we'd like the chance to put it right. You also have the right to complain to the UK regulator:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Wycliffe House, Water Lane, Wilmslow, SK9 5AF
11. Security
We protect your data with HTTPS encryption on all web traffic, SSH key-only server access, encrypted backups, firewalling and intrusion prevention, and regular security updates. In the unlikely event of a breach, we will notify the ICO within 72 hours where required, and inform affected subjects where the risk to their rights is high.
12. Changes to this notice
We may update this notice. Material changes will be posted here with a new "last updated" date and highlighted at the top of the page for 30 days.
13. Contact
For anything about this notice or your data:
- Email: hello@lumpymailpens.co.uk
- Post: Level One, Basecamp Liverpool, 49 Jamaica Street, Liverpool, L1 0AH
- Response time: within 30 days (usually much sooner)
LumpyMailPens.co.uk — Liverpool, Merseyside, England. ICO registration ZC174907.