Last updated 2026-11-09
This notice explains what personal data DataPacts collects through its forms and its editorial inbox, why, and what you can do about it. DataPacts publishes an independent reference on AI training data licensing. Form data is not sold and is not used to train language models, and the site runs no analytics, advertising vendors or tracking cookies.
Written by the DataPacts Editorial Team; the facts on every page follow how we source, date and check every figure.
Who is responsible for your data
The controller of the personal data described here is DataPacts, which you can reach at editorial@datapacts.com. Every request about personal data goes to that editorial inbox.
What each form collects, why, and for how long
Each DataPacts form collects only what it needs to handle one kind of request, and each has its own purpose, legal basis and retention period. The table below lists the four channels (as of 2026-11-09), with the DataPacts form specification as the source.
| Form | Status | Data collected | Purpose | Legal basis (plain words) | Kept for | Source |
|---|---|---|---|---|---|---|
| Company data enquiry | live | country, company status, headcount band, data types and volume, name, work email, role, consent record | to read the enquiry and, where buyers' published criteria fit, offer an independent introduction | steps you asked DataPacts to take; for any introduction to a buyer, your agreement | 24 months from submission | DataPacts form specification |
| Introducer form | not yet live | introducer's contact details and the details of the company, estate or client they refer (fields final when the form goes live) | to handle the referral | legitimate interests in handling referrals (Art. 6(1)(f)), weighed against the referred person's interests | as long as needed to handle the referral | DataPacts form specification |
| Deal tracker updates by email | not yet live | email address | to send deal tracker updates | your consent, withdrawable by unsubscribing | until you unsubscribe | DataPacts form specification |
| Email to editorial@datapacts.com | live | what you write and your email address | to answer you and handle corrections | legitimate interests in answering correspondence (Art. 6(1)(f)) | as long as needed to answer | DataPacts form specification |
Article 6(1)(f) of Regulation (EU) 2016/679 (GDPR, in force 2016-05-24, applicable from 2018-05-25) allows processing that is necessary for the legitimate interests of the controller or a third party, unless the interests or fundamental rights of the data subject override them. Every submission also triggers a short notification email to the editorial inbox.
An introducer may name another person, for example the owner of a company or the contact at an estate. Where data about that person was not obtained from them, Art. 14(3)(a) GDPR requires the information to reach them within a reasonable period and at the latest within one month, and this notice is that information.
Where your data is stored and who processes it
Form submissions are stored in a Cloudflare D1 database, and each submission also sends a short notification email to the DataPacts editorial inbox. Cloudflare, Inc. acts as a processor, handling the data on behalf of DataPacts within the meaning of Art. 28 GDPR. The two processing steps are:
- Cloudflare hosting and the D1 database, where each submission is stored for the period shown in the table
- Cloudflare email routing, which delivers the notification to the editorial inbox
The hosting service also processes technical data needed to deliver pages and keep the site secure.
What DataPacts does not do with your data
DataPacts runs no analytics, no advertising vendors and no tracking cookies, and it does not sell form data or use it to train language models. The four commitments are:
- No analytics: visits are not measured with an analytics tool
- No advertising vendors: no ad network or marketing pixel receives site data
- No tracking cookies: the site sets no cookies to follow readers
- No sale and no model training: form data is neither sold nor used for training
The statement on model training is explicit because Connecticut's amended privacy act (P.A. 25-113) requires privacy notices to say, from 2026-07-01, whether personal data is collected, used or sold to train large language models. DataPacts does not claim that the act applies to it. Funding and the rule against taking a cut of any sale are set out in how DataPacts is funded.
Transfers outside the EU and EEA
Cloudflare, Inc. is a US company, so data processed through its services may be handled outside the EU and EEA. Chapter V of the GDPR (Arts. 44 to 49) allows such a transfer on the basis of an adequacy decision (Art. 45(1)), appropriate safeguards (Art. 46(1)) or, in limited cases, a derogation (Art. 49(1)). One adequacy decision is Commission Implementing Decision (EU) 2023/1795 of 2023-07-10 on the EU-US Data Privacy Framework, which the EU General Court upheld in case T-553/23 on 2025-09-03; an appeal, C-703/25 P, is pending as of 2026-11-09.
Your rights and how to use them
You can ask DataPacts for access to, correction or erasure of your data, object to processing based on legitimate interests, withdraw consent at any time, and complain to a data protection supervisory authority. The six rights are:
- Access: a copy of the data held about you
- Rectification: correction of inaccurate data
- Erasure: deletion where Art. 17 GDPR applies
- Objection: to processing that rests on legitimate interests
- Withdrawal of consent: at any time, for example by unsubscribing
- Complaint: to the supervisory authority where you live or work
To use any of these rights, write to editorial@datapacts.com and say which right and which submission you mean. DataPacts answers within the period the law sets.
Changes to this notice
DataPacts updates this notice when a form, a processor or a retention period changes, and the date at the top shows the last change. A new form, such as the introducer form going live, triggers an update before the form accepts data.
Related pages
Questions not answered here go to the editorial inbox listed on the contact page.