Data HQ Privacy Notice: VistaConnect and BlogPilot

Version: 3.0 Effective from: 2026-09-29 Last reviewed: 2026-09-29

This notice explains how Data HQ Limited handles personal data in connection with the VistaConnect platform and the BlogPilot content service (together, the "Services"), and the websites for each. For VistaConnect it sits alongside the VistaConnect Terms of Service (which govern your commercial use of the platform), the VistaConnect Non-Disclosure Agreement (which covers confidentiality and Article 28 UK GDPR processor terms) and the Data Retention Schedule (which sets out how long we keep each category of information). For BlogPilot it sits alongside the BlogPilot Terms of Service, the BlogPilot Data Processing Agreement and the Data Retention Schedule. In the event of conflict between these documents, the order of precedence set out in the relevant Terms of Service applies.

BlogPilot and VistaConnect accounts are separate. If you use the same email address for both, we hold two accounts for you, and this notice applies to each.

This notice is published at vista.datahq.co.uk/legal/privacy and is also linked from the BlogPilot website (blogpilot.datahq.co.uk).

1. Who we are

Data HQ Limited: company number 04193862, registered office 46-54 High Street, Ingatestone, Essex CM4 9DW.

Data HQ is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration Z5561873.

Our internal Data Protection Lead is responsible for privacy compliance and can be contacted at legal@datahq.co.uk (postal: Saxon House, 27 Duke Street, Chelmsford, Essex CM1 1HT). A formal Data Protection Officer (UK GDPR Article 37) is not appointed because Data HQ's core activities do not meet the statutory threshold for mandatory appointment; we keep this position under review.

2. Our role: controller or processor

Under UK GDPR we may act as either a data controller or a data processor, depending on the data in question.

For VistaConnect, we are the controller in respect of:

• your account identifying information (email, name, password hash, company name, signup source);
• your billing and payment information;
• logs of your use of the platform (which endpoints you hit, when, how many credits you used);
• the underlying B2B database that VistaConnect queries against, which is built and maintained by Data HQ under licences from public and commercial sources (see section 4, Sources of data). Our lawful basis for maintaining this database is legitimate interest in providing B2B data services to businesses.

For VistaConnect, we are the processor in respect of any data you upload through the Data Audit, List Builder or Find Look-alikes features, including personal data in uploaded files. When we act as processor, you are the controller; our processing is carried out only on your instructions for the purposes of the Project described in the NDA. Article 28 contractual obligations are set out in section 17 of the NDA.

For BlogPilot, we are the controller in respect of:

• your BlogPilot account information (name, work email, password hash, company name) and that of the other users on your account;
• your billing and payment information;
• records of your use of BlogPilot (for example posts created, features used and AI usage, recorded for billing, support and cost control);
• information about people who ask us for a BlogPilot demonstration or who we speak to before they become customers (see section 4);
• analytics data about visits to the BlogPilot website, blogpilot.datahq.co.uk (see section 10).

For BlogPilot, we are the processor in respect of personal data collected through the BlogPilot website tracking script on a customer's website. The customer is the controller of that data, and the Article 28 terms are set out in the BlogPilot Data Processing Agreement.

3. Lawful basis for processing

We rely on one or more of the following bases:

• Contract. Most processing, in order to provide the Services you signed up for.
• Legitimate interest. For security monitoring, fraud prevention, service improvement, and maintenance of the underlying B2B database. We have performed a Legitimate Interests Assessment for the database which considers the necessity of the processing, its proportionality to the purpose, and the reasonable expectations of individuals whose data appears in the database in their professional capacity as employees, officers or representatives of a business. We consider that our legitimate interest in providing accurate B2B business information is not overridden by the rights and freedoms of those individuals, whose data is drawn from public registers or commercially licensed sources and does not relate to their private lives. You may request a summary of our LIA from legal@datahq.co.uk, and you may object to inclusion in the database or request suppression of your entry at any time by writing to the same address.
• Steps before a contract, and legitimate interest (BlogPilot prospects). When you ask for a demonstration, we process your details to take the steps you have asked for before entering into a contract, and on the basis of our legitimate interest in responding to business enquiries and following up with interested businesses. You can ask us to stop at any time.
• Legitimate interest (BlogPilot website analytics). We measure visits to the BlogPilot website to understand how it is used and to improve it. You can object at any time using the opt-out described in our Cookie Notice.
• Legal obligation. To retain accounting, tax and audit records for the period required by UK tax and accounting law.
• Consent. Where we rely on it (for example, optional marketing communications). You may withdraw consent at any time.

4. What we collect, and where it comes from

From you, directly: account data (name, work email, hashed password, company name, signup source, verification status, login timestamps); billing data (company billing address, VAT number, payment history recorded by Stripe; card numbers are never seen by Data HQ); files and content you upload; usage data; technical data (IP address, browser type, timestamps) for security and abuse-monitoring.

BlogPilot customers. In addition to account, billing and technical data: the brand, product and tone of voice information you give us; your instructions and conversations with the BlogPilot assistant; the posts, images and other content created in your account; author names and profiles you add; and the access details for the website you connect for publishing (for example a WordPress Application Password or Craft CMS token). Website access details are stored encrypted and are never displayed back once saved.

People who ask for a BlogPilot demonstration. You ask for a demonstration by emailing us at sales@datahq.co.uk. We collect the details you include in your email and in our correspondence with you, typically your name, work email address, company, telephone number, website address and your message. These are held in our Microsoft 365 email and business systems. Microsoft 365 (email, documents and Teams) is hosted in Microsoft's United Kingdom data centres. We use this information to arrange and hold the demonstration, to prepare for it (which may include looking at your company's public website and public company information), and to follow up with you about BlogPilot.

Sources of data held in our B2B database (Article 14 disclosure): we build the underlying B2B database from a combination of public and commercially licensed sources, including:

• Companies House (UK register of companies): licensed Crown Copyright data;
• Royal Mail Postcode Address File (PAF): licensed address data;
• Licensed B2B contact-data providers: commercial licences with providers who warrant a lawful basis for the data they supply us;
• Published corporate websites: public business information;
• Direct updates from data subjects: where individuals correct or request suppression of their entries.

The personal data in our B2B database relates to individuals in their professional capacity (for example, company directors recorded on public registers, or named contacts supplied by licensed business-data partners). We do not process special categories of personal data.

We ask that you do not upload special-category data to the platform, or include it in BlogPilot content.

5. How long we keep it

See the Data Retention Schedule at vista.datahq.co.uk/legal/retention (also linked from the BlogPilot website) for the full position. In summary:

• Audit jobs and their results: 30 days from job completion, automated.
• List Builder purchased lists: 24 months from purchase.
• List Builder assistant conversations: 12 months; conversations older than 12 months are deleted automatically.
• Your account: until you ask us to delete it (self-serve deletion is available in Settings).
• Tax and accounting records: up to 7 years from the end of the relevant accounting period, as required by UK law.
• Operational logs: 30 days (90 days for audit-flagged events).
• Database backups: 7-day rolling window.
• BlogPilot content and settings (posts, conversations, brand settings, images): until you delete them, or until your account is closed.
• BlogPilot website access details (for publishing): until you disconnect your website in Settings (which deletes them immediately) or ask us to disconnect it, or until your account is closed.
• BlogPilot demonstration requests from people who do not become customers: 24 months from our last contact with you.
• BlogPilot website tracking data (held for customers as processor): for as long as the customer's account is open. It is deleted when the account is closed, after the closure grace period, or sooner if the customer asks us to delete it, in which case we delete it within 30 days of the request. The BlogPilot Data Processing Agreement gives the full position.

Where you exercise your right to erasure, your data is removed from our live systems within 24 hours. Your data may persist in system backups for up to 7 additional days while the backup window rolls forward; it is not accessible for operational use during that period and will be automatically aged out.

6. Where we store it

VistaConnect and BlogPilot are hosted in Microsoft Azure's UK South region. Personal data does not leave the UK in the ordinary course of storage. Some sub-processors may process data outside the UK (see section 7).

We use Microsoft's Azure OpenAI Service to provide AI features. The service is hosted in the UK, but Microsoft may process prompts and outputs in other Azure regions to provide it. Microsoft does not use this data to train its models.

BlogPilot's AI image features use OpenAI, a provider based in the United States (see section 7), so the text description of an image, and when you ask for an image to be changed, the image itself, are sent outside the UK for that purpose.

Where personal data is transferred from the UK to a country without a UK adequacy decision, Data HQ relies on the UK International Data Transfer Agreement, or on EU Standard Contractual Clauses with the UK Addendum, together with supplementary measures as appropriate.

7. Sub-processors and other third parties

We do not sell your personal data. The following sub-processors assist in delivering the Services:

Microsoft 365. Microsoft 365 (email, documents and Teams) is hosted in Microsoft's United Kingdom data centres.

Azure OpenAI training. Data processed through the Azure OpenAI Service is subject to Microsoft's commitment that customer inputs and outputs are not used to train, retrain or improve the foundation models made available through the service, nor are they shared with other Microsoft customers or OpenAI. See Microsoft's published Azure OpenAI data handling terms for the current position.

Lead Qualifier web search. When Data HQ staff use the Lead Qualifier to research a company, search queries are sent to Microsoft's Grounding with Bing Search service. Microsoft provides it under the Grounding with Bing terms of use and the Microsoft Privacy Statement, not under Microsoft's data protection terms for Azure, and the queries may be processed outside the UK. This applies to staff use only, and only for company research.

OpenAI image generation (BlogPilot). When you ask BlogPilot for an image, we send the text description of the image to OpenAI's image service. When you ask for an existing image to be changed, we also send that image. We do not send your account details, your website access details or your website visitors' data. We have accepted OpenAI's Data Processing Addendum. OpenAI does not use data sent through its API to train its models, and we have not opted in to sharing data with OpenAI to improve its models. OpenAI keeps abuse-monitoring logs of requests for up to 30 days, unless longer retention is required by law or is reasonably necessary to protect its services or any third party from harm.

We commit to giving you at least 30 days' notice of any proposed addition or replacement of a sub-processor, delivered as described in the Sub-processor List. The current list is also published and maintained at vista.datahq.co.uk/legal/sub-processors, and is linked from the BlogPilot website.

We share personal data with third parties only in these circumstances:

• with sub-processors, as described above;
• where legally required (see section 6 of the NDA);
• with a successor business in the event of a merger, acquisition or reorganisation, in which case your rights under this notice transfer with the business, and the successor is bound by these terms until it publishes an equivalent notice of its own to you.

8. Your rights

You have the following rights under UK GDPR in respect of your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data.
• Erasure: ask us to delete your data, subject to the statutory exceptions in the Retention Schedule.
• Restriction: ask us to pause processing while a query is resolved.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing we carry out on a legitimate-interest basis, including processing for direct marketing (we will stop without exception if you object to direct marketing).
• Withdrawal of consent: where consent is the lawful basis.

To exercise any right, email legal@datahq.co.uk. We respond within 30 days (extendable by a further 60 days for complex requests, with explanation).

If you visited the website of a BlogPilot customer and your question is about that website's tracking, please contact that business first, because it is the controller of that data (see section 10).

If you are dissatisfied with our response, you may complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk/make-a-complaint, 0303 123 1113.

9. Data security

We protect your data with a combination of technical and organisational measures:

• Encryption in transit: TLS 1.2+ for all portal, application and API traffic.
• Encryption at rest: Azure-managed encryption for databases, backups and object storage.
• Access controls: access to production data is restricted to named Data HQ personnel on a need-to-know basis, with mandatory multi-factor authentication.
• Sub-processor contracts: all sub-processors are contractually bound by equivalent data-protection obligations.
• Incident response and notification. We will notify the Information Commissioner's Office of any reportable personal-data breach within 72 hours of Data HQ becoming aware, in line with UK GDPR Article 33. Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in plain language, describing the breach, the data affected, the likely consequences and the steps we are taking.

10. Cookies and tracking

The VistaConnect and BlogPilot applications use only strictly necessary cookies and similar storage to keep you signed in and remember preferences. We do not use third-party advertising or cross-site tracking cookies within the logged-in applications.

The public VistaConnect marketing pages (vista.datahq.co.uk homepage and similar) may use analytics cookies, subject to our separate Cookie Notice, presented to you on your first visit and available from the footer of those pages.

The BlogPilot website (blogpilot.datahq.co.uk) measures visits using cookieless analytics: it does not set cookies or store anything on your device for analytics. Data HQ is the controller of that analytics data. We measure it with our own BlogPilot tracking script, the same one our customers use (it records the page address without any query string, the referring page, UTM campaign fields and the device type, and uses your IP address only in memory to count unique visits for a day, without storing it); no third party receives it. It does not record your country or location. You can opt out using the switch on the BlogPilot website's Cookies page, and we treat a Global Privacy Control signal from your browser as an opt-out. The Cookie Notice gives details.

BlogPilot website tracking for customers. BlogPilot customers can add a tracking script to their own websites to measure the performance of their content. For visitors to those websites, the customer is the controller and Data HQ acts as its processor. If you visited a customer's website and have a question about this, please contact that business first. What the script collects is described at blogpilot.datahq.co.uk/tracking-privacy.

11. Automated decision-making and profiling

We do not carry out any automated decision-making that has legal or similarly significant effects on individuals. Certain features (for example, the credit grade displayed in the Company Intelligence view) are derived from public Companies House filings and are informational only; they are not used to make automated decisions about individuals.

12. Children

VistaConnect and BlogPilot are B2B services intended for use by people acting in a business capacity. They are not intended for use by individuals under 18 and we do not knowingly create accounts for anyone under 18.

13. Marketing

We may send you transactional emails about your account (verification, billing, breach notifications, account changes). We may also send you infrequent service-related announcements relevant to your use of the Services, on the basis of our legitimate interest in keeping you informed. We do not send unsolicited marketing to individuals under PECR without your consent. You can opt out of non-transactional communications at any time using the link in each message or by emailing legal@datahq.co.uk.

If you asked us for a BlogPilot demonstration, we may contact you about BlogPilot afterwards as a business contact. You can ask us to stop at any time.

14. Changes to this notice

We may update this notice from time to time. The version number and last-reviewed date at the top of this document tell you when. Material changes (defined as changes that reduce your rights, expand the purposes for which we use your data, or change our sub-processors in a way that affects where your data is processed) will be notified by email at least 14 days in advance and require you to re-accept on next login. A changelog is maintained at vista.datahq.co.uk/legal/privacy/changelog.

Quick reference

• General data-protection queries: legal@datahq.co.uk
• BlogPilot demonstrations: sales@datahq.co.uk
• Postal address: Data HQ Limited, Saxon House, 27 Duke Street, Chelmsford, Essex CM1 1HT
• ICO registration: Z5561873
• ICO (UK regulator): ico.org.uk (or 0303 123 1113)

Version history