Privacy Policy

B2B Forge Limited ("B2B Forge", "we", "us") supplies business contact data relating to companies that exhibit at trade shows and expos. We are the controller of the personal data described in this policy.

This policy covers two different groups, and the second is the one most privacy policies bury. Sections 2 to 4 cover visitors to this website. Section 5 onwards covers the individuals whose business contact information appears in our database — people who have not contacted us and may not know we exist. If you found your details in a list somebody bought, section 10 is what you want.

We do not build advertising profiles from visitor analytics, and we do not sell visitor data.

We use the minimum set of cookies needed to run the site and understand aggregate traffic. We do not run advertising or cross-site tracking cookies.

You can block or delete cookies in your browser settings. Blocking strictly necessary cookies may prevent forms from submitting.

We hold information about companies that exhibit at trade shows, and about individuals at those companies in their professional capacity only.

We do not knowingly collect information about individuals acting in a personal capacity. We do not collect special category data as defined by the UK and EU GDPR — no health, biometric, genetic, racial or ethnic origin, political opinion, religious belief, trade union membership or sexual orientation data. We do not collect data about children, consumer purchase history, or financial account information.

Exhibitor information is obtained through commercial arrangements with data partners and supplemented from public business sources — company websites, published exhibitor directories, corporate registries and public professional profiles.

We do not obtain data by circumventing access controls, by scraping services in breach of their terms, or from breach or leak datasets.

Under the UK GDPR and EU GDPR we must have a lawful basis for each purpose. Ours are set out below.

Where we rely on legitimate interests we have carried out a balancing assessment weighing our interest against the rights and freedoms of the individuals concerned. We will provide a summary on request.

Legitimate interests is not a blank cheque. It is precisely why an objection under section 10 takes effect immediately rather than being weighed case by case.

We will name our current processors on request. We do not disclose personal data to anyone else.

We are established in the United States, and our customers and infrastructure are international, so personal data may be transferred outside the UK and the European Economic Area.

Where we transfer personal data out of the UK or EEA we rely on the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with a transfer risk assessment and any additional technical measures it identifies. A copy of the relevant mechanism is available on request.

Suppression entries are kept indefinitely on purpose. Deleting the record of a removal request is exactly what causes someone to be re-added the next time a source is refreshed. A suppression entry holds the minimum needed to recognise and exclude a record, and nothing else.

When a retention period ends, data is securely deleted or irreversibly anonymised.

No system is perfectly secure and we do not claim otherwise. We do not currently hold a SOC 2 or ISO 27001 certification, and we do not display badges implying that we do.

Depending on where you live you have some or all of the following rights. We honour all of them for everyone regardless of location, because running one process is simpler than running three.

The fastest route is the suppression form linked at the foot of this page. It requires no account, and we will never make you create one to exercise a right — that friction is exactly what these rules exist to prevent.

We acknowledge every request within 10 days and complete it within 45 days. If a request is genuinely complex we may extend once by a further 45 days and will tell you before the first period ends. We do not charge for this and we will not treat you differently for asking.

An authorised agent may submit on your behalf. We will ask for proof of authorisation before acting.

When you ask to be removed we suppress the record so it is excluded from everything we deliver in future, and we notify customers who received the affected record that they must remove it. Our Terms and Acceptable Use Policy require them to do so.

We cannot reach into a third party's systems and delete data for them, and any vendor claiming they can is overpromising. If a company keeps contacting you after you have asked us to suppress your record, tell us and we will follow it up with them directly.

Licensing personal information about people with whom we have no direct relationship is capable of making us a data broker under California, Texas, Oregon and Vermont law, each of which carries its own registration and request-handling obligations.

We assess our position in each of those jurisdictions and register where required. We will confirm our current registration status on request, and we process deletion requests routed through the California Delete Request and Opt-out Platform within the timescales that regime requires.

If you are unhappy with how we have handled your personal data, contact us first at privacy@b2bforge.co and we will try to resolve it.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. In the EEA it is the authority where you live. In the United States you may contact your state Attorney General.

We may update this policy. The effective and last-updated dates at the top of this page always reflect the current version.

Where a change materially affects how we use personal data we already hold, we will give at least 14 days notice before it takes effect — by email where we have an address for you, and by notice on this page in every case.