Shotton & Black — Privacy Policy

Last updated: 09 June 2026

1. Who we are

Shotton & Black is a commercial intelligence brand operated by Soba Private Label Ltd, the company behind the Soba: Private Label brand. Soba Private Label Ltd is registered in England and Wales under company number 14881359, with its registered office at Office 1 Izabella House, 24–26 Regent Place, Birmingham, England, B1 3NJ. In this policy, "we", "us", and "our" refer to Soba Private Label Ltd.

We are the data controller for the personal data described here. When you give information to Shotton & Black, you are giving it to Soba Private Label Ltd, the same company that operates Soba: Private Label, and it may be held and handled across that wider operation rather than by Shotton & Black alone.

We are registered with the Information Commissioner's Office (ICO) under registration reference ZB707921.

2. What this policy covers

This policy explains the personal data we collect through the Shotton & Black website and through our dealings with the firms we work with, why we hold it, who we share it with, and the rights you have over it. It covers the Shotton & Black brand specifically. Soba: Private Label and its other brands may publish their own policies for the data they collect directly. Where a matter touches more than one brand, it is the same company, and the same standards, throughout.

We process personal data in line with UK data protection law, namely the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

3. The personal data we collect

Most of what we do involves businesses rather than individuals, so the personal data we hold is limited and is almost always business contact information. We collect it in three ways.

When you visit the website. We collect standard technical information through our website host, such as your IP address, device and browser type, and the pages you view. We do not use cookies for analytics or tracking (see section 8).

When you email us or commission a report. The website has no contact form; if you want to reach us, you email us directly. When you do, we collect the details you give us: your name, business email, firm, role, telephone number, and the content of your message and any later correspondence. If you go on to commission work, we also collect the contact and billing information needed to deliver and invoice it.

When we contact you. We approach firms directly about our service. To do that, we hold business contact details for individuals at the accountancy and law firms we believe our work is relevant to: name, role, firm, business email, and sometimes a business telephone number. We obtain these from publicly available and professional sources, such as firm websites, professional directories, and business information providers. You can ask us to stop contacting you at any time, and we will (see sections 4 and 9).

We do not seek or knowingly collect special category data (such as data about health, race, or political views), and the website is not intended for, or directed at, children.

4. How we use your personal data, and our lawful bases

We use personal data only for the purposes below, and we rely on the lawful basis shown for each.

  • Responding to enquiries and preparing reports. To answer your questions, scope and deliver work, and manage the relationship. Basis: performance of a contract, or steps taken at your request before a contract; and our legitimate interests in running the business.

  • Contacting firms about our service. To introduce our work to firms we think it suits. Basis: our legitimate interests in business development, balanced against your interests; and, for marketing emails to corporate subscribers, in line with PECR, with a clear right to object at any time.

  • Running and securing the website. To keep the site working and protect it. Basis: our legitimate interests.

  • Invoicing, record-keeping, and legal compliance. To raise invoices, keep proper records, and meet our legal and regulatory obligations. Basis: legal obligation, and our legitimate interests.

Where we rely on legitimate interests, we have considered your rights and would not use your data in a way that overrides them. You can ask us for more detail on this balancing exercise.

5. Who we share your data with

We do not sell personal data. We share it only as follows.

  • Within the Soba operation. Because Shotton & Black and Soba: Private Label are run by the same company, your data may be handled by the same systems and people across that operation, for the purposes set out above.

  • Service providers acting on our instructions. We use trusted suppliers to run the business, including our website host (Squarespace), our email provider (Google Workspace), our payment processor, and, where relevant, professional advisers such as accountants and lawyers. These suppliers act on our instructions and are bound to keep your data secure and use it only for the services they provide to us.

  • Legal and regulatory disclosures. We may disclose data where the law requires it, to protect our rights, or in connection with a sale or reorganisation of the business.

How report data is handled. When a firm engages us to prepare a report, it gives us the names of the companies involved: its client, and that client's competitors. These are firm names, which are generally not personal data, and they are the only such information that passes through us in the course of the work. We use them only to produce the report, acting on the firm's instructions. To produce reports we use Anthropic as one of our service providers, which processes those firm names on our behalf under Anthropic's Commercial Terms of Service and Data Processing Addendum. You can read those terms at https://www.anthropic.com/legal/commercial-terms.

6. Sending data outside the UK

Our payment processing is handled within the UK.

Some of our other service providers are based outside the UK. Our website host (Squarespace) and our email provider (Google Workspace) are United States companies that handle the technical and enquiry information described in section 3. The AI provider we use to produce reports (Anthropic) receives firm names only. Where personal data is transferred outside the UK, we rely on the safeguards these providers put in place, principally the UK International Data Transfer Addendum to the EU Standard Contractual Clauses and, where a provider is certified, the UK Extension to the EU–US Data Privacy Framework.

7. How long we keep it

We keep personal data only for as long as we need it for the purposes above, then delete or anonymise it.

  • Enquiries that do not become work: up to 24 months.

  • Records relating to clients and engagements, including invoices: kept for the duration of the relationship and for 6 years afterwards, in line with our legal and tax obligations.

  • Outreach contact details: kept while the contact remains relevant, and removed promptly on request.

8. Cookies

Shotton & Black does not use cookies or similar technologies for analytics, advertising, or tracking. The site may set a small number of strictly necessary cookies that are required for it to function; under PECR, these do not require your consent. Because we set no non-essential cookies, we do not ask you to accept a cookie banner.

9. Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal data we hold about you;

  • ask us to correct data that is inaccurate or incomplete;

  • ask us to delete your data in certain circumstances;

  • ask us to restrict or object to how we use it, including objecting to direct marketing or to processing based on legitimate interests;

  • ask us to transfer your data to you or another provider where that right applies; and

  • withdraw consent at any time, where we rely on it.

To exercise any of these, contact us using the details in section 12. We will respond within one month. There is normally no charge, and we may ask you to confirm your identity first.

10. Complaints

If you have a concern about how we handle your data, please raise it with us first and we will try to put it right. You also have the right to complain to the ICO, the UK's data protection regulator, at ico.org.uk, or by post to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

11. Changes to this policy

We may update this policy from time to time. The version in force is the one published here, and the date at the top shows when it last changed. Where a change is significant, we will take reasonable steps to make it clear.

12. Contact us

For anything to do with this policy or your data, contact:

Admin Shotton & Black, a Soba: Private Label brand Office 1 Izabella House, 24–26 Regent Place, Birmingham, England, B1 3NJ Admin@sobaprivatelabel.com