Privacy
Privacy Notice
Last updated: 9 September 2026
Who controls your data
Peter Harrison, trading as Oreval, is the controller for personal data used to operate Oreval. Contact peter@oreval.co.uk for privacy questions, corrections or rights requests.
What we collect and where it comes from
When you request a Revenue Map we collect the company website and operating postcode you submit. If the form asks for and you provide a work email, we also collect that email. We keep relevant report, profile-correction, enquiry and feedback records. Providing an optional email is not a condition of viewing the free report and is not blanket consent to marketing.
We collect public company and business-contact information from company websites, official procurement notices (including Find a Tender and Contracts Finder) and public company registers, including Companies House where available. This can include names, business roles, business email addresses, company identifiers, website evidence and contract/supplier history. We keep source references and qualification notes to check relevance and accuracy.
For customers we keep subscription status, payment-provider identifiers, service access and company-specific pipeline activity. Stripe handles card details; Oreval does not receive full card numbers or card security codes. Hosting and email providers process technical information such as IP addresses, request times and delivery logs when operating the service.
Why we use data and our lawful bases
We use request and service data to produce Revenue Maps, answer enquiries, provide monitoring and administer subscriptions. Where you personally contract with us, this is for steps you request before a contract or to perform that contract. When you act for a company, our basis is our legitimate interest in providing and administering that company's service.
Our legitimate interests also include checking public-source accuracy, matching relevant business opportunities, preventing abuse, maintaining security and measuring whether our service is useful. We weigh those interests against the effects on individuals. We use legal obligation where processing is required for accounting, tax or responding to a legally binding request. Where we rely on consent, it can be withdrawn without affecting earlier lawful processing.
Business outreach and your right to object
You can object to direct marketing at any time. Reply to an email asking us to stop, or email peter@oreval.co.uk. We stop marketing to that contact and retain only the suppression information needed to avoid contacting them again.
Relevant outreach to verified corporate subscribers is considered separately from communications needed to fulfil a requested report or subscription. Where personal business-contact data is used, we assess legitimate interests. We do not treat a public email address as consent, or assume a sole trader or ordinary partnership is eligible for unsolicited email. Where consent or another applicable electronic-marketing permission is required, we must have it before sending. Service messages about an existing subscription are not permission for unrelated marketing.
Report links, cookies and activity
A tracked Revenue Map link can associate a visit, an offer interaction or a checkout event with the relevant business report. This helps us evaluate and operate the service; a recorded visit does not prove who opened or forwarded a link. Report links may be forwarded, so do not use them to share confidential information. Paid pipeline credentials are separate and should not be shared.
Paid access uses an essential authentication cookie. Hosting and payment providers may also use security and service cookies. Oreval's report and outreach templates do not add advertising cookies or email-open tracking pixels. Any future non-essential tracking requiring consent must be explained and consent obtained before it is used.
Service providers and disclosures
Our current service stack uses Vercel for hosting and operational logs, Supabase for database and service records, Stripe for hosted payments and subscription administration, and Zoho Mail for business email and authorised delivery. Access is limited to the data relevant to each function. Payment and other providers may also act as independent controllers for their own legal, fraud-prevention and account purposes. We do not sell personal contact details.
Authorised people and technical service providers assisting with support, development or security may access records as needed for that work. We may disclose information when lawfully required or necessary to establish or defend legal rights.
International processing
Our providers operate internationally, including in the United States; data is not promised to remain exclusively in the UK. International transfers are subject to UK data-protection requirements. Relevant provider terms describe their processing locations and transfer arrangements, which may include adequacy decisions or contractual safeguards. Contact us for information about the arrangement applicable to your data and how to obtain relevant safeguards.
Provider information: Vercel, Supabase, Stripe and Zoho.
How long we keep data
Retention depends on why a record is needed, not an indefinite right to keep it. Report requests and prospect records are assessed against continuing relevance, the last meaningful interaction, unresolved enquiries and any objection. Customer records are needed while the subscription operates and afterwards only to the extent needed for outstanding support, security, disputes or applicable accounting and legal requirements.
Source/audit records are retained where needed to explain and correct intelligence; suppression records may be retained longer to keep an opt-out effective. Records no longer needed should be deleted or anonymised. Backup and provider-log retention follows the relevant provider's retention cycle. We do not claim that all records are automatically erased on a fixed date.
Your rights and complaints
Depending on the data and lawful basis, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. The direct-marketing objection is absolute. We may need proportionate identity verification and will explain any lawful reason a request cannot be met in full. Contact peter@oreval.co.uk.
You may complain to the UK Information Commissioner's Office. Please also tell us about a concern so we can try to resolve it.
Automated analysis and changes
Oreval automatically extracts business evidence and calculates explainable fit scores to support business decisions. These are not decisions about an individual's legal rights or eligibility for credit, employment or insurance. Public evidence can be incomplete or change; you can ask us to correct it. We will update this notice when our practices change and make material changes clear through an appropriate service channel.