how we collect · country by country

Collection rules

The rules our crawler and our data follow, and the legal basis for each kind of data in every country we cover.

Crawling rules

robots.txt

Always honoured

SyntoraDataBot rules first, then *; no answer = no crawl

≥ 5 s

Between requests to one site

or the site's Crawl-delay, honoured in full

Pages per site at most

company pages, two links deep

1 IP

Fixed, identified, no proxies

reverse DNS crawler.syntoradata.com

Public pages only. No logins, paywalls, forms or CAPTCHAs, and no attempt to get around any access control.
The company's own website only. Only companies we know from official registers, global identifier sets or licensed company datasets, anywhere in the world; never social networks, search engines, directories or other third-party sites, and no government or university sites.
Finding the website. To link a registered company to its website we may try a few likely domains based on its name. On each we read robots.txt first, then at most the homepage and one legal or contact page; a site that is not that company's is not visited again.
No answer, no crawl. If a site's robots.txt returns a server error, asks us to slow down (429) or does not answer, we do not crawl it until it does. A missing robots.txt (404) means the site sets no rules.
Back off on trouble. HTTP 429, 5xx or timeouts slow us down; five in a row pause the site for 7 days.
Honest identity. One User-Agent that links to our crawler page, one fixed IP, and a live status page.
Opt-out any time. A robots.txt rule or an e-mail stops the crawler for that site.

Data rules

Provenance on every fact: the page it came from and when we first and last saw it.
Facts, not copies: we store specific facts (a phone number, a VAT id), not the site's content for reuse. Copies of the pages we read are kept internally for at most 180 days, only to prove where a fact came from.
Licensed data: company-level fields only; no personal data is taken from bought datasets, and each field is used only as its licence allows.
Minimisation: no personal webmail, no personal phones, photos, dates of birth, home addresses or special-category data. See people data points.
Precision over volume: websites are linked to companies only with proof (company number or name + registered postcode); names are attached to e-mails only when they match.
Retention: work contacts are deleted 365 days after we last see them, or after two visits that no longer show them; nothing is kept "just in case".
Erasure and suppression: on request we delete the contact and any archived page that contains it, and keep only a one-way fingerprint (hash) of the address so it is never collected again. A hash of a known address can be matched, so we protect it as personal data too.
Security: servers in Germany (EU) on encrypted disks; databases are not reachable from the internet.

Legal basis

Kind of data	Basis	What that means
Company register data	Open data licence	Each register publishes its data under an open licence that allows reuse, including commercial reuse, with the attribution listed on sources & licences.
Company facts from websites	Published by the company	Switchboards, general inboxes, addresses and VAT ids that a company publishes so that others can contact it. Usually company information; where a number or inbox belongs to a sole trader or one named person, we treat it as personal data under the same rules, including removal on request.
Professional contacts	Legitimate interests, GDPR Art. 6(1)(f)	Not a blanket permission: a documented balancing test between our customers' B2B interest and the person's rights, with minimisation, a public notice (Art. 14), easy objection and removal, and no serving until the review is done.

Country by country

Where we collect, and the rules that apply
Country	Register data	Personal data law · regulator	E-mail marketing (for customers)
United Kingdom	Companies House · OGL v3	UK GDPR + Data Protection Act 2018 · ICO	PECR: e-mail to corporate subscribers is allowed without prior consent if the sender is identified and an opt-out is offered; sole traders and partnerships need consent.
France	INSEE Sirene, Annuaire des Entreprises · Licence Ouverte 2.0	GDPR + Loi Informatique et Libertés · CNIL	CNIL: B2B e-mail prospecting without prior consent is allowed when the message relates to the recipient's profession, with clear information and an opt-out.
Ireland	CRO · CC BY 4.0	GDPR + Data Protection Act 2018 · DPC	ePrivacy Regulations (S.I. 336/2011) apply; check them before e-mailing people.
Norway	Brønnøysundregistrene · NLOD 2.0 (personal data excluded)	GDPR via the EEA + personopplysningsloven · Datatilsynet	Markedsføringsloven applies to electronic marketing; check it before e-mailing people.
Sweden	Bolagsverket · open data	GDPR + dataskyddslagen (2018:218) · IMY	Marknadsföringslagen applies to electronic marketing; check it before e-mailing people.
Finland	PRH / YTJ · CC BY 4.0	GDPR + tietosuojalaki (1050/2018) · Tietosuojavaltuutetun toimisto	The Act on Electronic Communications Services (917/2014) applies; check it before e-mailing people.
Latvia	Uzņēmumu reģistrs · CC0	GDPR + Personal Data Processing Law · Datu valsts inspekcija	The Law on Information Society Services applies; check it before e-mailing people.
Everywhere else	GLEIF (LEI) and Wikidata · CC0; licensed company datasets	The data-protection law of the country; GDPR / UK GDPR whenever the people concerned are in the EU or UK	Local rules apply, e.g. CAN-SPAM in the US (identify yourself, honour opt-outs within 10 business days) and CASL in Canada (consent first); check them before e-mailing people.

Everyone in these countries can complain to their data protection regulator named above.

Rules for our customers

Use the data for lawful B2B purposes only, never to profile people's private lives.
Follow the e-mail marketing rules of the recipient's country (see the table): identify yourself, offer an opt-out, and honour it.
Pass objections back to us so the address is suppressed everywhere.

This page explains how we apply these rules. It is not legal advice.