Legal
Privacy Policy
Last updated 22 September 2026
This policy explains what AceLeads does with personal data, in plain English. It covers everyone: people who contact us through this site, people who use the partner portal, and people whose enquiry reached us through one of the brands we work with.
1. Who we are
AceLeads is a trading name of HDCH Limited, a company registered in England and Wales under number 16237398. Our registered office address is on our terms of use page.
We are the data controller for the personal data described in this policy, and we are registered with the Information Commissioner's Office as a data controller. To ask us anything about your data, email [email protected] and put "data protection" in the subject line.
2. What we collect
If you contact us through this site
Your name, work email, phone number, company name and website, and whatever you write in the message. On the get started form we also record the industries you want leads in and your budget band. This comes from the get started, services enquiry, affiliate application and feedback forms.
If you have a portal login
Your name and email address, the account you belong to, your role on it, when you accepted the data and confidentiality agreement, and a record of the leads assigned to you and what you did with them. Passwords are stored by our authentication provider as hashes and we cannot read them.
If you enquired through one of our brands
Your name, email, phone number, postcode and the details of your enquiry, together with the record of the consent you gave when you submitted it. We did not collect this from you directly. It came from the brand you enquired through, which is named in the section below.
Automatically, when you browse
Your IP address, browser and device type, the pages you look at and the site you arrived from. Cloudflare also processes your IP address to protect our forms from automated abuse.
We do not ask for special category data, such as health or ethnicity, and you should not send it to us. We do not knowingly collect data about children.
3. Where your data came from, if not from you
If you enquired on Fast Track Leasing, Performance & Prestige, or UK Housing Claims, that enquiry may have been passed to us. Those brands sit in the same group as AceLeads, and the consent you gave at the point of enquiry is what allows us to introduce you to a supplier. We keep that consent record. If you want to see it, ask us and we will send it to you.
4. Why we are allowed to use it
Under UK GDPR we need a lawful basis for everything we do with your data. Ours are:
Legitimate interests
Responding to a business enquiry, running the marketplace, passing a lead to the partner best placed to help, keeping our site secure and preventing fraud. We have considered your interests and think you would reasonably expect each of these.
Consent
Non-essential cookies, live chat, and marketing email you have opted into. You can withdraw consent at any time and it is as easy to withdraw as it was to give.
Contract
Running a portal account and providing the service the account is for.
Legal obligation
Keeping accounting and tax records, and responding to lawful requests.
5. Who we share it with
The partner who receives your lead
If you enquired about a product or service, we pass your details to one partner business so they can contact you about that enquiry. They become responsible for your data in their own right, and they are contractually limited to contacting you about the thing you enquired about. Ask us and we will tell you exactly who received your details.
Our suppliers
The companies listed in the next section, who process data on our instructions so that the site, the database and our email actually work.
Professional advisers and authorities
Our accountants and advisers, and any authority we are legally required to disclose to.
We do not sell your personal data, and we do not share it with anyone for their own marketing.
6. The suppliers who process it for us
- Cloudflare. Hosting, site security and form spam protection (Turnstile).
- Supabase. The database holding accounts, leads and lead contact details.
- Airtable. Our internal CRM, which mirrors enquiries so the team can work them.
- Brevo. Sending our transactional and notification email, and holding marketing contacts.
- Google. Tag Manager and Analytics, which only run after you accept cookies.
- Microsoft. Business file storage, where our invoices and partner records are filed.
Each is contractually required to act only on our instructions and to keep the data secure. Some are based outside the UK. Where data is transferred abroad we rely either on UK adequacy regulations or on the UK Addendum to the Standard Contractual Clauses, so that your data keeps essentially the same protection it has here.
7. How long we keep it
- Enquiries and lead contact details: 24 months from the date of the enquiry, unless you ask us to erase them sooner.
- Portal accounts: For as long as the account is open, then 12 months after it closes.
- Accounting records, including invoices: Six years from the end of the relevant financial year. This is a statutory minimum and we cannot shorten it.
- Complaints and feedback: Three years, so we can show how a complaint was handled.
- Marketing contacts: Until you unsubscribe, and then a minimal record so that we do not contact you again by mistake.
8. Keeping it safe
Access to lead data is restricted to the account it belongs to, enforced in the database itself rather than only in the interface, so one partner cannot see the leads of another. Everything travels over an encrypted connection, portal access needs a named login, and passwords are stored as hashes we cannot read. If there is ever a breach that puts your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.
9. Cookies
Essential
A record of the cookie choice you made, and the session that keeps you signed in to the portal. These are always on, because the site cannot work without them, and they do not need your consent.
Analytics and advertising
Google Tag Manager and Google Analytics, used to understand which pages are useful. These stay switched off until you press Accept.
Live chat
If we have live chat running, it loads only after you press Accept.
To change your mind after choosing, clear the stored site data in your browser settings and the banner will appear again on your next visit.
10. Your rights
You can:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct anything inaccurate or incomplete.
- Ask us to erase it, where we have no overriding reason to keep it.
- Ask us to restrict how we use it while a concern is being sorted out.
- Object to us using it on the basis of legitimate interests.
- Ask us to transfer it to you or to someone else in a portable format.
- Withdraw consent at any time, where consent is what we relied on.
- Tell us to stop sending you marketing, which we will action without asking why.
Email [email protected] and we will respond within one month. It is free. We may ask you to confirm who you are first, so that we do not hand your data to somebody else.
11. Automated decisions
We match enquiries to partners automatically, using the industry, location and budget on the enquiry. It decides which supplier contacts you, not whether you are offered anything, and a person can review it. Tell us if you want that.
12. Complaining
Come to us first if you can, at [email protected], and we will work through it with you. Our complaints procedure sets out the timescales.
You do not have to come to us first, though. You can complain to the Information Commissioner's Office at any time, at ico.org.uk or on 0303 123 1113.
13. Changes
If we change this policy we will update the date at the top. If a change matters to you, we will tell you directly rather than rely on you noticing.