Privacy Policy

Retail Spotter Solutions (RSS)
Last updated: 6 April 2026
This Privacy Notice and Cookie Policy explains how Retail Spotter Solutions (“RSS”, “we”, “us”, “our”) collects and uses personal data when you visit our website, contact us, submit an enquiry or onboarding form, or when we carry out merchant introduction and related outreach activity.

1. Who we are
The website and service are operated by The Ministry Group Elevation Ltd, trading as Retail Spotter Solutions (“RSS”).
Registered office: 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE
Company number: 16273971
Registered in: England and Wales
Email: sales@retailspottersolutions.com
For the purposes of UK data protection law, RSS is a controller of personal data processed in connection with our website, our communications, our onboarding activity and our merchant introduction and outreach activity.

2. What this Notice covers
This Notice covers personal data relating to:
website visitors;
people who contact us, including by email, contact form, telephone or onboarding form;
brand contacts, including customers, prospective customers and their representatives;
merchant contacts, including decision-makers and business contacts we approach in connection with merchant introduction, samples, tastings and related follow-up.
Where we obtain personal data from a source other than the individual concerned, we aim to provide privacy information at first contact or otherwise within a reasonable period, and at the latest within one month, unless an exemption applies.

3. Personal data we collect
3.1 Data you provide to us
We may collect:
identity and contact data, such as name, job title, business name, business address, email address and telephone number;
enquiry and correspondence data, including messages you send us and our replies;
onboarding and campaign information you provide, such as product details, target venues, preferred areas, sampling availability and related preferences;
billing and payment data, including invoice records, amounts, due dates, payment status, payment references and related correspondence; and
Where applicable, payment and mandate information required to set up or administer Direct Debit or other payment arrangements.
Please do not provide special category data, such as health information, unless we specifically request it.
3.2 Data we collect when you use the website
We may collect:
technical and usage data, such as IP address, browser type, device information, pages visited and approximate location derived from IP address; and
cookie and similar technology data, as explained in section 14.
3.3 Data we obtain from other sources
We may obtain:
merchant business contact data from publicly available sources, such as business websites, publicly listed contact pages, directories, venue listings and professional listings;
brand contact details from the brand’s organisation or representatives; and
contact information from referrals or introductions.
Personal data includes information relating to an identifiable natural person, including where an individual can be identified indirectly.

4. How we use personal data
We use personal data for the following purposes:
to respond to enquiries and communicate with you;
to operate, administer and improve our website;
to review enquiries, onboarding submissions and potential client suitability;
to onboard brands and administer client relationships;
to carry out merchant introduction and related outreach activity, including contacting merchant decision-makers about product opportunities, samples, tastings and related follow-up;
to issue invoices, collect payments, administer Direct Debit arrangements where used, reconcile payments and conduct credit control;
to keep business, compliance and accounting records;
to maintain suppression lists and opt-out records; and
to establish, exercise or defend legal claims.

5. Lawful bases
We rely on the following lawful bases under UK data protection law, depending on the circumstances:
Legitimate interests: to operate our business, communicate with business contacts, carry out merchant introduction and related outreach, administer relationships, collect payment, maintain records and protect our rights, provided those interests are not overridden by the rights and interests of the individual concerned.
Contract: where processing is necessary to perform a contract with a client, or to take steps at the client’s request before entering into a contract.
Legal obligation: where we must keep records or otherwise comply with legal requirements.
Consent: where consent is required, including for non-essential cookies and certain electronic marketing in cases where PECR requires consent.

6. Direct marketing and B2B outreach
We may contact business contacts, including merchant decision-makers and brand representatives, by telephone, email, text message, social media message or other business contact methods where lawful to do so.
For B2B electronic marketing, the rules differ depending on the type of recipient. Corporate subscribers, such as limited companies and LLPs, are treated differently from sole traders and some partnerships. Sole traders and some partnerships are treated in a similar way to individual subscribers for PECR purposes.
Where we send direct marketing, we will comply with applicable data protection and privacy rules. If you object to direct marketing, we will stop using your personal data for direct marketing purposes and will keep a suppression record so that we can respect your opt-out.

7. Sharing personal data
We may share personal data in the following circumstances:
With brands/clients: we may share merchant contact details, booking information and related communications where this is necessary to release a lead, arrange a sample, confirm a tasting, enable follow-up or otherwise deliver the service;
With merchants: we may share brand identity, relevant product information and brand contact details where needed to arrange or confirm introductions, samples, tastings or related follow-up;
with service providers who support our operations, such as hosting providers, email providers, website providers, form providers, cloud software providers, payment providers and Direct Debit providers;
with professional advisers, such as legal, accounting or compliance advisers, where necessary; and
with authorities or regulators where required by law or where necessary to protect our legal rights.

8. RSS and brands as controllers
RSS and the relevant brand/client will generally act as independent controllers of the personal data each handles in connection with introductions, bookings and follow-up communications. Each party is responsible for complying with applicable data protection, privacy and marketing rules for its own processing.
We do not state that RSS and brands are joint controllers unless that is actually the case for a particular arrangement.

9. International transfers
We aim to keep personal data within the UK. If we use suppliers that process personal data outside the UK, we will ensure appropriate safeguards are in place, such as contractual protections recognised under UK data protection law.

10. Security
We use reasonable technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. No method of transmission over the internet is completely secure.

11. Retention
We keep personal data only for as long as reasonably necessary for the purposes described in this Notice, including the need to keep records for legal, accounting and compliance purposes.
Our usual retention periods are:
enquiry and correspondence records: typically up to 24 months, unless needed longer for an ongoing matter;
client/account/onboarding records: during the relationship and for a reasonable period afterwards;
invoices, payment records and accounting records: typically up to 6 years;
suppression list records: for as long as necessary to respect opt-out requests; and
website technical and cookie data: for the periods explained in our cookie settings or internal retention practices, depending on the type of cookie or log.

12. Your rights
Depending on your circumstances, you may have rights under UK data protection law, including the right to:
access your personal data;
have inaccurate personal data corrected;
have personal data erased in certain circumstances;
restrict processing in certain circumstances;
object to processing in certain circumstances;
object at any time to processing for direct marketing;
receive personal data in a portable format in certain circumstances; and
Withdraw consent where we rely on consent.

13. Contact us and complaints
If you have questions about this Notice or want to exercise your rights, contact us at:
Email: sales@retailspottersolutions.com
Address: 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE
You also have the right to complain to the Information Commissioner’s Office (ICO) if you believe your data protection rights have been infringed.

14. Cookie Policy
Cookies are small text files placed on your device when you visit a website. Similar technologies can also store or access information on your device.
14.1 Types of cookies we may use
We may use the following types of cookies or similar technologies:
strictly necessary cookies, which are needed for the Website to function properly;
functionality cookies, which remember your preferences where used; and
analytics or performance cookies, which help us understand how the Website is used where used.
14.2 Consent for non-essential cookies
We will ask for your consent before placing non-essential cookies or similar technologies on your device. Consent must be given by a clear positive action. Simply continuing to use the Website is not enough. You must also be able to reject non-essential cookies as easily as you can accept them.
14.3 Managing cookies
Where a cookie preferences tool is available on the Website, you can accept or reject non-essential cookies and change your preferences at any time.
You can also manage cookies through your browser settings, although disabling certain cookies may affect how the Website functions.
14.4 Strictly necessary cookies
Some cookies and similar technologies may be used without consent where this is permitted by law, including where they are strictly necessary for a service you have requested or otherwise fall within a recognised exception.