Governance / 2026.1-UK-PECR

UK PECR & GDPR governance

TURNMILL365 LTD · Draft for director and legal review. Not a certification or legal opinion.

01 / Corporate B2B marketing

PECR’s prior-consent rule for electronic mail generally does not apply to corporate subscribers such as limited companies and LLPs. Subscriber type must be checked: sole traders and some partnerships are individual subscribers and generally require consent or all applicable soft opt-in conditions. A previous enquiry alone is not blanket permission. Marketing must identify the sender and provide a valid, simple opt-out. Objections must be honoured through a suppression list.

02 / Personal data and lawful basis

Named business contacts and identifiable email addresses can be personal data. Processing requires an appropriate documented lawful basis, clear privacy information, data minimisation and appropriate security. Where legitimate interests is used, a purpose, necessity and balancing assessment is required. Individuals have an absolute right to object to processing for direct marketing. A corporate domain does not prove legal compliance.

03 / Engineering data and retention

The optimizer is a local simulation. Selected STEP files are not read, parsed or uploaded; only their names and sizes are held in page memory. The rendered part is sample geometry. PDF drawings, quote specifications and messages submitted through account workflows are stored for those workflows and are not automatically purged after analysis. A confirmed retention schedule and deletion procedure must be approved before this draft is adopted; no zero-retention commitment is made.

04 / Agent transparency and commitments

The agent surface publishes downloadable demonstration schemas and deterministic illustrative prices. Explorer tools run locally, not through a hosted MCP transport. Quotes are non-binding and do not place orders. The corporate-domain tool returns a review checklist, not a verified subscriber or compliance verdict. Optimizer metrics are simulated and cannot authorize manufacture or replace engineering validation.

05 / Privacy requests and questions