Under data protection law, you are considered to be trading if you're using personal information for commercial reasons, even if you're an individual and not part of an organisation.