[BNM] data protection Q

[Joe Aliferis]

I have a tricky one....

We operate an online Newsletter Manager app
Part of it lets clients import their tables of recipients and create 
mailing lists
Once installed and configured, app is fully managed by client ongoing.
RECIPIENTS
MAILING LISTS
ARTICLES
NEWSLETTER
MAILSHOTS

App is running on a Rackspace server (UK data centre)

A client about to signup has queried an issue of data protection 
regarding the client data they are about to hand over for import in the 
database running on the Rackspace server.

The user data is composed of Name | Email address pairs

They are worried about potential to copy/sell their recipient data 
because it is not stored/managed in-house, as it were.

I need to reassure them and, although I can do that on a company to 
company level, I know very little about legal positions and would like 
to understand a little more.

It seems to me that the default position would be that any data that 
forms part of product supplied by us, that they import into a database 
running on our server, belongs to them and we would have no right to 
copy or sell that data to any other parties.

Can anyone shed light?

Appreciated

joe