Privacy Notice

Last updated: 1 June 2026

1. Who we are

This privacy notice explains how Propensify Limited (“Propensify”, “we”, “us”, “our”) collects and uses personal data, and your rights in relation to that data.

• Company: Propensify Limited
• Registered in England & Wales, company number: 13123730
• Registered office: c/o Lelliott & Co, Heath Place, Ash Grove, Bognor Regis, PO22 9SL, United Kingdom
• ICO registration number: registration pending
• Data protection contact: privacy@propensify.io

We are the data controller for the personal data described in this notice. We do not have a statutory obligation to appoint a Data Protection Officer, but you can raise any data protection question with us at the contact address above.

2. What this notice covers

We process personal data in two main contexts, and this notice covers both:

1. Business prospect and contact data that we source, enrich and provide to our business customers for the purpose of business-to-business (B2B) outreach; and
2. Website visitor data, including information you give us through our contact form, and information collected automatically through cookies, analytics and server logs.

Our prospecting activities are global in scope. Depending on where you are located, your data may be protected by the UK GDPR, the EU GDPR, or equivalent data protection laws, and this notice is intended to meet those requirements.

3. The personal data we process

3.1 Business prospect and contact data

We process limited business-context personal data about individuals in their professional capacity. For a given business contact, this may include:

• name
• job title / role
• seniority and department
• business email address (where available)
• professional profile URL, such as a LinkedIn profile (where available)
• business location (where available)
• current company
• previous company and role history (where relevant and available)
• company domain
• company-level information, such as industry, size, location and related company metadata

We do not intend to collect personal email addresses or personal telephone numbers. If we ever process telephone numbers, these will be business contact numbers only, and we will update this notice accordingly. We do not process any “special category” data (such as health, racial or ethnic origin, religious beliefs) or criminal offence data.

3.2 Website visitor data

When you visit our website or get in touch through it, we may process:

• information you submit through our contact form (such as your name, email address, company and message);
• cookies and analytics data about how you use our website (where you have consented to non-essential cookies); and
• server logs and technical data, such as IP address, browser type and pages visited, collected automatically for security and to operate the website.

4. Where we get business prospect data from

Most of the business contact data we process is not collected directly from the individual concerned. Under the UK and EU GDPR you have the right to know where it came from.

We obtain business prospect data from:

• third-party B2B data and enrichment providers; and
• publicly available professional and business sources, which can include public company websites, professional profile pages, business directories, company registries and other publicly available business datasets.

Where professional profile URLs (such as LinkedIn) are included, these are provided to us as part of third-party B2B enrichment datasets; we do not manually scrape individual social or professional profiles ourselves.

We maintain an internal record of the specific providers we use, which is available to data subjects, customers and regulators on request.

5. How we use personal data, and our lawful basis

5.1 Business prospect data

We use business prospect data to identify organisations and roles that are a genuine fit for our customers’ products or services, to enrich and verify business contact details, and to provide this data to our business customers so they can carry out relevant B2B outreach.

Our lawful basis for this processing is legitimate interests (Article 6(1)(f) UK/EU GDPR) — specifically our and our customers’ legitimate interest in carrying out proportionate, relevant business-to-business marketing. We have carried out a Legitimate Interests Assessment balancing this against the rights and interests of the individuals concerned. In practice this means:

• we only process business-context data about people in their professional roles;
• we only target individuals whose role is genuinely relevant to the offer being made;
• we keep the data we hold to a minimum; and
• we make it easy to object and stop being contacted at any time (see section 9).

We rely on legitimate interests for marketing to corporate subscribers (such as limited companies and limited liability partnerships). We do not rely on legitimate interests to send marketing email to individuals such as sole traders and ordinary consumers.

5.2 Email verification

To improve accuracy and reduce undeliverable messages, business email addresses may be checked using validation signals provided by our data sources and, before any outbound email, run through an independent email verification provider. This checks technical deliverability signals such as syntax, domain/MX records, SMTP response, and whether an address is disposable, role-based, catch-all or invalid.

5.3 Website visitors

• Contact form submissions are processed to respond to your enquiry, on the basis of our legitimate interest in answering messages sent to us (or to take steps at your request).
• Non-essential cookies and analytics are used only where you have given consent through our cookie banner.
• Essential cookies and server logs are processed on the basis of our legitimate interest in operating and securing the website.

6. Who we share personal data with

We may share personal data with:

• Our business customers, who receive business prospect data from us to carry out their own outreach. When a customer uses this data, they act as an independent data controller and are responsible for their own use of it, including providing their own transparency information and honouring opt-outs in their communications.
• Service providers acting on our behalf (processors), including: cloud hosting and infrastructure providers; email verification providers; website and analytics providers; and our email/communications provider. These providers act on our instructions under written data processing terms.

We do not sell personal data for any purpose other than the B2B data provision described in this notice, and we do not share it for unrelated third-party marketing.

7. International transfers

We operate globally, and some of our service providers are located outside the UK and the European Economic Area (EEA), including in the United States (for example, our hosting and infrastructure provider).

Where we transfer personal data outside the UK or EEA, we put in place appropriate safeguards as required by the UK and EU GDPR — such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses — or rely on an adequacy decision where one applies. You can request more information about these safeguards using the contact details in section 1.

8. How long we keep personal data

• Business prospect and contact data: retained for a maximum of 3 years from the last meaningful interaction, after which it is deleted or anonymised — unless we need to retain limited information for legal, compliance, suppression or opt-out purposes.
• Suppression / opt-out records: retained for longer where necessary, so that we can make sure we do not contact you again after you have asked us not to.
• Website contact enquiries: retained for as long as needed to deal with your enquiry and for a reasonable period afterwards.

9. Your rights and how to opt out

Depending on your location and the applicable law, you have rights over your personal data, including the right to:

• be informed about how we use your data (this notice);
• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data (“right to be forgotten”);
• restrict or object to our processing;
• data portability, where applicable; and
• withdraw consent (for example, to cookies) at any time.

You have the right to object to direct marketing at any time. If you object, we will stop processing your data for that purpose. To opt out, object, or exercise any of your rights, simply email privacy@propensify.io. We will action opt-out requests promptly and add you to our suppression list so you are not contacted again.

We aim to respond to requests within one month, and we will acknowledge any data protection complaint you send us within 30 days.

10. Cookies

Our website uses cookies and similar technologies. Essential cookies are needed for the site to work. Non-essential cookies (such as analytics) are only used where you have consented through our cookie banner, and you can change your preferences at any time.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first at privacy@propensify.io so we can try to resolve it.

You also have the right to complain to a data protection regulator. In the UK this is the Information Commissioner’s Office (ICO) — ico.org.uk. If you are in the EU/EEA, you may complain to the supervisory authority in your country.

12. Changes to this notice

We may update this notice from time to time. The current version and its date are shown at the top of this page.