Privacy Policy.

Who we are

We operate the CompanyProspect service, which provides curated business data sourced from publicly available registries and directories.

We are the data controller responsible for your personal data within the meaning of Art. 4(7) GDPR and Art. 4 LOPDGDD (Spanish data protection law). The company CEO serves as the privacy contact for all enquiries. We have not appointed a Data Protection Officer (DPO), as one is not mandatory under Art. 37 GDPR for an organization of our size.

Privacy contact

Data we collect and how we source it

Terminology clarifications. “Personal data” is any information that identifies a person — a name, an email address or a phone number. Business contact details, including a work email or job title, are personal data under Art. 4(1) GDPR even when they relate to someone’s job rather than their private life. If you are in the US, your state law may call this “personal information” — see §13.

2.1 Data about our customers

2.2 Data about website visitors

2.3 Business contact data in our B2B database

CompanyProspect aggregates and enriches information about small and medium-sized enterprises exclusively from publicly available sources and licensed commercial APIs, including:

• Official company registries — including US Secretary of State filings across 50 states, BORME / Registro Mercantil in Spain, INSEE in France, Receita Federal CNPJ open data in Brazil, Servicio de Impuestos Internos in Chile and SUNARP in Peru. Registry information may include publicly available names of business owners, directors, shareholders or agents involved in a company filing.
• Public business directories and websites — including Google Maps / Google Business Profile accessed via licensed commercial APIs, plus information disclosed by companies on their websites and social profiles. This may include corporate contact details and names and roles of employees.
• Email discovery and verification providers — independent third-party providers specializing in corporate email pattern discovery and deliverability verification, established in the EU/EEA or United Kingdom and contractually authorized to permit our use of their outputs. Provider identities are available on request at privacy@companyprospect.com.

Collected vs. generated email addresses. Some corporate-domain email addresses are collected because the business published them on its website, Google Business Profile or official registry filing. Others are generated by applying a known organizational email pattern — for example, firstname.lastname@company.com — to a registry-sourced personal name and then validating deliverability. Generated addresses receive a confidence score and are included only when they meet a minimum quality threshold. We disclose the source category to customers, who are contractually required to include the source disclosure in their first outreach; see §5.

Data elements may include company name, registration number, registered address, incorporation date, sector or activity codes, owner or director name, publicly listed or pattern-matched business email, publicly listed business phone number and business location.

What we do not do

• We do not purchase bulk personal-data lists from consumer-facing data brokers. Commercial inputs are limited to official registry data, licensed APIs aggregating publicly listed business-directory data, public company profiles and websites, and professional email discovery and verification services with resell permission.
• We do not scrape private or login-protected accounts.
• We do not collect data about individuals acting in a purely personal or consumer capacity.
• We do not collect sensitive personal data listed in Art. 9(1) GDPR, such as health, religion, political opinions, ethnicity, sexual orientation, trade union membership, biometric or genetic data.
• We do not collect or process data of children under 16.
• We do not pattern-match or generate addresses on free consumer email providers such as Gmail, Yahoo, Hotmail or Outlook.com. If a business publicly lists a free-provider address as its business contact, we may include it as a collected business contact. We do not enrich purely personal addresses unrelated to a business.
• We do not make decisions based solely on automated processing that produce legal or similarly significant effects under Art. 22 GDPR. Automated quality filters determine whether a corporate-domain email is included, but do not produce legal or similarly significant effects on the individual.

Legal bases for processing

3.1 For customers

3.2 For business contacts in our database

We process publicly available business contact data under legitimate interest, or its local-law equivalent, as recognized in each jurisdiction where we operate:

A Legitimate Interest Assessment (LIA) concluded that our processing is proportionate because:

• The data comes from official public registries or was published by data subjects in a professional or business context.
• We process only business contact data, not private or consumer data.
• The processing serves the legitimate commercial purpose of enabling B2B engagement, recognized as a lawful interest under Recital 47 GDPR.
• Data subjects may object at any time, and we honor objections promptly through our suppression list; see §9.

A summary of our LIA is available on request at privacy@companyprospect.com. The full assessment is available to supervisory authorities on request.

3.3 For website visitors

How we use your data

For customers

• Provide, maintain and improve CompanyProspect.
• Process payments and manage subscriptions.
• Communicate about accounts, product updates or our services.
• Provide customer support.

For business contacts

• Compile and maintain an accurate B2B prospect database.
• Deliver contact data to customers for lawful B2B purposes.
• Verify and refresh accuracy through periodic checks against public sources.

For everyone

• Comply with legal obligations.
• Protect against fraud, abuse and security threats.

Data sharing and controller relationships

Business contact data is personal data. We disclose personal data only to the recipient categories below, for the stated purposes and under the stated safeguards:

“Sale” of personal data — clarification

Under GDPR and equivalent EU and LATAM laws, providing business contact data to customers is a controller-to-controller disclosure based on Art. 6(1)(f) GDPR and the local equivalents listed in §3.2. GDPR does not use the concept of “sale”; the relevant questions are whether a valid legal basis applies and whether data-subject rights are preserved.

Under certain US state privacy laws, notably CCPA/CPRA in California and analogous statutes elsewhere, providing personal information to a third party for monetary or other valuable consideration may meet the statutory definition of a “sale” or “sharing”. To be clear:

• We do not sell personal data to data brokers for advertising or consumer profiling, and do not engage in cross-context behavioral advertising.
• We do license business contact data to B2B customers as our core commercial offering. Under certain US state-law definitions, this may constitute a “sale” or “sharing”.

US residents may opt out at any time; see §13.

Controller-to-controller transfer

When a customer accesses business contact data through CompanyProspect, Nummary Analytics and the customer act as independent data controllers. Each is independently responsible for its compliance. Our customers agree through our Terms of Service and a separate Data Sharing Agreement to:

• Use data only for lawful B2B purposes.
• Respect data-subject rights, including opt-out and rectification requests.
• Include in the first commercial communication a disclosure identifying the source of the contact information and the right to opt out under Art. 14 GDPR or its equivalent.
• Apply our suppression list within five business days of receipt; see §9.

Downstream notification and suppression-list cadence

When a business contact exercises the right to erasure or objection, we remove the contact from our database, add the contact to a permanent suppression list and include the contact in the next monthly suppression-list update sent to customers who purchased data during the previous 24 months. Customers are contractually required to apply the update within five business days.

International transfers

We are based in Spain and primarily store data within the EEA. Certain processing may involve transfers outside the EEA, including cloud hosting using US-region infrastructure, email verification providers in the EU/EEA and United Kingdom, and delivery of B2B contact data to customers outside the EEA, currently including Brazil, Peru, Chile and the US.

Where data is transferred outside the EEA, we ensure adequate protection through:

• EU adequacy decisions where available, including the UK adequacy decision and the EU-US Data Privacy Framework for certified recipients.
• Standard Contractual Clauses approved by the European Commission under Art. 46(2)(c) GDPR, and corresponding safeguards under applicable LATAM law.
• Supplementary measures consistent with EDPB Recommendation 01/2020, including encryption, access controls and transfer-impact assessments where applicable.
• For controller-to-controller transfers to customers outside the EEA, a Data Sharing Agreement incorporating the relevant SCCs into the customer contract.

A copy of applicable SCCs or an executed transfer agreement is available on request at privacy@companyprospect.com.

Data retention

When data is no longer needed, it is securely deleted or irreversibly anonymized.

Your rights

Under GDPR and applicable data-protection laws, you may have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase data, subject to legal retention obligations.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds.
• Data portability in a structured, machine-readable format.
• Withdraw consent at any time where processing is consent-based, without affecting prior lawful processing.

For business contacts in our database

• Object or opt out: Request removal at any time. We process requests within 30 days and add the contact to our permanent suppression list to prevent re-collection.
• Access and rectify: Request a copy of the data we hold or correction of inaccuracies.
• Source disclosure under Art. 14(2)(f) GDPR: Ask us to identify the specific public source and whether an email was collected from a public listing or generated by pattern matching.
• Downstream notification: Ask us to notify customers of an erasure or correction. We make reasonable efforts through our monthly suppression-list update.

How to exercise your rights

We respond to requests within 30 days. If a request is complex or multiple requests are made, we may extend by up to a further 60 days and will notify you within the initial period under Art. 12(3) GDPR.

You may lodge a complaint with your local supervisory authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD) — aepd.es. Other authorities include France’s CNIL, Brazil’s ANPD, Peru’s ANPDP, Chile’s APDP or your local DPA.

Suppression list

We maintain a suppression list containing the minimum data necessary — typically a name or a hash of the email address — to ensure that people who opt out remain excluded from our database. The list is used solely for opt-out enforcement and is not shared with customers.

Cookies and tracking

Our website uses:

• Strictly necessary storage required to remember privacy preferences, which does not require consent.
• Plausible Analytics and Ahrefs Web Analytics for cookieless, aggregate traffic measurement without persistent identifiers.
• Google Analytics 4 with Advanced Consent Mode for website and campaign measurement. Google receives limited signals without cookies when storage is denied; these can include page URLs, referrers and consent state.

In Europe, including the EEA, United Kingdom and Switzerland, optional cookies and advertising data use require your choice before they are enabled. Outside Europe, measurement is enabled by default unless your saved preferences or Global Privacy Control restrict it. An unknown region uses the European defaults. Campaign measurement supports Google Ads attribution for visits and sample-page arrivals. Ad personalization and remarketing remain disabled. You can change your choices through Cookie preferences in the footer. More detail appears in our Cookie Policy.

Security

We implement appropriate technical and organizational measures, including:

• Encryption in transit using TLS 1.2 or later and encryption at rest.
• Role-based access controls and least-privilege principles.
• Regular security reviews and vulnerability assessments.
• Incident-response procedures, including breach notification within 72 hours as required by Art. 33 GDPR and notification to affected individuals without undue delay where Art. 34 GDPR applies.

No method of electronic transmission or storage is completely secure. While we work to protect data, we cannot guarantee absolute security.

Children

Our service is directed at businesses and business professionals, not minors. We do not knowingly collect data from people under 16. Under Spanish Art. 8 LOPDGDD, the digital-consent age is 14. If we learn that we collected data from a child, we will delete it promptly.

USA state privacy rights

If you reside in a US state with comprehensive privacy legislation — including California, Connecticut, Colorado, Delaware, Indiana, Iowa, Minnesota, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas or Virginia — you may have additional rights, including:

• Right to know what personal information we collect and how it is used.
• Right to delete your personal information.
• Right to non-discrimination for exercising privacy rights.
• Right to opt out of the “sale” or “sharing” of personal information. Provision of B2B contact data may constitute a sale under certain state definitions. You may opt out at companyprospect.com/optout.

We honor Global Privacy Control signals as valid opt-out requests where required. Contact privacy@companyprospect.com or use our opt-out page to exercise your rights.

We do not collect “sensitive personal information” as defined by California Civil Code §1798.140(ae).

CompanyProspect is registered in the California Data Broker Registry maintained by the California Privacy Protection Agency (CPPA).

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or a prominent website notice at least 30 days before taking effect. The “Last updated” date reflects the most recent revision.

For business contacts we cannot reach by email, material changes will be reflected on this page. People who requested erasure or opted out will not be re-contacted.

Changelog

Versioned history of revisions to this Privacy Policy. Older versions are retained for audit purposes and are available on request at privacy@companyprospect.com.