Prospect Privacy Notice
This notice is for people who are not Warmerly customers, but whose business contact details appear in the database that powers our lead finder and email finder. Data protection law requires us to tell you this even though you never gave us your details directly (Article 14, UK and EU GDPR). If you are a customer, our Privacy Policy is the one that applies to you. If you are a resident of California or another US state with a comprehensive privacy law, see also our US State Privacy Notice.
Controller: Kristiyan Tsvetanov, trading as Warmerly, 318 Shady Lane, Birmingham, B44 9EB, England, United Kingdom. Contact: privacy@warmerly.com.
1. What we hold
Our database is organised around businesses, not individuals. For a given company domain we may hold:
- the company name, website, description, industry, approximate size, and country;
- publicly listed role-based email addresses such as info@, hello@, or contact@;
- the company's public LinkedIn and social profile URLs;
- technical facts about the domain's email setup — whether it has mail records, its SPF and DMARC configuration — which is what our deliverability tooling actually uses.
Separately, our email finder can be asked by a customer to work out the likely email address of a named individual at a given company. Where that happens we hold that person's first and last name, the company domain, the address or addresses produced, and a confidence score.
We do not hold home addresses, personal (non-work) email addresses, phone numbers, special category data, or criminal offence data.
2. Where it came from
- Public company websites. Our crawler reads publicly accessible pages. It identifies itself in its user agent and obeys
robots.txt; if a site disallows us, we do not crawl it. - Public DNS records, for the mail-configuration facts.
- Inference. Some addresses are not published anywhere — they are generated from a person's name and their employer's known address format, then tested for deliverability. An address produced this way is a well-informed guess, and we label it as such internally with a confidence score.
3. Why we hold it, and our lawful basis
Our lawful basis is legitimate interests (Article 6(1)(f)): operating a business-to-business prospecting tool, which our customers use to identify companies that might want to hear from them. We have carried out a balancing test. In short: the data is limited to the business sphere, most of it is company-level rather than personal, it comes from sources the business itself made public, we do not build behavioural profiles, and we give you an unconditional right to have your details removed — see section 6.
You have the right to object to processing based on legitimate interests. If you object, we will stop, and there is no test you have to pass first.
4. Who we share it with
Warmerly customers can search the database and export records for their own outreach. Once a customer has exported your details, they become the controller of that copy — and they, not us, are responsible for how they contact you. If you have received an email you did not want, the fastest route is to use the unsubscribe link in that email, which suppresses you for that sender immediately. Emailing us also works, and covers our database itself.
We use the sub-processors listed in our DPA to host and process this data. We do not sell the database.
5. How long we keep it
Company records are refreshed periodically and retained while the business appears to be trading. Records for domains that no longer resolve or no longer accept mail are retired. Individual-level records produced by the email finder are retained for 24 months from the date they were generated, and then deleted. Suppression records — the fact that you asked not to be contacted — are kept indefinitely, because deleting them would allow you to be added back.
6. Your rights, including removal
You have the right to:
- Object to our processing, and have your details removed from the database. We will action this and add you to a permanent suppression list so the same details are not re-added by a future crawl.
- Access the data we hold about you.
- Correct anything inaccurate — this matters most for inferred email addresses, which can be wrong.
- Erase your data.
- Restrict processing while a dispute is resolved.
- Complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
To remove yourself or your company, use our privacy request form or email privacy@warmerly.com with the domain or email address concerned. No account needed, no justification needed. We act within one month, and usually much sooner.
7. Changes
We will post updates to this notice on this page and update the date above.