How [TeamTalk Ltd] uses the personal data of people it contacts about its product, and what those people can do about it. Publish this at team-comms.com/privacy before sending a single outreach email, and link to it from the footer of every one.
This notice must be live at a stable URL before the first cold email or call, not after. It is the document that makes the legitimate interests basis usable, and Article 14(3)(b) gives you a month at the outside to provide it when the data did not come from the person. Fill in every bracket, publish it, then link it. A notice that describes a company other than the one sending the email is worse than no notice at all.
| Controller | [TeamTalk Ltd], a company registered in England and Wales under number [company number], registered office [registered office address]. For the personal data described in this notice we are the controller: we decide why and how it is used. |
| How to contact us | Email [privacy@team-comms.com] · post to the registered office above · telephone [number]. The person accountable for data protection is [name, role]. |
| Data protection officer | We are not required to appoint one under Article 37 of the UK GDPR and have not appointed one. The named individual above answers everything a data protection officer would. |
| ICO registration | We are registered with the Information Commissioner under registration number [number]. |
| What this notice covers | Business contacts: people we approach, or who approach us, about buying or evaluating TeamTalk. It does not cover the workers whose data our customers put into the product. For those people our customer is the controller and we are the processor, and the customer's own privacy notice applies. |
Only what is needed to have a business conversation with you: your name; your job title and employer; your work email address; your work telephone or mobile number where it is published or you gave it to us; your work address or the site you are responsible for; the public professional profile you maintain, for example on LinkedIn or your employer's website; and a record of our contact with you, meaning the emails and calls, what was discussed, what you asked for, and whether you asked us to stop.
We do not knowingly collect any special category data about you, we do not buy consumer marketing lists, and we do not use tracking pixels to record whether you opened an email. [If you do use open tracking, say so here plainly and give the opt-out. Do not leave this sentence in if it is not true.]
Article 14 of the UK GDPR requires us to tell you the source when the data did not come from you. Ours are: your employer's own website, including team, contact and site pages; publicly available professional networks such as LinkedIn; trade press, industry directories, event and exhibitor lists and public tender or framework notices; Companies House and other public registers; and a colleague or contact of yours who suggested we speak to you, in which case we will tell you who, if you ask. We record which of these a record came from.
| What we do | Lawful basis | The detail |
|---|---|---|
| Contact you about TeamTalk, by email, telephone or LinkedIn, and follow up on that contact | Legitimate interests, Article 6(1)(f) | Our interest is finding customers for a product built for the sector you work in. We have carried out and recorded a legitimate interests assessment (LIA) covering the purpose, necessity and balancing tests, and we will send you a copy of it if you ask. In short: we contact people in a professional capacity, about something within their job, at their work contact details, in low volumes, with a clear identity and a one-click way to stop. We do not contact people at home, at personal addresses, or about anything outside their work. |
| Keep a record that you asked us not to contact you | Legal obligation, Article 6(1)(c) | We must be able to honour a suppression request, which means keeping the minimum record needed to recognise you and not contact you again. This is the one record we keep even after you ask us to stop. |
| Answer your enquiry, run a demonstration, prepare a proposal or a pilot | Steps before a contract, Article 6(1)(b), or legitimate interests where you act for a company | Only what the conversation needs. |
| Keep our own business records, including accounting and dispute records | Legal obligation and legitimate interests | Retained for the periods below. |
Electronic marketing rules, separately from the UK GDPR. Unsolicited marketing email and text are also governed by the Privacy and Electronic Communications (EC Directive) Regulations 2003. Regulation 22 restricts unsolicited electronic mail sent to an individual subscriber. A corporate subscriber is outside that restriction. Regulation 2(1) defines one as a company, a company incorporated by royal charter or letters patent, a partnership in Scotland, a corporation sole, or any other body corporate or entity that is a legal person distinct from its members, so a limited liability partnership and a Scottish partnership are both corporate subscribers. The people who are individual subscribers, and to whom the restriction does apply, are sole traders and partnerships in England, Wales and Northern Ireland that are not limited liability partnerships. Regulation 23 requires that we never disguise who we are and always give a valid address to opt out. We only approach corporate subscribers on this basis, we identify ourselves in every message, and we act on any objection at once. If you tell us to stop, we stop, whatever the classification.
We do not sell, rent or share your data with anyone for their own marketing. We use a small number of suppliers who process it only on our written instructions, as processors: [email provider] for sending and storing mail; [CRM or spreadsheet tool] for keeping the record; [calendar and meeting tool] for arranging a meeting; and our accountant and, where needed, our solicitor as professional advisers. Where any of them is outside the United Kingdom we make the transfer under an approved route: adequacy regulations under Article 45A, or the ICO's International Data Transfer Agreement or Addendum under Article 46 with a documented transfer risk assessment. We will tell you which applies to which supplier if you ask. We will also disclose data where the law, a court or a regulator requires it.
| Record | Retention |
|---|---|
| Prospect record where you have not replied to us | 12 months from the last contact, then deleted |
| Prospect or opportunity record where we are in an active conversation | 24 months from the last contact, then reviewed and deleted unless the conversation is live |
| Record of an objection or an opt-out request | Kept indefinitely, in the minimum form needed to make sure we do not contact you again |
| Customer contract, accounting and tax records | Six years after the end of the relationship, which is the ordinary limitation and tax record period |
You have the right to be informed, which is what this notice is for; the right of access to a copy of the personal data we hold about you; the right to rectification of anything inaccurate or incomplete; the right to erasure; the right to restrict processing while a dispute is resolved; the right to data portability where processing is by automated means on consent or contract; and the right to object to processing based on legitimate interests. We do not carry out automated decision-making producing legal or similarly significant effects.
Objecting to direct marketing is absolute. Where you object to processing for direct marketing we must stop, immediately and without balancing it against anything. There is no test to apply and no reason you need to give.
How to exercise any of them: email [privacy@team-comms.com] with "privacy request" in the subject line, or reply to any message we have sent you with the word stop. We respond within one month, and we do not charge. For a right to object or an opt-out we act immediately and confirm in writing.
Please tell us first, at [privacy@team-comms.com], so we can put it right. You also have the right to complain to the supervisory authority at any time: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, helpline 0303 123 1113, ico.org.uk/make-a-complaint. Complaining to us does not remove your right to complain to them.
This is version [1.0], published [date]. We keep every earlier version and will supply one on request. Where a change materially affects how we use your data we will tell the people affected rather than relying on the page changing quietly.