GDPR and Your Data Rights

01Why you are reading this

The UK and EU General Data Protection Regulation (GDPR) require us to tell people when we collect their personal data from somewhere other than them (Article 14). This page is that notice for the business professionals whose work details appear in our prospect lists. It also explains how our customers must handle the data.

Website visitors and customers should read our Privacy Policy.

02Who is responsible for your data

Clean Rows is the controller of the prospect data we compile. Contact us at hello@cleanrows.com. We have not appointed a Data Protection Officer. A named person at Clean Rows handles every data request.

When we deliver a list, the customer who receives it becomes an independent controller of that copy and is responsible for how it uses the data, including telling you who they are when they first contact you.

03What data we hold

Work-related information only:

• First and last name
• Job title and seniority
• Employer, company domain, company size and industry
• Business email address and its verification status
• Company phone number, and a mobile number where publicly listed for business use
• Personal and company LinkedIn profile URLs
• Work location (city, state or country)

We do not hold special category data (such as health, ethnicity, religion or political opinions), criminal records, government ID numbers, financial data or home addresses.

04Where the data comes from

From publicly accessible business sources:

• Public professional profiles, such as LinkedIn
• Company websites, team pages and press releases
• Public business directories and company registries
• Public regulatory filings, such as SEC filings

We check business email addresses with two independent email verification services. We do not buy or resell private databases.

05Why we use it and our legal basis

We compile prospect lists so that businesses can find and contact relevant professionals about products and services that relate to their work. Our legal basis is legitimate interests (Article 6(1)(f) GDPR): our interest in providing this service and our customers’ interest in B2B sales research and outreach.

We have assessed that these interests are not overridden by your rights because:

• we use only professional data that is already publicly available in a business context
• the data is used only to contact you in your professional role
• we build lists to a specific brief rather than keeping a large database of profiles
• you can object and be removed at any time, and we honour this across all future lists
• our customers must follow outreach laws and honour opt-outs under our Terms of Service

We do not use the data for automated decision-making that has legal or similarly significant effects on you.

06Who receives it

• Business customers who order lists matching your professional profile. They are mainly agencies, B2B software companies and B2B service firms in the US, UK, EU, Canada and Australia.
• Service providers that help us deliver lists, such as email verification, file storage and hosting providers.

Data may be processed in India, where we operate, and in the countries where our customers are based. Where UK or EU data is transferred to a country without an adequacy decision, we use safeguards the law allows, such as Standard Contractual Clauses.

07How long we keep it

We build lists to order. We keep a delivered file for 90 days so we can handle rebuilds and support, and then delete it from our working storage. If you ask to be removed, we keep only what is needed to stop you being added again (for example, your email address) on a suppression list.

Customers keep their own copies under their own retention policies.

08Your rights

You have the right to:

• Access the data we hold about you and learn where it came from
• Correct inaccurate details
• Erase your data
• Object to our processing. For direct marketing this right is absolute: we will stop, with no questions asked
• Restrict our processing while a complaint is resolved
• Complain to a supervisory authority, such as the UK Information Commissioner’s Office (ico.org.uk) or the data protection authority in your EU country

To make a request, email hello@cleanrows.com from your work address, or tell us which address to search for. We may ask you to confirm your identity. We respond within one month.

When you are removed, we add you to our suppression list and, where we can, tell customers who received your details in the previous 90 days so they can remove you too.

09What our customers must do

Customers who receive our lists are independent controllers and must:

• tell each person who they are and where the data came from, at the latest when they first contact them (Article 14 GDPR)
• include a clear way to opt out in every message and honour opt-outs promptly
• follow electronic marketing rules, such as the UK PECR, EU ePrivacy laws, CAN-SPAM, CASL and telemarketing and do-not-call rules. Some EU countries, such as Germany, require prior consent even for business-to-business email, and UK sole traders and partnerships are treated like consumers
• suppress anyone we tell them has asked to be removed

Full obligations are in our Terms of Service.

10Contact

Email hello@cleanrows.com with the subject “Remove me” or “Data request”. A person reads every message.