Prospecting privacy notice

Effective 4 November 2026 · v1.0

Download this notice (PDF)

This GDPR Article 14 notice covers GTME’s research for its own sales. Research and CRM recordkeeping are current processing; any later outbound contact is a separate step. This notice does not imply that a campaign has begun or that we may contact every person in a research list. Work on behalf of a client needs its own allocation of responsibilities and notice.

Controller and contact

DIGITAL Adrian Żebrowski, trading as GTME, Gdańsk, Poland; NIP 9571194723; REGON 543098783. Contact adrian@gtme.cc for information or to object.

Sources and data

We research public business websites and professional profiles, and use Clay to source or enrich business information. HubSpot currently holds company records; researched personal contact data is held in research tools and working files. Depending on the source, data may include your name, employer, role, business contact details, profile or source URLs, company characteristics, location and research notes. Supplier results or raw exports may also contain addresses, inferred locations or other fields. Our procedure requires checking relevance and accuracy and removing unnecessary fields before further use. Initial supplier data remains under review. We do not deliberately seek or use special-category data for this research.

You can ask which sources and suppliers contributed to your record, including whether a source was public, and which fields we hold. Public availability does not make every reuse permissible.

Purpose and basis

We assess whether a business and professional role could be relevant to our account research and outbound services. We rely on legitimate interests under Article 6(1)(f): finding suitable business customers while assessing necessity, your reasonable expectations and effects on you. A human reviews fit; a role or company match is not evidence that you intend to buy.

This data-processing basis is not permission to email, call, text or message you. Before any outreach we must separately assess the channel, jurisdiction, consent requirements, exceptions and objections. We do not make solely automated decisions producing legal or similarly significant effects under Article 22.

When we inform you

Our procedure is to provide this information within one month of obtaining your personal data, or at the first communication or first disclosure to another recipient if earlier. Publishing this page alone does not replace giving you the notice. The notice delivered to you includes the available source-specific provenance for your record; you can also ask for further source details.

Recipients and transfers

Relevant data may be handled by Clay for research and enrichment, HubSpot for company records, and an access-limited OpenAI assistant/workspace for research support. Cloudflare infrastructure and Google Gmail may handle communications. Access is limited to the people and service providers involved in these purposes. This notice does not authorise disclosure of a contact list to clients.

These services can involve processing outside the EEA, including the US. Clay, HubSpot and Cloudflare publish terms describing safeguards including standard contractual clauses. We are verifying account-specific contractual arrangements and transfer safeguards; the linked standard terms do not establish which safeguards apply to each account. Ask us about a particular transfer and how to obtain a copy of the applicable safeguards; see also our general privacy notice.

Time limits and objections

Our retention policy limits unengaged prospect records to 90 days from collection and raw exports to 30 days from creation. Reviews and deletions are manual. Further enrichment does not restart the 90-day limit. If you start a business discussion with us, relevant information may move into enquiry or customer records under the general notice. An objection alone does not count as that engagement.

You may object to direct marketing, including related profiling, at any time. We then stop using your data for that purpose. We retain only the minimum identifying information needed to prevent renewed contact for as long as we carry out outbound activity, with an annual review of necessity. That suppression record is not used to target you. Any other retention needs a separate purpose and basis.

Reply to any message or email adrian@gtme.cc. No special wording or account is needed. See all rights, response times and complaint options.