The awkward questions, answered first

For the business contact records we compile ourselves, we rely on legitimate interests — Article 6(1)(f) of the UK and EU GDPR. We do not claim consent for data we did not collect from the person, because that claim would not be true.

Legitimate interests is not a free pass. It only holds if a three-part balancing test holds, so here is ours in the open:

We keep a written legitimate interests assessment and share it with customers under NDA during procurement. In jurisdictions where electronic marketing to individuals — including sole traders and partnerships in the UK under PECR — needs prior consent, legitimate interests does not rescue you. The platform can exclude those entity types and whole countries from a campaign, and the decision is yours to make with your counsel.

Five categories, and every field carries the source of record and the date we last saw it:

• Publicly accessible company websites, career pages, press releases and filings.
• Public company registries and open government datasets, used where the register’s own licence allows commercial reuse.
• Professional profiles a person has published for a professional audience.
• Open map and points-of-interest data for the local-business dataset.
• Licensed feeds from data partners, under contracts that warrant the partner’s own right to license them.

Equally important, what we do not do:

• We do not buy consumer lists, and we do not accept data of unclear provenance from brokers.
• We do not scrape behind a login, a paywall or a technical measure intended to prevent access.
• We do not hold special category data — health, beliefs, politics, union membership, sexuality — and we reject partner feeds that contain it.
• We do not knowingly hold personal email addresses or personal mobile numbers; where a record is identifiable as a private channel it is dropped.

Every record is revalidated on a 4-week cycle.

Both, in two clearly separated contexts — and the distinction decides who has to answer a subject request, so it is worth being precise about.

Our data processing agreement covers the processor half, incorporates the EU standard contractual clauses and the UK addendum, and lists sub-processors in an annex. It is available before signature, not after.

They write to privacy@salvo.example or use the form linked from every outbound email, and we work to a fixed sequence:

• We confirm receipt within one working day and answer substantively within 30 days.
• We verify only enough to be confident we are matching the right record. We do not demand a passport scan to delete a work email address.
• On an access request we return what we hold, the categories of source it came from, and who it has been disclosed to.
• On an objection under Article 21 we stop processing for direct marketing immediately. There is no balancing test to run — an objection to direct marketing is absolute.
• On erasure we remove the record and keep the identifier on a permanent suppression list, so the next refresh cannot reintroduce them.

That last point is the one people ask about. Keeping the identifier after an erasure request is itself processing, and we rely on the legal obligation to give effect to the erasure. The entry holds the identifier and nothing else — no name, no employer, no history — and it is never used for anything but blocking.

Not individually, and we will not pretend otherwise. Because we did not collect the data from the person, Article 14 applies, and Article 14(5)(b) allows a proportionality carve-out where individual notice would take disproportionate effort. We rely on it — a great many companies do — but we do not treat it as the end of the obligation.

What we do instead:

• A standing collection notice published in our privacy policy, describing categories, sources, purposes and rights.
• Every email sent through the platform identifies the sender, the company on whose behalf it is sent, and a reply-to that reaches a person.
• Every email carries a plain opt-out line — no image-only unsubscribe, no dark pattern, no login required to leave.
• On request we tell any individual precisely which sources their record was assembled from.

Suppression is checked before every single send, not nightly. A campaign cannot be configured to skip the check, and there is no override switch for administrators.

• Explicit opt-out links are appended to every message the platform sends.
• Free-text opt-outs are caught too: the reply classifier treats “take me off this list”, “not interested, stop emailing” and similar as an opt-out, suppresses the address for the workspace that wrote to them and closes the thread without a further reply. The unsubscribe link in every email goes further and applies platform-wide.
• Suppression applies at address level and, optionally, at domain level — useful for customers, competitors and anybody who asks for the whole company to be left alone.
• Hard bounces and spam complaints are suppressed automatically and permanently.
• Objections made to us as controller are applied platform-wide, across every customer workspace, not just the one that sent the email.
• You can import your own suppression list at any time; it is applied before it finishes uploading.

Opt-outs are irreversible through the product. If somebody who opted out later asks to be contacted again, that takes a written request to support, so a mis-click can never undo a person’s decision.

Retention is set per category, and deletion is a job that runs, not an intention.

Deletion from backups is not instant — a restore window has to exist for the system to be recoverable. A record erased from primary storage is re-suppressed automatically if a restore ever reintroduces it.

Sub-processors are listed by legal entity, purpose and hosting region in the DPA annex. By category, they are:

• Cloud infrastructure and managed Postgres, in an EU or US region you choose at workspace creation.
• Transactional email infrastructure for platform notifications, kept separate from campaign sending.
• A large language model provider for research, writing and reply classification — under zero-retention terms, with customer content excluded from model training.
• OpenRouter, an LLM routing service hosted in the United States, which passes those same research, writing and classification requests — including the lead details they carry — to the model provider.
• A payments processor for cards, invoices and tax handling. Card numbers never reach our systems.
• A support desk for tickets you open with us.

We give 30 days’ notice before adding or replacing a sub-processor, and a customer may object. If we cannot resolve an objection, the customer may terminate for that reason without penalty and take a data export with them.

No. We hold no completed SOC 2 or ISO 27001 audit today, and we are not going to imply one with a badge that means something weaker. If a current certificate is a hard gate in your procurement process, we are not the right vendor for you yet, and we would rather say so now than in week six of a security review.

What does exist:

• TLS 1.2+ in transit, AES-256 at rest, and encrypted, key-separated backups.
• Least-privilege access, SSO with enforced MFA for staff, and no standing production database access.
• Audit logging of administrative and data-export actions inside every workspace.
• Dependency and container scanning in CI, with a documented patch window for critical findings.
• An annual third-party penetration test; the summary letter is available under NDA.
• A written incident response plan committing us to notify affected customers within 72 hours of confirming a personal data breach.

A SOC 2 Type I readiness assessment is the current objective; we will publish the report date when there is a report, and not before.

Cold email is not one legal regime, it is several, and the differences are larger than most sequences account for. In brief, and without pretending this is exhaustive:

The platform gives you the controls — country and entity exclusion, mandatory sender identification, forced opt-out lines, suppression enforced before each send. Deciding which markets you are comfortable sending into is a judgement call that belongs to you and your lawyer.

Exported records are licensed to your organisation for your own sales, marketing and research. That licence is non-exclusive and non-transferable, and three things sit outside it: reselling or redistributing the records, building a competing database from them, and using them as training data for a model you publish or sell.

You remain the controller of anything you export the moment it lands in your systems, which means your own retention schedule, your own notice obligations, and your own duty to honour an objection someone sends to you. Suppressions you record with us do not automatically reach a copy you took last quarter — so keep exports short-lived and refresh them. The full wording is in the terms of use.