How we got your data

You did not give us your details. We built a record about your professional role from sources you will find listed further down, and one of our customers used it to email you. When that happens, Article 14 of the UK and EU GDPR says we owe you an explanation without you having to ask for it — who we are, what we hold, where it came from and how to make it stop. This page is that explanation.

Every message sent through the platform carries an unsubscribe link in its footer, and the page that link opens points straight here — that is the route from a cold email to this explanation. Reading it is not conditional on you being a customer, being in Europe, or replying to anything.

One company holds the database and answers for it. The customer who emailed you chose to contact you and wrote the message, but the record itself is ours, and so is the duty to explain it.

Controller

Salvo GTM Ltd Placeholder, to be completed before launch: confirm the incorporated nameThe company that decides what happens to the data, and the one answerable to you for it.

Registered address

Placeholder, to be completed before launch: registered office addressArticle 14(1)(a) wants the real one, not a support desk.

Company number

Placeholder, to be completed before launch: company number

Data protection contact

privacy@salvo.exampleMonitored by a person. Every route on this page ends up here.

Data protection officer

Placeholder, to be completed before launch: appointed? name and contact, or the recorded reason one is not required

EU / UK representative

Placeholder, to be completed before launch: article 27 representative, or the recorded reason none is neededRequired if we hold data about people in a region where we are not established.

Business-role data, and nothing about your private life. A complete record is short enough to list in full:

• Your name, and the job title, seniority and department we have on file for you.
• The company you work for, and its website, industry, size band and locations.
• A work email address, and a direct business line where a public listing gave us one.
• A link to a professional profile you published yourself, where we matched one.
• The provenance trail: for every field, which category of source it came from and the date we saw it there.
• If a customer has emailed you through us, the record of that — when, by whom, whether it was opened, and your reply if you sent one.

We do not hold special category data — nothing about health, beliefs, politics, ethnicity, sex life or trade union membership — and we do not knowingly hold home addresses, personal email accounts or personal mobile numbers. If you find any of that in a copy of your record, that is a defect and we want to hear about it.

This is the honest answer to the question most people arrive with. Each field in your record carries the category of source it came from, so a copy of your data tells you which of these rows applies to which field.

We do not buy consumer lists, we do not guess addresses by pattern-matching a company domain, and we do not take data from anyone who cannot say where they got it.

One purpose, one lawful basis. We rely on legitimate interests — Article 6(1)(f) — and not on consent, because claiming you consented to something you were never asked about would not be true.

Legitimate interests only holds if the balance genuinely falls our way, so we wrote the test down and published it rather than asserting the conclusion. It is in the compliance FAQ, in full, including the parts that count against us. If you disagree with it, you do not have to argue: an objection to direct marketing needs no reason and we have no right to refuse it.

• Our customers — the companies that search the database and run campaigns. A customer sees your record when it matches what they are looking for.
• Our sub-processors — cloud hosting, a managed database, transactional email infrastructure, a language model provider Placeholder, to be completed before launch: confirm the zero-retention terms are signed, error monitoring, and a support desk. Each one is under a written contract and processes only on our instructions.
• Nobody who wants it for advertising. We do not sell personal data, we run no ad networks and we place no third-party marketing pixels.
• A court or regulator, where the law compels us — and we will tell you unless we are legally barred from doing so.

The categories are listed with their regions in the privacy policy, and the named entities are in the DPA annex, available on request. An access request tells you which of our customers has actually seen your record, not just which ones could have.

Primary hosting is in Placeholder, to be completed before launch: hosting region, once the infrastructure is fixed. Where data reaches a country without an adequacy decision — in practice the United States — we rely on the European Commission’s standard contractual clauses with the UK international data transfer addendum, encryption in transit and at rest, and Placeholder, to be completed before launch: a transfer risk assessment, to be completed and dated. Copies of the clauses are available from privacy@salvo.example on request, and you do not have to explain why you want them.

A request to erase is recorded with the date it is due, and the suppression takes effect the moment it arrives. The periods above only mean something once something enforces them without being asked: Placeholder, to be completed before launch: automated retention sweep, to be running before launch.

The platform scores how closely a company matches what a customer is looking for, and a language model drafts the email and classifies your reply. That is profiling in the ordinary sense of the word, and we would rather say so than hide it. What comes out of it is a marketing email — not a decision about credit, employment, insurance or eligibility — so it is not the kind of automated decision Article 22 gives you a right to object to individually. You can still object to the whole thing under Article 21, which is a wider right and takes one click. Content sent to our model provider is covered by zero-retention terms and is not used to train public models.

These are yours whether or not you are a customer and wherever you live. All of them are free, none of them need a reason, and we will not ask you for a passport to settle a question about a job title.

• Object to marketing (Article 21(2)) — absolute. We stop, immediately, and we cannot weigh anything against it.
• Object to the rest of the processing (Article 21(1)) — we stop unless we can show compelling grounds that override your rights, and the burden is on us.
• Get a copy (Article 15) — everything we hold, where each field came from, and who has seen it.
• Have it corrected (Article 16) — wrong employer, old title, a name spelt the way nobody spells it.
• Have it erased (Article 17) — the record goes; the hashed opt-out stays so it cannot come back.
• Restrict processing (Article 18) — pause everything while an accuracy dispute is resolved.
• Portability (Article 20) — a machine-readable file, where it applies.
• Complain to a regulator (Article 77) — see below, and you never need our permission.

Access, correction and erasure go through a confirmation email first, because we will not send somebody’s file to whoever typed their address into a form. Opting out does not: the right to stop marketing is unconditional, so we do not put a condition in front of it.

Tell us first if you are willing to — we would rather fix it than read about it from a regulator — but you are under no obligation to, and complaining to us does not use up your right to complain to anyone else.

You can lodge a complaint with the data protection authority in the country where you live, where you work, or where the thing you are unhappy about happened. In the UK that is the Information Commissioner’s Office. In the EU it is your national authority; the European Data Protection Board publishes the list. Our own lead supervisory authority is Placeholder, to be completed before launch: lead supervisory authority, once the entity is registered.