Privacy notice · UK GDPR and PECR
Privacy Policy
Last updated:
This notice explains how Konvertia collects, uses and protects personal data about people who visit our website, contact us, use our online tools, work for our clients, or receive messages from campaigns we run. It is written for people in the United Kingdom, and it applies alongside the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Konvertia provides B2B lead generation: cold email and LinkedIn outreach run on our own platform, Bazalt. To do that we process business contact details of decision-makers at companies that may be interested in our clients' services, and in our own.
1Who we are
The controller of your personal data is Konvertia Sp. z o.o., a company registered in Poland.
- Registered office: ul. Tadeusza Kościuszki 9B, 05-082 Blizne Jasińskiego, Poland
- Company number (KRS): 0001169704
- VAT ID: PL1182304811
- Email: kontakt@konvertia.pl
- Website: konvertia.pl
For anything about your personal data, including using your rights, write to us at kontakt@konvertia.pl.
We act as a controller when we decide why and how personal data is used, for example when we run outreach to promote our own services or deal with your enquiry. When we run a campaign on a client's instructions, we act as that client's processor. This notice covers our processing as a controller. It also tells you what to expect if you receive a message from one of our campaigns.
2What personal data we collect
Visitors to our website
- Your IP address and technical details about your device and browser.
- Details you enter in our forms and tools, such as your name, email address, company, website and phone number.
- Details shared when you book a call with us.
- How you use the site (analytics cookies, only with your consent).
- Session recordings and heatmaps: cursor movement, clicks, scrolling and the pages you visit (Microsoft Clarity, only with your consent). Text typed into form fields is masked and does not appear in recordings.
- The company network you visit from (worked out from your IP address) and the pages you view; if you submit a form, also a link between the email address you give and those visits (Leadfeeder, only with your consent).
Our clients and people who work for them
- Identification details: name, job title and company.
- Contact details: email address, LinkedIn profile and phone number.
- Information about onboarding and how a campaign is set up.
- Details of LinkedIn accounts that a client connects to our platform.
People we contact in B2B campaigns
- Name, job title, work email address, company and LinkedIn profile.
- Business information we use to make a message relevant to your role, such as your public LinkedIn activity, information on your company's website and public market signals like a job change or a recruitment drive.
We do not ask for special category data (such as health or political opinions) and we do not use it. We do not make decisions about people by solely automated means that have legal or similarly significant effects.
3Where we get your data
Most of the data we hold comes from you, for example when you fill in a form. For people we contact in B2B campaigns, we do not collect the data from you directly. It comes from:
- publicly available business and professional sources, such as LinkedIn and public company registers;
- our clients, who give us contact details as part of a campaign;
- databases our platform builds from publicly available information.
If we contact you for the first time, our message tells you who we are and why you are hearing from us. This notice gives you the rest of the information we owe you, and it is always available on this page.
4Why we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR) | Example |
|---|---|---|
| Answering enquiries and contacting you | Article 6(1)(b): contract, or steps before entering one | Replying to an email or a contact form |
| Delivering services to our clients | Article 6(1)(b): contract | Running an outreach campaign on a client's instructions |
| B2B outreach to potential customers | Article 6(1)(f): legitimate interests | Emailing a decision-maker at a company |
| Marketing our own services | Article 6(1)(f): legitimate interests, or Article 6(1)(a): consent where you have opted in or the law requires it | Newsletter, LinkedIn campaigns, messages after you ask us to send you something |
| Legal obligations (accounting and tax) | Article 6(1)(c): legal obligation | Issuing and keeping invoices |
| Website analytics and session recordings | Article 6(1)(a): consent | Visit statistics (Google Analytics), session recordings and heatmaps (Microsoft Clarity), recognising which companies visit the site (Leadfeeder) |
| Improving our services | Article 6(1)(f): legitimate interests | Analysing campaign performance, improving the Bazalt platform |
Where we rely on consent, you can withdraw it at any time. Withdrawing is as easy as giving consent, and it does not affect the lawfulness of what we did before.
If you give us your details through a form, we need them to answer you or to provide what you asked for. If you do not provide them, we cannot do that.
5B2B outreach, legitimate interests and PECR
Our legitimate interests
When we contact people in business roles to offer B2B services, we rely on legitimate interests. Our interest is to run a commercial business, start relevant conversations with other businesses and provide services to them. We have weighed your interests against ours using the ICO's three-part test.
- Purpose: finding and contacting people whose role makes our message relevant to their work, in order to start a business conversation.
- Necessity: we use a small set of business details (name, job title, work email, company, LinkedIn profile) and contact only people in decision-making roles. We do not buy mass lists of unknown origin.
- Balance: people in these roles can reasonably expect relevant business approaches. The impact on you is small. Every message says who we are, and it gives a simple way to opt out. We honour an opt-out straight away.
We keep a written record of this assessment. If you would like a summary of it, email us.
Email and PECR
PECR does not require consent for marketing emails sent to corporate subscribers, such as limited companies, limited liability partnerships and some public bodies. We still identify ourselves in every message and give a working way to opt out. Sole traders and some partnerships are treated as individual subscribers. We do not send them marketing email unless they have consented or another rule in PECR applies.
Your right to object to direct marketing
You have the right to object to direct marketing at any time, and it is absolute: if you object, we must stop, and we will.
To object, reply to any message from us and ask to be removed, or email kontakt@konvertia.pl. We then take you out of active campaigns straight away and add your address to a suppression list, so that our campaigns do not contact you again. We have to keep that minimum record in order to honour your request.
6Who we share your data with
We share personal data with the following kinds of recipients, and only as far as needed for the purposes above.
Service providers acting as our processors
- Cloud infrastructure providers: servers and hosting for the Bazalt platform.
- Software providers: CRM, email automation, analytics and AI language-model tools. They act under data processing agreements.
- Google Ireland Ltd: Google Analytics, for website statistics (with your consent).
- Microsoft Ireland Operations Ltd: Microsoft Clarity, for session recordings and heatmaps (with your consent).
- Dealfront (Leadfeeder): recognising which companies visit the site (with your consent).
- Our accountants, for the data needed to keep our books.
- Our legal advisers, where we need legal advice.
Our clients
When we run a campaign, the contact details of the people who reply or take part may be shared with the client who commissioned it. This happens under our contract with that client.
Public authorities
We disclose data to public authorities, such as tax authorities, only where the law requires it.
We do not sell personal data.
7Transfers outside the UK
Konvertia is based in Poland, so your data is handled there and in other countries of the European Economic Area (EEA). The UK has adequacy regulations covering the EEA, so personal data can flow from the UK to us without further safeguards.
We do not transfer personal data to other countries without the safeguards that UK GDPR requires, such as adequacy regulations or standard contractual clauses. Google and Microsoft may process analytics data in the United States. Both companies take part in the EU-US Data Privacy Framework. If you would like more information on the safeguards we rely on, or a copy of them, email us.
8How long we keep your data
| Category of data | How long we keep it |
|---|---|
| Client contracts and correspondence | 5 years after the relationship ends, or until claims can no longer be brought |
| Invoicing and accounting records | 5 years from the end of the tax year they relate to |
| Contact form data where no contract follows | 12 months from the last contact |
| B2B contact data in outreach campaigns | Until you object or the campaign ends, and in any case no more than 24 months |
| Suppression list (people who opted out) | Indefinitely, so that you are not contacted again |
| Bazalt platform system logs | 12 months from creation |
| Analytics data (cookies) | As set in your cookie settings, usually 12 to 26 months |
| Session recordings (Microsoft Clarity) | 30 days. Aggregated data (statistics, heatmaps): up to 13 months |
When the period ends, we delete the data permanently or anonymise it.
9Your rights
Under UK data protection law you have the following rights. Some of them depend on the lawful basis we use.
- Access: to know whether we hold your data and to get a copy of it.
- Rectification: to have inaccurate data corrected and incomplete data completed.
- Erasure: to ask us to delete your data in certain situations.
- Restriction: to ask us to pause using your data while a dispute is resolved.
- Data portability: to receive data you gave us in a structured, commonly used format, where we process it by automated means on the basis of consent or a contract.
- Withdrawing consent: to withdraw consent at any time where we rely on it.
- Not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. We do not make such decisions.
Right to object
You can object to our use of your data when we rely on legitimate interests. If it is for direct marketing, we must stop. For other purposes we will stop unless we can show compelling legitimate grounds that override your interests.
How to use your rights
Email kontakt@konvertia.pl. We reply without undue delay and within one month of receiving your request. If the request is complex or we receive several from you, we can extend that by up to two further months, and we will tell you why. We do not charge a fee unless a request is clearly unfounded or excessive. We may need to check your identity first.
10Cookies and similar technologies
Our website uses cookies and similar technologies. Apart from the strictly necessary ones, we set them only after you give consent in our cookie banner (CookieYes), and we pass your choice to the Google tools through Consent Mode.
Strictly necessary
These make the site work, for example by keeping your session and your language preference. They do not need consent.
Analytics
These tell us how the site is used. They are switched on only with your consent.
- Google Analytics: visit statistics, traffic sources and conversions (cookies _ga and _ga_*).
- Microsoft Clarity: session recordings and heatmaps, which show us where people click, scroll and get stuck, so we can fix broken elements and make pages easier to read. Text typed into forms is masked. Cookies: _clck, _clsk, SM and MR. See Microsoft's privacy statement.
- Leadfeeder (Dealfront): uses your IP address to show us which company a visit comes from and which pages were read. If you submit a form, it links the email address you give to those visits. Cookie: _lfa.
Marketing
These are used to show personalised adverts and measure campaigns, for example the LinkedIn pixel, remarketing, Google's _gcl_au and Microsoft's MUID and ANONCHK. They are switched on only with your consent.
You can change or withdraw your consent at any time with the cookie settings icon in the bottom left corner of the page, or in your browser settings. Withdrawing consent does not affect processing that took place before.
11Keeping your data secure
We use technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure. They include:
- encryption of data in transit (TLS/HTTPS);
- encryption of data at rest on the Bazalt servers;
- role-based access control, so that only authorised people can see the data;
- regular backups and recovery procedures;
- data protection training for our staff;
- security audits and penetration testing of our infrastructure.
If a personal data breach is likely to put people at risk, we report it to the supervisory authority within 72 hours of becoming aware of it. If the risk is high, we also tell the people affected.
12Complaints and the ICO
If you are unhappy about how we use your data, please tell us first at kontakt@konvertia.pl and we will try to put it right. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at any time.
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Because our company is based in Poland, you may instead complain to the Polish regulator, the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
13Changes to this notice
We may update this notice when the law, our business or the Bazalt platform changes. We will tell you about important changes with a clear notice on our website, and by email if you are our client. The date at the top shows when it was last updated. If we plan to use your data for a new purpose, we will tell you before we do.