Privacy Notice for B2B Contact Data

Information about our processing of business contact information (GDPR Art. 14)

Last Updated: October 3, 2026

Why are you receiving this notice?

Under GDPR Article 14, we must inform you when we process your personal data obtained from sources other than you. This notice explains how we collect, use, and protect business contact information in our B2B lead-research service.

1. Data Controller Identity

Name: INNOVACORE SYSTEMS S.R.L.

Registered Office: Berceni, Ilfov, Octavian Goga no. 5, ground floor, room no. P04, 12.11 sqm

Registration Number: J2025042878002

CIF: 51978294

Contact Email: contact@innovacore.ro

DPO/Privacy Contact: contact@innovacore.ro

2. What Business Contact Data We Process

We process the following categories of business contact information:

  • Full Name: First name and last name
  • Professional Title: Job title or position
  • Work Email Address: Business email address
  • Work Phone Number: Business phone number (if available)
  • LinkedIn Profile: Public LinkedIn profile URL (if available)
  • Company Affiliation: Name and registration details of employer company
  • Industry Information: Business sector (CAEN code) of employer

We do NOT collect: Home addresses, demographic data, or sensitive personal data (health, religion, political opinions, etc.). We look only for business contact details; however, a data provider may occasionally return a personal e-mail address or phone number.

3. Sources of Your Data

We obtain business contact information from the following sources:

  • Apollo.io: A third-party B2B data provider that our team uses to identify business contacts and obtain their business contact details (Apollo aggregates information from public sources: company websites, LinkedIn, business directories, press releases)
  • Public Business Registries: Romanian Trade Register (ONRC), company websites, public announcements
  • Manual Research by Our Team: The business contacts we deliver to clients are identified by our team from public sources — company websites, public LinkedIn profiles, public registries, and the press
  • AI-Assisted Web Research: Public information about the company (website, press, news) found through Google Search; this may include the names of its management or general contact details published by the company

Important: We only process information that is publicly available or obtained through legitimate B2B data providers. We do not purchase consumer data or scrape private social media profiles.

4. Why We Process Your Data

We process business contact information for the following purposes:

  • Lead Research for Clients: Our team identifies and delivers relevant companies and business contacts to our clients (companies in Romania), who may contact them for legitimate commercial purposes
  • Lead Generation: To help businesses find decision-makers at companies that may benefit from their products or services
  • Market Research: To provide insights about company structures, industries, and business trends in Romania
  • Contact Verification: To validate and maintain accuracy of business contact information
  • Drafting Assistance: To help clients prepare e-mails and calls to business contacts, using an AI service

We do NOT use your data for: Direct marketing to consumers, spam, unsolicited telemarketing, or any purposes unrelated to legitimate B2B commerce.

5. Legal Basis for Processing

Our legal basis for processing business contact data is Legitimate Interest under GDPR Article 6(1)(f):

Our Legitimate Interest: Providing a B2B lead-research service through which businesses in Romania identify and reach relevant business contacts for commercial purposes.

Balancing Test: We have conducted a Legitimate Interest Assessment (LIA) that balances:

  • Your Rights: Privacy, data protection, freedom from spam
  • Our Interests: Providing valuable B2B services to clients
  • Safeguards: Data minimization, opt-out mechanism, limited retention, quality filtering

You have the right to object to processing based on legitimate interest at any time. See Section 8 for how to exercise your rights.

6. Who Has Access to Your Data

Your business contact information may be shared with:

  • Our Clients: Businesses in Romania for which our team prepares lead lists. A client receives your contact details only if our team delivers them, for the company you work at — directly in their account or in a PDF dossier
  • Data Processors: Third-party service providers who help us operate the platform:
    • Apollo.io (B2B data provider, USA - adequate safeguards in place)
    • Neon Database (PostgreSQL hosting, EU/Frankfurt)
    • Hetzner Online (servers for data processing and PDF dossier generation, Germany)
    • Vercel (web application hosting; application logs are processed in the USA)
    • Cloudflare (network protection and the secure connection to our servers; traffic may transit Cloudflare's global network)
    • Google (Gemini API – AI assistance for company research and drafting prospecting messages; may process data outside the EEA). When a client generates an e-mail or call script, it receives the contact person's name and job title; it does not receive their e-mail address, phone number or LinkedIn profile.
    • Resend (delivery of e-mails related to GDPR requests)
  • Legal Authorities: If required by law or to protect our rights/property

We do NOT sell or rent your data to third parties.

6a. International Data Transfers

Some of our service providers process data outside the European Economic Area (EEA). We ensure your data is protected when transferred internationally:

Transfers to United States

We transfer personal data to the following US-based processors:

  • Apollo.io: Contact enrichment API (safeguarded by Standard Contractual Clauses or EU-US Data Privacy Framework)
  • Google (Gemini API): AI assistance: research on companies based on public information (name, tax ID, locality, activity) and drafting e-mails and call scripts for our clients. For the latter, the contact person's name and job title and the client's notes on previous interactions are sent. E-mail address, phone number and LinkedIn profile are not sent. Transfer safeguarded by the EU-US Data Privacy Framework, with Standard Contractual Clauses (SCC) as a fallback. Google does not use this data to train its models and keeps it for at most 30 days, solely to prevent abuse.
  • Resend: Transactional email delivery for DSAR notifications and password resets (safeguarded by Standard Contractual Clauses)
  • Vercel (logs): Application logs and monitoring (safeguarded by Standard Contractual Clauses)
  • Cloudflare: Network protection and the secure connection to our servers (safeguarded by the EU-US Data Privacy Framework, with Standard Contractual Clauses (SCC) as a fallback)

Transfer Safeguards

  • Standard Contractual Clauses (EC-approved contracts ensuring GDPR-level protection)
  • EU-US Data Privacy Framework certification (where applicable)
  • Encryption in transit (TLS) on every connection; the database is encrypted at rest
  • Data minimization – only what is necessary is sent (e.g. the AI service receives the contact person's name and job title, not their e-mail address or phone number)

For details about the transfer mechanism used for each vendor, contact us at the address above.

6b. When We Provide This Notice

Under GDPR Article 14, we must provide this notice within specific timeframes. However, we rely on an exception for disproportionate effort:

Why We Don't Send Individual Notices

Direct individual notification to every business contact in our database would be:

  • Disproportionately expensive relative to the number of contacts
  • Likely ineffective (most would be filtered as spam, <1% read rate)
  • Legally problematic (unsolicited emails may violate ePrivacy rules)

Alternative Transparency Measures: Instead, we make this notice publicly available on our website (accessible 24/7), provide an easy opt-out mechanism (DSAR form), and ensure data subjects can exercise their rights at any time. This approach is more effective and compliant with GDPR Article 14(5)(b) - disproportionate effort exception.

7. How Long We Keep Your Data

Company Data and Undelivered Contacts:

Company data obtained through research (for example, the business description, website, news) and business contacts identified but not delivered to any client (name and title) currently have no automatic deletion period. We keep them while the company remains in our database and delete them on request (see Section 8).

Contact Data Delivered to Clients:

When we deliver your contact details to a client, we keep them for 2 years from delivery. After 2 years, we automatically delete the e-mail address and phone number and stop displaying the LinkedIn profile; name and title remain visible to the client. Copies the client has already downloaded (for example, PDF dossiers) are under the client's control.

Opt-Out Records (Suppression List):

If you request suppression (opt-out), we keep the e-mail address, phone number and/or LinkedIn profile you asked us to suppress, together with cryptographic hashes of them, indefinitely and solely to honor that choice and prevent your data from being delivered again.

Delivery History and GDPR Requests:

We keep a history of the deliveries made by our team (which contact details were delivered, and to which client) and a record of the GDPR requests we receive. These currently have no automatic deletion period; we use them to answer access and erasure requests and to demonstrate compliance.

8. Your Rights Under GDPR

You have the following rights regarding your business contact data:

Right to Access (Art. 15)

Request a copy of all business contact data we hold about you, including sources and recipients.

Right to Rectification (Art. 16)

Correct inaccurate or incomplete contact information.

Right to Erasure (Art. 17)

Request deletion of your contact data from our systems.

Right to Object (Art. 21)

Object to processing based on legitimate interest. We will stop processing unless we have compelling legitimate grounds or legal obligations.

Right to Data Portability (Art. 20)

Receive your data in a structured, machine-readable format (JSON/CSV).

Right to Restriction (Art. 18)

Request temporary restriction of processing (e.g., while we verify accuracy).

How to Exercise Your Rights

To exercise any of these rights, you can:

Response Time: We will respond to your request within 30 days (extendable to 3 months for complex requests, with notification).

Verification: We may ask for identification proof to prevent unauthorized access (e.g., email verification, LinkedIn profile confirmation).

9. Quick Opt-Out (Suppression)

Want to remove your contact information immediately?

You can request to be added to our suppression list, which will:

  • Prevent your contact data from being delivered to our clients
  • Prevent us from obtaining your e-mail address and phone number from our data providers
  • Suppression does not delete data already delivered. To have it deleted from our systems, submit an erasure request (Art. 17) through the DSAR form

→ Request Suppression (Opt-Out)

10. Right to Lodge a Complaint

If you believe we have not handled your data properly, you have the right to lodge a complaint with:

Romanian Data Protection Authority (ANSPDCP):

  • 📍 Address: Bulevardul General Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania
  • 📧 Email: anspdcp@dataprotection.ro anspdcp@dataprotection.ro
  • 🌐 Website: www.dataprotection.ro www.dataprotection.ro
  • 📞 Phone: +40 21 252 5599

We encourage you to contact us first so we can address your concerns directly.

11. Changes to This Notice

We may update this notice periodically to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website. The "Last Updated" date at the top of this page indicates when the most recent changes were made.

Questions or Concerns?

We are committed to transparency and respecting your privacy rights. If you have any questions about this notice or our data practices, please contact us.

Submit DSAR RequestContact Us via Email