ATTN PLEASE LTD ("we", "us", "our") provides a B2B contact intelligence and outreach support platform to business customers. This notice explains what personal data we hold about business contacts, how we obtained it, what we do with it, and the rights you have over it.
1. Who we are
Controller: ATTN PLEASE LTD
Contact for data protection matters: support@bamya.co
We are established in the United Kingdom and our processing is primarily governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we process the personal data of individuals located in the European Union (in particular, business contacts in Bulgaria), the EU General Data Protection Regulation also applies to that processing.
2. What personal data we hold
We collect and hold the following categories of business-context personal data about individuals in their professional capacity:
- Identity and role: full name, job title, employer name.
- Business contact details: work email address, LinkedIn profile URL, and a company telephone number where one is publicly listed. We do not collect, infer, or supply personal or direct-dial telephone numbers for individuals.
- Profile photograph as published on the individual's public LinkedIn profile.
- Business-context summaries generated from the individual's recent public LinkedIn activity. We do not retain the original posts. An automated process reads the individual's recent public posts and extracts only business-relevant signals (such as role changes, company announcements, professional achievements, or industry-related commentary). Personal content (including but not limited to health, family, politics, religion, and lifestyle topics) is excluded from the summary by design. The original posts are not stored after summarisation.
- Company-level information about the individual's employer: industry, headcount, revenue band, registered address, ownership and director information from public company registers (Companies House in the United Kingdom, and the Bulgarian Commercial Register where applicable), and recent news mentions from public sources.
We do not intentionally collect special category data (such as health, political opinions, religious beliefs, or trade-union membership). Our summarisation process is specifically designed to exclude such categories from the data we retain.
3. Where we obtained your data
How your record came to exist. There are three ways a business contact reaches our platform, and how much we hold about you depends on which applies:
- As a researched lead. We selected the company and the contact against a customer's agreed brief, then researched and enriched the record ourselves. This is where we hold the most: role, company context, a business-relevant summary of recent public activity, and a verified business contact channel.
- As a personal lead. Our customer already knew of you and gave us your name and the address of your public LinkedIn profile. We extract publicly available information from that profile and hold it against the record. We do not research you or your employer beyond that profile, and we do not assess whether you are a fit for anything.
- As a potential lead. We supplied a customer with a list of people on LinkedIn who appeared close to the kind of contact they were looking for. Such an entry holds only what identifies the person on LinkedIn. We do not research, verify, or enrich it, and it becomes a researched lead only if the customer later asks us to research it.
Your data was obtained from one or more of the following sources:
- Public LinkedIn profiles - accessed via automated tools that read pages publicly accessible on the LinkedIn website without logging in to any LinkedIn account.
- Apollo.io - a third-party B2B contact data provider whose database includes professional contact information aggregated from public and partner sources.
- Public company registers - Companies House in the United Kingdom, and the Bulgarian Commercial Register (Търговски регистър), together with the filings published on them.
- Company websites and blog posts.
- Publicly available news coverage and press releases.
- Publicly accessible business directories, review sites, and event listings.
- Public social media pages, including public company pages on Facebook. We read pages that are publicly accessible without logging in; we do not access private profiles, groups, or restricted content.
- General web search - to locate the public sources listed above.
- Email-pattern inference - where a company's standard email format is publicly known, we may construct a likely email address from that format combined with the individual's name, and verify deliverability before that address is used.
4. Why we hold your data and our lawful basis
We process your data for the following purposes:
- To maintain a database of business contacts and their employers that our customers can use to identify potential business counterparties for legitimate B2B offers.
- To provide our customers with research, context, and message drafts to support targeted, relevant business outreach to those contacts.
- To support our customers in operating outreach campaigns in line with our outreach doctrine, which restricts contact to a small number of relevant individuals per company and prohibits bulk or untargeted messaging.
Our lawful basis for this processing is legitimate interests under Article 6(1)(f) of the UK GDPR (and EU GDPR where applicable). The legitimate interests in question are our own commercial interest in operating the platform and our customers' interest in conducting lawful B2B outreach to relevant decision-makers.
We have carried out a balancing test and concluded that this processing does not override your interests, rights, and freedoms, on the basis that:
- the data concerns you in your professional capacity, not your personal life;
- the data is drawn from sources where you have made the information available in a professional context, or which exist as public registers of business information;
- we apply data minimisation in practice: we do not retain raw social media content, and our summarisation process is designed to exclude personal and sensitive topics from the data we hold;
- the processing supports communication that is, by design, targeted, relevant, low-volume, and capable of being stopped on request;
- you have the right to object to the processing at any time, as set out below.
A summary of our legitimate interests assessment is available on request.
5. Who we share your data with
We do not sell personal data.
We share data with the following categories of recipient:
- Our customers - businesses who have engaged us to support their B2B outreach. Each customer is provided only with contact information relevant to their specific outreach campaign. In data protection terms our customers are independent controllers, not our processors: once data reaches them, they decide whether, when and how to make contact, and they answer for that decision. Our Terms and Conditions require each customer to carry out its own legitimate interests assessment before contacting anyone, to honour objections immediately and tell us within 5 working days, to forward any request you make to us within the same period, and to delete the data within 24 months of receiving it.
- Our hosting and infrastructure providers - in particular Microsoft Azure (United Kingdom region), which hosts our platform and database.
- Our data sources, where relevant - for example, where Apollo.io or other providers are used as part of our enrichment process.
- Our AI providers - the platform's AI features send the text they work on to one of these, depending on the feature: Google, through its Gemini API; OpenAI; Anthropic; and TypeSafe AI, which helps our in-app assistant decide how to answer a question and reads e-mails our customers share with the platform to suggest what they might do next (section 10).
- For Bamya Call, our call companion - Soniox, Inc. receives live call audio, streamed from your browser, for speech recognition and translation, and Google LLC, through Vertex AI, receives transcripts and prompts for all of its AI features, both primarily in the European Union. We use Vertex AI on a paid Google Cloud project, under which submitted content is not used to train Google's models. Bamya Call's own Privacy Policy has the details.
- Regulators, law enforcement, or legal advisers where we are required to do so by law or where it is necessary to establish, exercise or defend legal claims.
6. International transfers
Our primary data storage is in the United Kingdom (Microsoft Azure UK region). The United Kingdom and the European Union have mutual adequacy decisions in place, so transfers between them do not require additional safeguards.
Where personal data is transferred outside the UK or EEA in the course of using sub-processors (for example, where a vendor has support staff in another jurisdiction), we rely on appropriate safeguards including the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK addendum, or applicable adequacy decisions.
7. How long we keep your data
We retain business contact records for up to 24 months from the last meaningful activity associated with that record (for example, the last time a customer engaged with the contact through our platform). After this period, the record is either deleted or anonymised so it can no longer be linked to you.
Separately from our own retention, our customers are required under our Terms and Conditions to delete data we supply within 24 months of delivery, to review what they still hold at least once every 12 months, and to delete your data from their active systems within 30 days if you object. Deleting your record from our platform does not by itself remove it from a customer's own systems, so if you want it gone everywhere, tell us and we will pass the request on.
If you exercise your right to object to processing (see below), we will retain a minimal record of your identity and contact details on a suppression list for the sole purpose of ensuring you are not re-contacted. This suppression record is kept indefinitely or until you ask us to delete it.
8. Your rights
Under UK GDPR (and EU GDPR where applicable), you have the following rights in relation to your personal data:
- Right to be informed - this notice is part of how we satisfy that right.
- Right of access - you can ask us for a copy of the personal data we hold about you.
- Right to rectification - you can ask us to correct inaccurate or incomplete data.
- Right to erasure - you can ask us to delete your data, subject to some exceptions (for example, the limited suppression-list retention described above).
- Right to restrict processing - you can ask us to limit how we process your data while a query is being resolved.
- Right to data portability - applies in limited circumstances; ask us if you wish to exercise it.
- Right to object to processing - you have a particular right to object to processing carried out on the basis of legitimate interests, including the processing described in this notice. If you object, we will stop processing your data for outreach purposes and add you to our suppression list.
- Right to lodge a complaint with a supervisory authority - in the UK this is the Information Commissioner's Office (ICO, ico.org.uk). If you are located in Bulgaria or another EU member state, you may complain to your local supervisory authority; in Bulgaria this is the Commission for Personal Data Protection (CPDP, cpdp.bg).
To exercise any of these rights, contact us at support@bamya.co. We will respond within one month. We do not charge a fee for handling reasonable requests.
You do not need to give a reason when objecting to processing or asking to be removed.
9. Automated decision-making
We do not make decisions about you that produce legal or similarly significant effects on you using solely automated means.
10. Information our customers add themselves, including e-mails they share
Our customers can also put information into their own Bamya account themselves: they add or import people and companies, write notes, and can share e-mails with the platform. For this information our customer is the controller, and we process it on its behalf as its processor. Our customer decides what to add or share, and answers for having a lawful basis to do so. We keep what it gives us; we do not check whether it was entitled to give it.
E-mails our customers share. A customer's users can copy us (Bcc) into an e-mail they send, forward an e-mail to us, or set a mail rule that passes e-mails on to us, using an address we give them. If you exchange e-mails with one of our customers, your messages may be among them. Each such e-mail is recorded in that customer's account, against the person or company it concerns. Our customer is responsible for what reaches us, including what a mail rule or automatic forwarding it set up sends.
- What we keep: the names and addresses of the sender and the recipients, the subject, the date and the text. Of an attachment we keep only its name, size and type, never the file itself.
- What we do not keep: our mail server accepts e-mails only from the addresses of our customers' own users. An e-mail that a mail rule passes on is kept only when it replies to a conversation the customer has already shared with us or, where the customer has chosen this, when it comes from someone already in its records. Any other e-mail is deleted as it arrives; we keep only which address sent it, to which address, when and why, for 30 days. The original message file of an e-mail we do keep is deleted after 30 days.
- We never write to you from this address: it only receives e-mail.
- Automated reading: TypeSafe AI reads the newest part of a recorded e-mail once, to suggest to our customer what it might do next, such as starting a deal or adding a task. Google, through its Gemini API, reads an e-mail only when a person at our customer asks it to, for example to read a proposed meeting time. These suggestions are not decisions about you: they are buttons a person at our customer may press, or reminders in its own task list.
- Requests to the assistant: a person at our customer may e-mail their assistant address a request, such as a change to make or a question about their records, sometimes above an e-mail they forward. The in-app assistant prepares it: the request, the forwarded e-mail and the names of the records it concerns are sent to our AI providers (Google, through its Gemini API, and Anthropic). A forwarded e-mail's words are read as information only, never as instructions, and nothing is changed until that person presses Apply.
- How long: until our customer deletes the e-mail, or the record it is filed on, in its Bamya account, or until its account closes; then we delete it, save where the law requires us to keep it. Deleting the e-mail from a mailbox does not delete our copy.
To exercise your rights over information a customer has added or shared, contact that customer, because it decides about it. You may also write to us at support@bamya.co, and we will pass your request on and help the customer answer it.
11. Changes to this notice
We may update this notice from time to time. The date at the top of this page shows when it was last revised. Material changes will be reflected in an updated version published at the same web address.
12. Contact
For any question about this notice or about how we handle your data, write to:
ATTN PLEASE LTD
support@bamya.co