Your data is safe. Full stop.

Yes. The SOC 2 Type 2 report and the ISO 27001 certificate are available to satisfy audit obligations. Request them through your account manager or during a security review.

Only what’s needed: full name, job title, email address, phone number, and LinkedIn profile. Processing is limited to contacts matching your approved ICP and buyer personas, in line with GDPR data minimisation principles.

Legitimate interest under Article 6(1)(f) of the GDPR, which Recital 47 contemplates for direct marketing. 2 gates run before any external source is called: the company has to match the profile you approved, and the person a persona you defined. The reason each contact passed is recorded at that moment, so the basis is specific to the individual.

Article 14 applies where personal data came from somewhere other than the person, and it asks for 9 pieces of information, not 3 or 4. Most are facts about your own organisation: who you are, your DPO, your retention criteria, the rights, the right to complain, and the timing. Three are facts about the individual record and cannot be reconstructed later: the legitimate interest relied on, the categories of data held, and the source it came from. Evergrowth records those 3 against every contact at the moment it qualifies. Our GDPR guide for B2B outbound maps every item to its article and gives a notice template for the rest, and the data flow page shows the full table.

The Play Agent that writes your outreach can carry it, so the notice travels with the first message rather than depending on a rep to remember. It is not on by default, because 6 of the 9 Article 14 items are facts about your organisation that we do not hold. Add those to the Play Agent instructions once, with the wording from our guide, and every first-touch message carries it from then on.

Individuals keep their full rights under Articles 15 to 21, including the right to object under Article 21. You are the controller, so the request reaches you, and our DPA commits us to assist you in giving effect to it. Because every contact carries the reason it qualified and the source it came from, the answer does not have to be reconstructed.

A database gives you the record. It does not give you the reason. Article 14(2)(b) of the GDPR obliges you to tell a person which legitimate interest you relied on, for that individual and not as a general policy. Here it is generated and stored at the moment the contact qualifies. From a purchased list or a browser extension it has to be reconstructed by hand afterwards, if it can be at all.

You choose: data is returned or deleted. If no request is made, all personal data is permanently deleted within 30 calendar days of termination.

No provider uses your data to train or improve their models. Our default routing is AWS Bedrock, which does not store prompts or completions. Where another provider handles a request, data may be retained briefly for abuse monitoring under that provider's published terms, and is never used for training.

Only when necessary to provide the service, and always using Standard Contractual Clauses (SCCs) or equivalent safeguards under GDPR Chapter V.

Yes. A GDPR-compliant Data Processing Agreement is included as a standard annex in every customer contract.

System prompts are versioned and loaded server-side. Third-party content (web pages, CRM records, search results) is delimited as data, never concatenated into instructions. Outputs are bound to typed schemas, so an injected directive cannot reach a downstream system as free-form text.

Microsoft Azure AI Foundry, AWS Bedrock (Anthropic), the OpenAI Enterprise API, and Google AI Studio. All operate under contractual terms that prohibit training on your data. No consumer endpoints, and no providers in non-aligned jurisdictions.

No. Our agents perform B2B research, qualification, and copy generation. They do not make decisions in the Annex III high-risk domains (employment, credit scoring, law enforcement, education access). A human reviews any action that affects external parties.

Yes. Our data flow overview sets out what we process, who receives it and where it runs. Beyond that, we will walk your team through the architecture under NDA, alongside the SOC 2 Type 2 report and the ISO 27001 certificate.