1. Background: What the GDPR Is
The General Data Protection Regulation (GDPR) came into force on 25 May 2018 and remains the cornerstone of data protection law across the European Union and the United Kingdom (via the UK GDPR). It sets out detailed rules governing how organisations may collect, store, use, share, and eventually delete personal data belonging to individuals.
The regulation applies not only to companies established within the EU, but also to any organisation, anywhere in the world, that processes personal data belonging to individuals located in the EU — which is directly relevant to TargetWise, given that our platform enriches business contact records for organisations operating across multiple jurisdictions, including within the EU and UK.
2. Why the GDPR Matters
The GDPR introduced some of the most significant changes to data protection law in a generation. For organisations that fail to comply, the consequences can be severe:
- Fines of up to 4% of total worldwide annual turnover, or €20 million — whichever figure is higher.
- Mandatory breach notification requirements, including notifying supervisory authorities within 72 hours of becoming aware of a qualifying breach.
- Expanded rights for individuals, including the right to access, correct, restrict, object to, and erase their personal data (the so-called "right to be forgotten").
- A requirement that privacy be considered "by design and by default" — meaning data protection safeguards must be built into systems and processes from the outset, not added as an afterthought.
At its core, the GDPR reflects a simple but powerful idea: individuals should have meaningful control over their own personal information, and organisations that process that information carry real responsibility for protecting it.
3. How TargetWise Applies the Six Principles of the GDPR
Article 5 of the GDPR sets out six core principles that govern all processing of personal data. Below, we explain in detail how TargetWise applies each of these principles to the way we operate our B2B contact enrichment platform.
a. Lawfulness, Fairness, and Transparency
The GDPR recognises six possible lawful bases for processing personal data: consent, contract, legal obligation, vital interests, public task, and legitimate interest. Each basis is suited to different types of processing activity.
Consent is often the most familiar basis to consumers, but it is not always the most appropriate one for a B2B data enrichment service like TargetWise, since much of what we process is professional contact information rather than sensitive personal data, and obtaining individual consent from every business contact in a database would be impractical and, in many cases, would undermine the value of the service to our customers. For this reason, TargetWise relies primarily on legitimate interest as the lawful basis for our core enrichment activities.
Relying on legitimate interest is not a decision we take lightly. Under the GDPR, an organisation must satisfy a three-part test before it can rely on this basis:
- Purpose test — Is there a genuine and legitimate reason for the processing?
- Necessity test — Is the processing genuinely necessary for that purpose, and is there a less intrusive way to achieve it?
- Balancing test — Do the interests of the organisation override the rights and freedoms of the individuals concerned?
We have carried out and documented a full Legitimate Interests Assessment (LIA), which is summarised below.
TargetWise's Legitimate Interests Assessment
Purpose of processing
TargetWise has a legitimate interest in processing professional contact information — including full names, job titles, employer names, and business contact details such as work email addresses and phone numbers — belonging to employees, managers, and decision-makers at companies around the world. This data is compiled from a combination of publicly available sources (such as company websites, professional networking profiles, and public business directories) and enriched using our proprietary matching technology, which cross-references minimal input data (such as a name and company) against these sources to return verified, complete contact records.
Lawful business objective
Our processing supports a clearly defined and lawful business objective: enabling our customers — sales teams, marketing departments, and revenue operations teams — to enrich incomplete contact records so they can reach the right people with relevant business communications. This type of activity is expressly recognised as a legitimate business objective under the Privacy and Electronic Communications Regulations 2003 (PECR), and Recital 47 of the GDPR specifically states that the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest, provided appropriate safeguards are in place.
Reasonable expectation
The data subjects included in our enrichment database are, by definition, individuals acting in a professional capacity — employees, managers, and executives whose job titles, employers, and business contact details are often already publicly disclosed by their employer, on professional networking platforms, or in company directories. Such individuals can reasonably expect that their professional contact information may be used by other businesses for legitimate commercial outreach relevant to their role, particularly where that information is already in the public domain.
Necessity and proportionality
We limit the categories of personal data we collect and process to what is genuinely necessary to deliver our service: full name, job title, employer name, business email address, and business phone number. We do not seek to collect or enrich sensitive categories of personal data (such as health information, religious beliefs, or political opinions), nor do we collect personal contact details unrelated to a person's professional role, such as home addresses or personal mobile numbers, except where a business has knowingly provided such information as part of its own contact records.
Keeping data accurate and current
Where a registry, public source, or customer feedback indicates that a person has changed roles, changed employer, or left the workforce entirely, we take reasonable steps to update or remove the relevant contact details from our active enrichment database, so that outdated information is not repeatedly surfaced to our customers.
Your right to object and opt out
Any individual has the right to ask that their personal data be removed from our enrichment database. Where such a request is received, we will suppress the relevant record so that it cannot be re-added to our active database at a later date through subsequent enrichment or data refresh processes.
The balancing test — why we believe this processing is justified
Weighing the interests of the individuals concerned against the legitimate interests of TargetWise and our customers, we believe the balance favours processing, for the following reasons: the data processed is limited to professional, business-context information; the individuals concerned can reasonably anticipate this type of processing given their public professional role; individuals retain a clear and effective right to object or opt out at any time; and the resulting service provides substantial value to the wider economy by allowing businesses to communicate efficiently and accurately with genuine points of contact, reducing the volume of misdirected, poorly targeted, or repetitive marketing communications that would otherwise result from reliance on outdated or incomplete data.
b. Purpose Limitation
Personal data processed by TargetWise is collected and used for one specific, clearly defined, and legitimate purpose: to build, maintain, and continuously refresh a database of verified professional contact information, which our customers use to enrich their own sales and marketing records for business-to-business outreach. We do not process this data for any purpose incompatible with this original purpose, and we do not sell or share this data for purposes unrelated to legitimate business enrichment and marketing use cases.
c. Data Minimisation
We apply data minimisation at every stage of our platform's design. The categories of personal data we collect and enrich are limited strictly to what is necessary to deliver accurate business contact enrichment: full name, job title, employer name, business email address, and business phone number. We do not collect unnecessary personal details, and our matching algorithms are designed to return only the specific data fields requested by our customers for each enrichment query, rather than exposing broader profile information than necessary.
d. Accuracy
TargetWise takes reasonable and ongoing steps to ensure that the personal data in our enrichment database is accurate and kept up to date. Our matching technology cross-references multiple independent sources to improve confidence in the accuracy of each match, and we continuously refresh records as new public information becomes available. Where an individual identifies that their information is inaccurate or out of date, they have the right to request that we correct or update it without undue delay.
e. Storage Limitation
We do not retain personal data indefinitely. When we become aware that an individual has changed roles, changed employer, or is no longer contactable at the details we hold, we take reasonable steps to remove or update the relevant record. Where an individual requests removal from our database, we retain only the minimal information necessary to ensure that the same data is not inadvertently reintroduced into our systems through a future data refresh (a process known as suppression).
f. Integrity and Confidentiality (Security)
We recognise that maintaining appropriate security over the personal data we process is a fundamental obligation under the GDPR. TargetWise applies technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction, or damage. Access to enrichment data is limited to customers using it for legitimate business purposes consistent with the professional role of the individuals concerned, and our infrastructure incorporates encryption, access controls, and monitoring designed to safeguard the data we hold.
4. Your Rights Under the GDPR
As a data subject, you have a number of rights in relation to the personal data we hold about you. These include:
- The right to be informed — to understand how your data is collected and used, as set out in this notice and our Privacy Notice.
- The right of access — to request a copy of the personal data we hold about you.
- The right to rectification — to have inaccurate or incomplete data corrected.
- The right to erasure — to request that we delete your personal data, subject to certain legal exceptions.
- The right to restrict processing — to ask us to limit how we use your data in certain circumstances.
- The right to object — to object to processing based on legitimate interest, including for direct marketing purposes.
- The right to data portability — to receive your data in a portable format, where applicable.
- Rights relating to automated decision-making — TargetWise does not use fully automated decision-making that produces legal or similarly significant effects on individuals without human involvement.
To exercise any of these rights, please contact us using the details on our Privacy Notice page. We aim to respond to all valid requests within one month, as required under the GDPR.
5. Supervisory Authority
If you believe your personal data has not been handled in accordance with the GDPR, you have the right to lodge a complaint with the relevant supervisory authority in your country of residence, place of work, or the place where the alleged infringement occurred. We would, however, appreciate the opportunity to address your concerns directly first — please contact us before escalating a complaint, so we can try to resolve the issue.
