Outreach privacy notice

1. Why you are reading this

This notice gives you the information the UK GDPR requires when we have not collected your details from you. The UK GDPR requires us to give you this information within a reasonable time after we get your details and at the latest within one month, and, if we use your details to write to you, at the latest when we first write to you. We link to this notice in our first email to you.

2. Your right to object

You can object at any time to our use of your details for direct marketing. When you do, we stop using them for marketing. You do not need to give a reason.

To object, reply to any of our emails with "stop", or in any other words. We then put your email address on our stop list, so that we do not write to you again. We act on it within two working days.

3. Who we are

Tamazia Ltd is the controller of your personal data. We are a company registered in England and Wales, company number 17295579, with our registered office at 124 City Road, London, EC1V 2NX. We are a compliance-first SEO and AI search agency for regulated firms.

For anything about your data, reply to any of our emails, write to contact@tamazia.co.uk, or use the contact form on our website. Post sent to our registered office also reaches us.

4. What we hold about you

• Your work contact details: your name, your work email address and your job title, where we have them.
• The name of the firm you work for, its website, its sector and its country, and any notes we make about its website when we prepare our email.
• The emails we send you and any replies you send us.
• Whether you have asked us to stop, and when.

We do not put tracking pixels in our emails, and we do not track which links in them you click.

If an email links to a review of your firm's website on our site, our database records how many times that page is opened and when it was last opened, against our record for your firm. Our server may also send PostHog, our analytics provider, an event saying the page was opened, with your firm's website address as its identifier.

5. Where we got it

We did not get your details from you. We got them from information that is publicly available about your firm, such as its own website and the public register of its regulator (for example the SRA or the CQC), from Companies House, and from work contact databases and web search tools that find work email addresses at a firm. To ask which source gave us your details, reply to any of our emails.

6. Why we use it, and our lawful basis

We use your details to decide whether our services are relevant to your firm, and to write to you, at work, to offer a free review of how your firm's website appears in search and AI search and which rules apply to it.

Our lawful basis is legitimate interests. The UK GDPR names direct marketing as an example of processing that may be necessary for a legitimate interest.

Our interest is telling regulated firms about a service that may help them. We believe this does not override your interests, because the details are about your job rather than your private life, people in your role can expect business offers about their firm's website, and you can stop our emails at any time with one reply. Our written assessment of this balance is available on request.

If you send us a message or ask for the free review through a form on our website, the details you give us there are also covered by our main privacy notice. Our website's code handles each such form as follows; a step runs only where the service it uses is connected. Before anything is stored, your email address is sent to an email checking service to test that it can receive mail: the first of ZeroBounce, Reoon, NeverBounce and Hunter that is connected and answers. Cloudflare stores the whole form for two years, with a shortened IP address, your country and your browser details. Our Neon database stores it in a table of leads and in a log of form submissions, with a one-way hash of your IP address. Resend sends an email alert containing the whole form to a personal Gmail account of our director, and sends you an acknowledgement. Slack and Telegram receive a message with your name, company, email address, sector, country, a shortened IP address, your type of device and the page you came from; Slack also receives the whole form, and Telegram your message. Notion receives an entry with your name, email address, company, sector and message. Our server sends an event to PostHog, our analytics provider, with your email address as its identifier, whatever you chose about cookies.

7. The email rules we follow

In the UK, we email only people at companies and limited liability partnerships. Because your work address belongs to a company or LLP, PECR does not require your consent before we email you. PECR does still forbid marketing email that hides who sent it, that gives no valid address where you can ask for such email to stop, or that breaks regulation 7 of the Electronic Commerce Regulations 2002, and it forbids marketing email that encourages you to visit websites that break that regulation. Regulation 7 says each such email must be clearly recognisable as a commercial communication, must say who it is from, and must make the conditions of any promotional offer, such as an offer of a free review, easy to find. The same regulations also say that marketing email sent without being asked for must be clearly recognisable as such as soon as it arrives.

PECR treats sole traders and partnerships, other than LLPs and Scottish partnerships, as individuals: we could email them only with their consent, or if they had bought or asked about similar services from us and were given a simple way to refuse. We do not send them cold email.

If you are in the US, the CAN-SPAM Act also applies: each email must say clearly that it is an advertisement and give a valid physical postal address and a working way to opt out, we must honour your opt out within 10 business days, and, once you opt out, we must not sell or pass on your address.

Our email policy sets out what we do before we send any cold email.

8. Who sees your data

We do not sell your data.

The companies that handle your details for us provide the tools we use to find work contact details, to check that an address can receive email and to send our emails, the mailboxes that hold our emails and your replies, this website, and our database. They include:

• Google Workspace, run by Google. It holds the mailboxes we send from, with the emails we send and your replies.
• Cloudflare, Inc. (United States). It runs this website, and it receives email sent to our tamazia.co.uk addresses and passes it on to the mailbox where we read it.
• Neon, a US database provider. It hosts our database, which is stored in Frankfurt, Germany. The database holds our stop list, and it has tables for the firms and people we may contact, the emails we send, where each person is in a series of emails, and the replies we receive. Our contract for it is with Databricks, Inc., the parent company of Neon, LLC.
• Mystrika, a service of Fresent LLC (United States). It warms up our sending mailboxes and has access to the email in them, including your replies.

9. Transfers outside the UK

Some of the companies above handle your details outside the UK. Cloudflare may handle them in the United States, India and Singapore as well as the UK, and Google and Mystrika in the United States. Our Neon database is stored in Frankfurt, Germany, which UK adequacy regulations cover, with any access from the United States covered by the EU standard contractual clauses with the UK Addendum in the Databricks data processing addendum that Neon's terms incorporate. Where a transfer is not covered by UK adequacy regulations, the UK GDPR allows it only with appropriate safeguards, such as standard data protection clauses, or under one of a few narrow exceptions. For Cloudflare, the safeguards are the EU standard contractual clauses with the UK Addendum in Cloudflare's data processing addendum, and Cloudflare states that it complies with the UK Extension to the EU-US Data Privacy Framework, which UK adequacy regulations cover. To ask which safeguard applies to a company, and for a copy of it, reply to any of our emails.

10. How long we keep it

We keep your contact record and our emails with you only for as long as we may still write to you about our services or are in touch with you, and then delete them.

• If you do not reply, we delete your contact record 12 months after the last email we sent you.
• If you reply, we keep our emails with you for 24 months after our last exchange, unless you become a client, when our main privacy notice applies.
• If you ask us to stop, your email address stays on our stop list with no end date. We keep it only so that we never email you again.

11. Your rights

You have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict how we use it, and to object to our use of it. The right to data portability does not apply here, because it covers only data you gave us yourself that we use with your consent or under a contract.

To use any of these rights, reply to any of our emails or write to contact@tamazia.co.uk. We answer rights requests free of charge and without undue delay. If you ask us to delete your data, we still keep your email address on our stop list, so that we do not contact you again.

We do not make decisions about you by automated means that have a legal or similarly significant effect on you.

12. Complaints

If you are unhappy with how we have used your data, reply to any of our emails or write to contact@tamazia.co.uk. You can complain to us first, and we will acknowledge your complaint within 30 days.

You can also complain to the Information Commission (the ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint.

13. Changes to this notice

If we change this notice, we will update the date at the top.