How we use business contact information

This notice explains how we handle the contact details of people we approach in a business capacity. It applies if you received an email or a LinkedIn message from us and we had not been in touch before.

Our main privacy policy covers visitors to this website. This notice covers information about you that we obtained from someone other than you.

Nima Project Ltd, trading as NimaProject
3rd Floor, 86-90 Paul Street, London EC2A 4NE
Company number 13152926, registered in England and Wales
Email: [email protected]

We are the data controller for the information described in this notice. We are not required to appoint a Data Protection Officer, so please send any question about this notice to the address above.

We contact people whose role makes our services relevant to their organisation. Those services are brand, product design, web and software engineering.

Before writing to anyone, we look at their organisation's public website and identify one specific, verifiable observation about it. That observation is what we offer to share. We do not send untargeted bulk email, and no decision about you is taken solely by automated means.

About you, we hold your name, job title, employer, work email address and LinkedIn profile URL.

About your organisation, we hold public information such as website performance measurements from Google PageSpeed Insights, the technology the site is built on, and published funding or hiring announcements.

We hold no personal email addresses and no home addresses. We do not seek out or record special category data, such as information about health, political opinions, religious beliefs or trade union membership.

Your details came from one or more of the following sources.

• Your organisation's own website, such as a team or contact page. Publicly accessible.
• Your LinkedIn profile, to the extent that it is public. Publicly accessible.
• Companies House, the UK public register of companies, which we use to confirm a company's legal status. Publicly accessible.
• Clay, a business data provider that licenses professional contact information and aggregates it from public and commercial sources. Not a publicly accessible source.

The first email we send you names the source your details came from.

We rely on legitimate interests, under Article 6(1)(f) of the UK GDPR. Article 6(11)(a) gives direct marketing as an example of processing that may be necessary for a legitimate interest. That does not make it automatically lawful, so we have carried out and recorded a balancing assessment.

Our interest is in marketing our services to organisations that may benefit from them. We concluded that this interest does not override your rights, for four reasons:

• We contact you in a professional capacity only, at your place of work.
• We write to you about matters that fall within your role.
• We hold the minimum information needed to make contact.
• We give you an immediate and permanent way to stop.

We can provide a summary of that assessment on request.

We do not send marketing messages to sole traders or to unincorporated partnerships. We do not send marketing messages to anyone in a country whose law requires consent before we may write.

Three parties see this information:

• Clay, the business data provider named above, which we also use to organise our own records.
• Our email delivery platform, which sends our messages and records replies and opt-outs. We will tell you which provider this is if you ask.
• Our own internal records, which only our team can access.

No one else has access. We do not sell your details, and we do not pass them to anyone for their own marketing.

Clay is based in the United States, which does not have general adequacy status under UK law. Transfers to Clay rely on the Standard Contractual Clauses in our agreement with them. We will confirm the arrangements for our email delivery platform when we tell you which provider it is. You can ask us at any time for details of the safeguards that apply to your information.

• If you reply or engage with us: 24 months from our last contact with you.
• If you never engage: 12 months from the end of the sequence. A sequence is at most three messages.
• If you ask us to stop: we delete everything except your email address and organisation name. We keep those two items indefinitely on a suppression list, so that we never contact you again.

You can tell us to stop contacting you at any time, and we will stop. Reply “stop” to any email from us, or write to [email protected]. We remove you the same working day and we do not write to you again.

You can also ask us to:

• give you a copy of the information we hold about you
• correct it, if any of it is wrong
• delete it
• restrict how we use it
• stop using it for any other reason connected to your particular situation

The right to data portability does not apply here. That right covers information you gave us yourself, under a contract or with your consent, and neither applies to your details.

If you are unhappy with how we have handled your information, please complain to us first at [email protected]. We will acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

We give you this notice in the first message we send you, and in any event within one month of obtaining your details.