Privacy Notice

Last updated: 15 October 2026

ATTN Please ltd ("we", "us", "our") provides a B2B contact intelligence and outreach support platform to business customers. This notice explains what personal data we hold about business contacts, how we obtained it, what we do with it, and the rights you have over it.

This notice is written for business contacts whose information appears in our platform - typically employees, owners, or representatives of companies that our customers may wish to contact about business offers. If you are a customer of our platform (an operator using it to run outreach), our Terms and Conditions govern your engagement and your account data.

1. Who we are

Controller: ATTN Please ltd
Contact for data protection matters: yavo@bamya.co

We are established in the United Kingdom and our processing is primarily governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we process the personal data of individuals located in the European Union (in particular, business contacts in Bulgaria), the EU General Data Protection Regulation also applies to that processing.

2. What personal data we hold

We collect and hold the following categories of business-context personal data about individuals in their professional capacity:

Identity and role: full name, job title, employer name.
Business contact details: work email address, LinkedIn profile URL, and a company telephone number where one is publicly listed. We do not collect, infer, or supply personal or direct-dial telephone numbers for individuals.
Profile photograph as published on the individual's public LinkedIn profile.
Business-context summaries generated from the individual's recent public LinkedIn activity. We do not retain the original posts. An automated process reads the individual's recent public posts and extracts only business-relevant signals (such as role changes, company announcements, professional achievements, or industry-related commentary). Personal content (including but not limited to health, family, politics, religion, and lifestyle topics) is excluded from the summary by design. The original posts are not stored after summarisation.
Company-level information about the individual's employer: industry, headcount, revenue band, registered address, ownership and director information from public company registers (Companies House in the United Kingdom, and the Bulgarian Commercial Register where applicable), and recent news mentions from public sources.

We do not intentionally collect special category data (such as health, political opinions, religious beliefs, or trade-union membership). Our summarisation process is specifically designed to exclude such categories from the data we retain.

3. Where we obtained your data

How your record came to exist. There are three ways a business contact reaches our platform, and how much we hold about you depends on which applies:

As a researched lead. We selected the company and the contact against a customer's agreed brief, then researched and enriched the record ourselves. This is where we hold the most: role, company context, a business-relevant summary of recent public activity, and a verified business contact channel.
As a personal lead. Our customer already knew of you and gave us your name and the address of your public LinkedIn profile. We extract publicly available information from that profile and hold it against the record. We do not research you or your employer beyond that profile, and we do not assess whether you are a fit for anything.
As a potential lead. We supplied a customer with a list of people on LinkedIn who appeared close to the kind of contact they were looking for. Such an entry holds only what identifies the person on LinkedIn. We do not research, verify, or enrich it, and it becomes a researched lead only if the customer later asks us to research it.

Your data was obtained from one or more of the following sources:

Public LinkedIn profiles - accessed via automated tools that read pages publicly accessible on the LinkedIn website without logging in to any LinkedIn account.
Apollo.io - a third-party B2B contact data provider whose database includes professional contact information aggregated from public and partner sources.
Public company registers - Companies House in the United Kingdom, and the Bulgarian Commercial Register (Търговски регистър), together with the filings published on them.
Company websites and blog posts.
Publicly available news coverage and press releases.
Publicly accessible business directories, review sites, and event listings.
Public social media pages, including public company pages on Facebook. We read pages that are publicly accessible without logging in; we do not access private profiles, groups, or restricted content.
General web search - to locate the public sources listed above.
Email-pattern inference - where a company's standard email format is publicly known, we may construct a likely email address from that format combined with the individual's name, and verify deliverability before that address is used.

4. Why we hold your data and our lawful basis

We process your data for the following purposes:

To maintain a database of business contacts and their employers that our customers can use to identify potential business counterparties for legitimate B2B offers.
To provide our customers with research, context, and message drafts to support targeted, relevant business outreach to those contacts.
To support our customers in operating outreach campaigns in line with our outreach doctrine, which restricts contact to a small number of relevant individuals per company and prohibits bulk or untargeted messaging.

Our lawful basis for this processing is legitimate interests under Article 6(1)(f) of the UK GDPR (and EU GDPR where applicable). The legitimate interests in question are our own commercial interest in operating the platform and our customers' interest in conducting lawful B2B outreach to relevant decision-makers.

We have carried out a balancing test and concluded that this processing does not override your interests, rights, and freedoms, on the basis that:

the data concerns you in your professional capacity, not your personal life;
the data is drawn from sources where you have made the information available in a professional context, or which exist as public registers of business information;
we apply data minimisation in practice: we do not retain raw social media content, and our summarisation process is designed to exclude personal and sensitive topics from the data we hold;
the processing supports communication that is, by design, targeted, relevant, low-volume, and capable of being stopped on request;
you have the right to object to the processing at any time, as set out below.

A summary of our legitimate interests assessment is available on request.

5. Who we share your data with

We do not sell personal data.

We share data with the following categories of recipient:

Our customers - businesses who have engaged us to support their B2B outreach. Each customer is provided only with contact information relevant to their specific outreach campaign. In data protection terms our customers are independent controllers, not our processors: once data reaches them, they decide whether, when and how to make contact, and they answer for that decision. Our Terms and Conditions require each customer to carry out its own legitimate interests assessment before contacting anyone, to honour objections immediately and tell us within 5 working days, to forward any request you make to us within the same period, and to delete the data within 24 months of receiving it.
Our hosting and infrastructure providers - in particular Microsoft Azure (United Kingdom region), which hosts our platform and database.
Our data sources, where relevant - for example, where Apollo.io or other providers are used as part of our enrichment process.
Our AI providers - the platform's AI features send the text they work on to one of these, depending on the feature: Google, through its Gemini API; OpenAI; Anthropic; and TypeSafe AI, which helps our in-app assistant decide how to answer a question.
For Bamya Call, our call companion - Soniox, Inc. receives live call audio, streamed from your browser, for speech recognition and translation, and Google LLC, through Vertex AI, receives transcripts and prompts for all of its AI features, both primarily in the European Union. We use Vertex AI on a paid Google Cloud project, under which submitted content is not used to train Google's models. Bamya Call's own Privacy Policy has the details.
Regulators, law enforcement, or legal advisers where we are required to do so by law or where it is necessary to establish, exercise or defend legal claims.

6. International transfers

Our primary data storage is in the United Kingdom (Microsoft Azure UK region). The United Kingdom and the European Union have mutual adequacy decisions in place, so transfers between them do not require additional safeguards.

Where personal data is transferred outside the UK or EEA in the course of using sub-processors (for example, where a vendor has support staff in another jurisdiction), we rely on appropriate safeguards including the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK addendum, or applicable adequacy decisions.

7. How long we keep your data

We retain business contact records for up to 24 months from the last meaningful activity associated with that record (for example, the last time a customer engaged with the contact through our platform). After this period, the record is either deleted or anonymised so it can no longer be linked to you.

Separately from our own retention, our customers are required under our Terms and Conditions to delete data we supply within 24 months of delivery, to review what they still hold at least once every 12 months, and to delete your data from their active systems within 30 days if you object. Deleting your record from our platform does not by itself remove it from a customer's own systems, so if you want it gone everywhere, tell us and we will pass the request on.

If you exercise your right to object to processing (see below), we will retain a minimal record of your identity and contact details on a suppression list for the sole purpose of ensuring you are not re-contacted. This suppression record is kept indefinitely or until you ask us to delete it.

8. Your rights

Under UK GDPR (and EU GDPR where applicable), you have the following rights in relation to your personal data:

Right to be informed - this notice is part of how we satisfy that right.
Right of access - you can ask us for a copy of the personal data we hold about you.
Right to rectification - you can ask us to correct inaccurate or incomplete data.
Right to erasure - you can ask us to delete your data, subject to some exceptions (for example, the limited suppression-list retention described above).
Right to restrict processing - you can ask us to limit how we process your data while a query is being resolved.
Right to data portability - applies in limited circumstances; ask us if you wish to exercise it.
Right to object to processing - you have a particular right to object to processing carried out on the basis of legitimate interests, including the processing described in this notice. If you object, we will stop processing your data for outreach purposes and add you to our suppression list.
Right to lodge a complaint with a supervisory authority - in the UK this is the Information Commissioner's Office (ICO, ico.org.uk). If you are located in Bulgaria or another EU member state, you may complain to your local supervisory authority; in Bulgaria this is the Commission for Personal Data Protection (CPDP, cpdp.bg).

To exercise any of these rights, contact us at yavo@bamya.co. We will respond within one month. We do not charge a fee for handling reasonable requests.

You do not need to give a reason when objecting to processing or asking to be removed.

9. Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects on you using solely automated means.

10. Changes to this notice

We may update this notice from time to time. The date at the top of this page shows when it was last revised. Material changes will be reflected in an updated version published at the same web address.

11. Contact

For any question about this notice or about how we handle your data, write to:

ATTN Please ltd
yavo@bamya.co