Legal
Privacy, in the order you need it.
What we hold, why we hold it, who is answerable for it, and how to make us stop.
Last updated 11 September 2026
If you received an email and want it to stop: use the unsubscribe link in it. One click, no account, no reply needed, immediate and permanent across the whole platform. Then read section 2, which is written for you.
If you are a customer: you are the controller of the contacts you bring or generate, and we process them on your instructions. Section 3 and the data processing addendum.
On this page
1. Who is responsible for what
ADM is a platform other businesses send their own campaigns through. That splits responsibility in a way worth being precise about, because it decides who you write to.
| The data | Controller | ADM's role |
|---|---|---|
| Your ADM account — name, work email, organisation, plan, billing reference | ADM | Controller. We decide what to collect and why. |
| Contacts a customer imports | The customer | Processor. We hold and send to them on the customer's instructions and for nothing else. |
| Leads generated through ADM's lead generation | The customer | Processor. The customer defines the search, sets the criteria and approves every lead before it enters their list — see below. |
| Delivery and engagement events — delivered, opened, clicked, bounced, unsubscribed | The customer | Processor, except for the suppression list, which we maintain platform-wide. |
| The suppression list — addresses that have opted out | ADM | Controller. We keep it in our own right, across all customers, so an opt-out given to one sender cannot be undone by another. |
On lead generation specifically. When ADM searches for leads, it does so on a brief the customer writes, against criteria the customer sets, and every result is held in a review queue the customer must approve before it enters their list. The customer determines the purpose and the means; ADM executes. That instruction — the brief, the criteria, who approved the results and when — is recorded, because a processor relationship that cannot be evidenced is not one. ADM does not select who a customer contacts, and does not use leads generated for one customer for anyone else.
The practical answer to "who do I write to": the organisation named in the footer of the email you received. That is the controller for your details. If you would rather start with us, we will route it and make sure it is actioned.
2. If you received an email from a campaign
You are here because a business contacted you at work. Here is the whole picture.
What is held about you
Your name, your job title, your employer, your business contact details, the country your company is in, and a short description of what your company does. Alongside that: the emails sent to you, and what our sending platform reported back about them — whether they were delivered, opened, clicked, bounced, or unsubscribed from.
That is the complete list. No special category data. No behavioural profile of you as an individual. Nothing about your life outside work.
Where it came from
Not from you — which is exactly why you are entitled to be told. It came from a commercial B2B contact database such as Apollo, from public company sources, or from the sending organisation's own records if you have dealt with them before. The email you received names the source in its footer. Full detail is in section 4.
Why it is lawful to contact you
The sender relies on legitimate interests (Art. 6(1)(f)) — approaching you at work, about work, on a matter relevant to your role. You have an unconditional right to object to direct marketing under Art. 21(2), and when you do, it stops. There is no balancing exercise on that one and we do not attempt one.
How to make it stop
- Unsubscribe link in the email. One click. Immediate, permanent, and applies across every campaign on the platform rather than just the one you received. If your address is imported again later, it stays suppressed.
- Reply and say so. That works too.
- Ask for erasure. We delete your contact record from the sender's collections and pull you out of anything already queued. One thing is deliberately kept: a minimal entry on the suppression list recording that you opted out. Deleting that would let the next import re-add you and quietly undo your own request — it is retained precisely to give effect to your objection, on the basis of Art. 21(3).
You are entitled to a response within one month (Art. 12(3)). You will normally get one within a few days.
3. If you are an ADM customer
For your account we are the controller, and we hold your name, work email, organisation, plan, billing reference, and the record of what you did in the product. We use it to run the service, bill you, and support you. We do not sell it and we do not market it onward.
For the contacts you bring or generate, you are the controller and we are your processor. We process them only to personalise and send your campaigns, to record engagement, and to maintain suppression — nothing else, and never for our own purposes. The data processing addendum is the contractual version of that sentence, and the sub-processor list names everyone involved.
What you are responsible for. The lawfulness of your own sending: having a basis to contact the people on your list, honouring objections, and complying with the rules of the markets you send into. ADM gives you the tooling and the warnings — the classification of every recipient, the country regime, the disclosure completeness check — and records what you were shown. It does not make the decision for you, and it is not legal advice.
4. Where contact data comes from — Art. 14
Personal data used for outreach on ADM is not obtained from the people it describes. That triggers Art. 14 GDPR, and Art. 14(3)(b) makes the notice due at the latest at the first communication — meaning in the first email, not only on a website somebody might visit afterwards.
So every campaign email carries, in its footer: the identity and postal address of the sending organisation, the source of the recipient's details, the categories of data held, the purpose and the legal basis, the right to object, a one-click way to exercise it, and a link to the controller's full privacy notice. Where we can determine the recipient's country, it is written in their language.
The sources are set out in full in the sending policy: commercial B2B contact databases, public company sources, and the customer's own records.
5. Automated processing and AI
Email copy is generated by third-party language models under contract. What is sent to them for a given recipient is: the recipient's name, company, country and role, the research summary about their company, the campaign brief, and any prior correspondence in the thread. What is never sent: payment data, credentials, or a customer's full contact list.
Our model providers are contractually prohibited from training on what we send them. They are named in the sub-processor list.
No automated decisions about people. Nothing in ADM makes a decision that produces legal or similarly significant effects for an individual, so Art. 22 is not engaged. Lead scoring assesses whether a company matches a customer's target profile — it does not evaluate a person, and it does not decide anything about them beyond whether their employer appears on a prospect list. Every generated email and every generated lead is reviewable by a human before it is used, and campaigns can be written entirely by hand with no model involved in the body at all.
6. How long anything is kept
| What | Kept for | Why |
|---|---|---|
| Account and billing records | 7 years after the account closes | Statutory retention for accounting records. |
| Contacts in a customer's collections | Until the customer deletes them, or 90 days after the account closes | The customer controls this; we act on their instruction. |
| Campaign content and engagement events | 24 months | Reporting, deliverability diagnosis and dispute resolution. |
| Suppression list entries | Indefinitely | Deleting these would let a later import undo the opt-out. Retained to give effect to the objection (Art. 21(3)). The entry holds the address and the date, nothing else. |
| Compliance audit records | 6 years | Evidence of accountability under Art. 5(2). Holds counts and a handful of example addresses, never the recipient list. |
| Application logs | 90 days | Security and fault diagnosis. |
7. Where data goes
Data is hosted in the EU where our providers offer it. Some of our sub-processors operate outside the EEA; those transfers rely on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one covers the country in question. Each provider, what it does, and where it processes are listed on the sub-processor page, which is updated when the list changes rather than annually.
8. Security
Encryption in transit and at rest. Access limited to the staff who need it for their work. Credentials held in the deployment platform rather than in source control. Tenant isolation enforced in the application itself, and covered by an automated test suite, so one organisation cannot read another's agents, collections, leads or campaigns.
If a personal data breach affects a customer's data we notify that customer without undue delay, with what we know and what we are doing about it, so they can meet their own Art. 33 deadline.
9. Your rights, and how to use them
Whether you are a recipient or a customer, you have the right to: access what is held, have it corrected, have it erased, restrict or object to its processing, receive it in a portable form, and — where processing relies on consent — withdraw that consent at any time without affecting what was done beforehand.
Objecting to direct marketing is absolute. Art. 21(2) gives you that right without conditions and without any balancing exercise. Say stop and it stops.
How to exercise them. For a campaign email, write to the organisation named in its footer — they are the controller. For anything about ADM itself, or if you would rather start with us, use the contact page. We answer within one month as required by Art. 12(3), and normally much sooner. Customers can also run access and erasure requests for their own contacts directly in the product.
If you are not satisfied, you can complain to your national data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens. You can complain to the authority where you live, where you work, or where the alleged infringement took place.
Contact
Controller for ADM account data: [registered legal entity, company number, registered address]. Privacy contact: [privacy@ address], or the contact page. [Data protection officer, if appointed].