This policy explains how COWXSALES LTD (“cowX”, “we”, “us”) collects and uses personal data, and the rights you have over it. We are committed to handling your data fairly, lawfully and transparently under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
COWXSALES LTD is a company registered in England and Wales (company number 12686111), with its registered office at 12 Leighton Road, Hove, England, BN3 7AD. We are the data controller for the personal data described in this policy, except where section 6 says otherwise.
ICO data protection reference number: ZC256720
If you have any questions about this policy or your data, contact us at ed@cowxsales.com or write to us at the address above.
This policy applies to:
Data you give us. When you fill in our contact form, we collect your name, email address, your website, and the website of the company you would like to win. If you contact us in other ways, such as by email, we collect whatever you choose to send us.
Data about your use of our website. With your consent, we use Google Analytics to collect information such as the pages you visit, the site that referred you, your approximate location, and your device and browser type. See section 11. Our hosting provider also handles technical data, such as your IP address, when it delivers our pages to you.
Business contact data from public sources. To help our customers identify organisations that may be a good fit for their services, and the right person to speak to at each, we collect professional information about people in business roles. This may include name, job title, employer, business email address, professional profile links, and information the person or their organisation has published, such as company announcements, website content, case studies, press coverage and professional social media posts. If someone replies to a message we send on a customer’s behalf, we also keep the reply and any details in it. We do not collect special category data (such as health, religion or political opinions) about business contacts.
The UK GDPR requires us to have a lawful basis for each use of your data. We rely on the following.
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and arrange calls | Legitimate interests (responding to people who contact us), or steps before entering a contract |
| Provide our services to customers and manage the account | Performance of a contract |
| Research organisations and identify relevant business contacts for our customers | Legitimate interests (helping our customers find businesses that may benefit from their services), see section 5 |
| Write to business contacts on our customers’ behalf, and handle their replies | Legitimate interests (relevant business-to-business contact, with an easy way to opt out), see section 5 |
| Keep records for accounting, tax and legal purposes | Legal obligation |
| Improve our website and services | Legitimate interests, or consent where cookies are involved |
| Protect our business and handle legal claims | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for details of that assessment and you have the right to object (section 9).
We research organisations and the people who work there so that our customers can decide who may be interested in their services. We then write to a small number of selected people on our customer’s behalf, in their name, from an email address on their domain. Our customer approves the accounts, the approach and the core message before anything is sent. Every message says who it is from, gives a genuine business reason for getting in touch, and makes it easy to say no. We only write to people at limited companies, and we do not write to sole traders or partnerships. We do not send mass marketing.
When we carry out this research and outreach:
Where we get this information. Typical sources include organisations’ websites, Companies House, press releases, published case studies and portfolio pages, event listings and professional networking sites.
Telling you we hold your data. When we write to someone, our first message tells them who we are and where to find this policy. For people we research but do not write to, telling each of them individually would involve disproportionate effort, so we publish this policy instead so the information is available to anyone. If you think we hold data about you, you can ask us at any time (section 9), and you can object to this research and outreach. If you object, we will stop processing your data and keep only the minimum needed to make sure we do not include you again.
When we research and write to organisations and contacts as part of a campaign for a customer, we may do so as a data processor acting on our customer’s instructions, or as a controller in our own right, depending on the arrangement. Our customer approves the approach before anything is sent, and we review it with them regularly. If you are contacted on a customer’s behalf and want to know how your details were found, you can ask the customer or us, and we will help.
Some of our service providers are based outside the UK, including in the United States and the European Economic Area. When your data is transferred outside the UK, we make sure it is protected by one of the safeguards the law allows, such as a UK adequacy decision (including the UK-US Data Bridge for certified organisations), or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
You have the right to:
To use any of these rights, email ed@cowxsales.com. We will respond within one month. We may ask you to confirm your identity. There is normally no charge.
We keep personal data only as long as we need it:
| Data | How long |
|---|---|
| Enquiries that do not lead to work | 12 months after our last contact |
| Customer records and contracts | 6 years after the end of the contract, for legal and tax reasons |
| Business contact research data | 12 months from collection if there is no ongoing contact, then deleted or refreshed |
| Records of objections | For as long as needed to make sure we respect your request |
We use appropriate technical and organisational measures to protect your data, including access controls, encrypted connections and reputable service providers. No system is completely secure, but we work to protect your data and will notify you and the regulator of a serious breach where the law requires it.
Our services are for businesses. We do not knowingly collect data from anyone under 18.
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.
If you are unhappy with how we have handled your data, please contact us first at ed@cowxsales.com and we will try to put it right.
You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO):