Privacy Notice

Who we are

LinLex LTD is a United Kingdom limited company providing B2B IT consultancy services, specialising in cybersecurity, infrastructure management, and programme delivery.

Where LinLex conducts outreach on behalf of a named client company, that client acts as the data controller and LinLex acts as a data processor under a written data processing agreement. In those cases, this notice is provided on behalf of the relevant controller.

What personal data we hold about you

We process a limited set of business contact information. We do not collect or process any special category data (e.g. health, ethnicity, political opinions).

Where we obtained your data

We did not collect your personal data directly from you. Your business contact information was obtained from one or more of the following sources:

• LinkedIn — publicly visible profile information that you have chosen to make available
• Company websites — staff directories, leadership pages, and other publicly listed contact details
• B2B data enrichment services — third-party providers such as Apollo.io that aggregate publicly available business contact data
• Industry events and publications — speaker lists, press releases, and publicly available conference materials

In every case, the data relates solely to your professional role and business contact details, not your private or domestic life.

Why we process your data

We process your personal data for the following specific purposes:

Lawful basis for processing

We rely on legitimate interests as our lawful basis under UK GDPR Article 6(1)(f).

For electronic communications specifically, we rely on the business-to-business exemption under Regulation 21 of the Privacy and Electronic Communications Regulations 2003 (PECR), which permits unsolicited email to corporate subscribers where:

• The message is sent to a business email address (not a personal address)
• The content is relevant to the recipient's professional role
• Every message includes a clear and functional opt-out mechanism

Legitimate interest assessment

We have conducted a Legitimate Interest Assessment (LIA) and concluded that:

Our legitimate interest

LinLex has a genuine business need to identify and contact potential clients whose organisations may benefit from our IT consultancy services. Direct B2B outreach is a standard and expected practice in the professional services sector.

Necessity

Processing business contact data is necessary to reach relevant decision-makers. There is no less intrusive means of introducing our services to potential clients who are not yet aware of LinLex.

Balancing test

We have balanced our interests against your rights and freedoms and concluded that processing is proportionate because:

• We only process business contact data, not private or sensitive information
• The data is already publicly available or shared by you in a professional context
• Our communications are limited, relevant, and infrequent (typically 3-5 emails over a period of weeks)
• Every email contains a clear, one-click opt-out that we honour immediately
• Recipients would reasonably expect B2B outreach relevant to their professional role
• There is no significant impact on your rights, freedoms, or interests

Who we share your data with

We keep your data within a tightly controlled set of systems and do not sell, rent, or trade personal data.

We may also disclose your personal data where required to do so by law, regulation, or court order.

How long we keep your data

Your rights under UK GDPR

You have the following rights in relation to your personal data. These rights are not absolute and may be subject to legal exemptions.

Automated decision-making and profiling

We use limited automated processing in the following ways:

• Contact scoring — an algorithm assesses the likely relevance of our services based on your job title, seniority, and industry. This helps us avoid contacting people for whom our services are not relevant.
• AI-assisted personalisation — email content may be tailored using AI tools to make messages more relevant to your role and sector.
• Timezone detection — your company's publicly listed location is used to infer timezone for send-time scheduling.

None of these processes produce legal effects or similarly significant effects on you. No automated decisions are made about whether to do business with you, and no data is used to make decisions about access to services, pricing, or similar outcomes. The scoring exists solely to improve the relevance and timing of business communications.

Google API Services User Data

Where a LinLex client uses a Google Workspace mailbox for outreach, the LinLex Outreach Platform connects to that mailbox using Google's OAuth 2.0 authorisation flow. The client (as the authenticated Google user) grants scoped access; they can revoke it at any time.

Scopes we request and why

How we store and use Google user data

• OAuth tokens are stored encrypted at rest on UK-based infrastructure under LinLex control. Access tokens refresh automatically; the long-lived refresh token is accessible only to the LinLex Outreach Platform service account.
• Message bodies from Gmail are not persisted. Reply detection reads headers and snippets at poll time and immediately discards them after classification.
• Calendar events are held in memory only for the duration of the slot-calculation request. No calendar data is persisted to our CRM or any other store.
• Outbound send records (recipient, subject, send timestamp, provider message ID) are retained in our CRM alongside equivalent records for Microsoft 365 sends, under the retention schedule in Section 8.

Limited Use — what we never do with Google user data

Disconnecting your Google account

You can revoke the LinLex Outreach Platform's access to your Google account at any time by either of the following methods:

1. Visit myaccount.google.com/permissions, locate LinLex Outreach Platform, and click Remove access.
2. Visit our disconnect page at linlexltd.co.uk/disconnect for step-by-step guidance and a direct revocation link.

Upon revocation, the access and refresh tokens held by LinLex are invalidated immediately and no further Google API calls can be made on your behalf. We will delete the stored OAuth record within 30 days of detected revocation, subject to any regulatory retention obligations.

Questions or concerns

For any question specifically about our handling of Google user data, contact privacy@linlexltd.co.uk with the subject line Google Data Request.

International data transfers

Our CRM system operates on UK-based infrastructure under LinLex control. Email delivery infrastructure varies by client: Microsoft 365 clients' outbound email transits Microsoft's UK and EEA data centres; Google Workspace clients' outbound email transits the regions configured by that client's Google Workspace tenancy, which may include the United States.

Outbound B2B email is, by its nature, sent to recipients wherever their business is located. Where we contact a business recipient outside the UK or EEA, the message necessarily traverses the recipient's own email infrastructure in their jurisdiction, and any reply or engagement signals we receive return by the same route. Beyond this necessary delivery and reply-tracking, LinLex does not transfer personal data to third parties outside the UK or the European Economic Area.

Where a LinLex client's email infrastructure is provided by a US-based operator — for example Microsoft Corporation for Microsoft 365, or Google LLC for Google Workspace — the associated data processing may involve transfer to the United States. Such transfers are safeguarded by the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement, as applicable, and by the provider's own certifications (including ISO 27001, ISO 27018, SOC 2).

Complaints

If you are unhappy with how we have handled your personal data, we encourage you to contact us first at privacy@linlexltd.co.uk so we can attempt to resolve the matter.

You also have the right to lodge a complaint with the UK supervisory authority:

Contact us

If you have any questions about this privacy notice or how we handle your personal data, please get in touch.