GDPR Compliance Statement

Our commitment

We handle personal data in accordance with the GDPR principles: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. We apply these principles across how we source, verify, store, and supply business contact data.

Controller and processor roles

Depending on the engagement, Data InfoMetrix may act as a data controller (for example, for data we compile and supply, and for our own website and client relationships) or as a data processor (where we process data on documented instructions from a client). We enter into data processing agreements with clients and sub-processors where required.

Lawful basis for processing

For B2B contact data used in business marketing, we primarily rely on legitimate interests — the interest of businesses in reaching other businesses with relevant offerings — balanced against the rights and freedoms of individuals. Where consent is the appropriate basis (for example certain electronic marketing under ePrivacy/PECR rules), we rely on consent. We also process data to comply with legal obligations.

Legitimate interests assessment

Where we rely on legitimate interests, we conduct and document a balancing assessment to ensure our interest in providing B2B data does not override the interests, rights, and freedoms of the individuals concerned. We limit processing to business and professional contact information used for relevant business outreach, and we honor objections and opt-outs.

How we source data

Personal data in our B2B database is obtained from permission-based and publicly available professional sources, including business directories, professional networks, company websites, public registers, partner contributions, and opt-in channels. Records are verified before use and refreshed on a recurring cycle.

Data subject rights

If your personal data is processed by us, you have the right to:

• Be informed about how your data is used.
• Access the personal data we hold about you.
• Request rectification of inaccurate or incomplete data.
• Request erasure (the “right to be forgotten”).
• Restrict or object to processing, including direct marketing.
• Data portability, where applicable.
• Lodge a complaint with a supervisory authority.

How to exercise your rights

To exercise any right, email [email protected] or use our contact page. We will verify your request and respond within one month, as required by the GDPR. There is no charge for a standard request. If you object to processing or direct marketing, we will add your details to our suppression list and cease the relevant processing.

International transfers

Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses, to ensure your data continues to receive an equivalent level of protection.

Data retention and security

We keep personal data only as long as necessary for the purposes for which it was collected and to meet legal obligations. We apply technical and organizational measures designed to protect personal data against unauthorized access, loss, or misuse, and review these measures regularly.

Supervisory authority

If you are in the EEA or UK and believe we have not handled your data in accordance with the law, you have the right to lodge a complaint with your local data protection supervisory authority. We would, however, appreciate the chance to address your concerns first.

Contact us

For any GDPR-related question or request, contact [email protected] or write to DataInfometrix, 7901 4th St N Ste 300, St Petersburg, FL 33702, USA. See our Privacy Policy for full details on our data practices.