Apolac Privacy Notice
Last updated:
This notice explains how Apolac Ltd collects and uses personal data: when you visit apolac.com, book a call with us, sign up to our newsletter, or receive an email from us as part of our business-to-business (B2B) outreach. We have written it in plain English. If anything is unclear, contact us at contact@apolac.com.
1. Who we are
Apolac Ltd ("Apolac", "we", "us") is a UK outbound growth partner. We help businesses win new clients through targeted B2B outreach.
- Company: Apolac Ltd, registered in England and Wales, company number 17466841
- Registered office: 128 City Road, London EC1V 2NX
- Email: contact@apolac.com
- Privacy contact: Harrison Leigh, Director (contact@apolac.com)
For the data described in this notice, Apolac Ltd is the controller, which means we decide how and why it is used. The exception is client campaigns (see section 3), where we act for our client.
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
2. The data we collect and why
| Purpose | Data | Lawful basis |
|---|---|---|
| Booking and holding a call with you (via the booking form on our website (apolac.com/call) and Calendly) and following up on your enquiry | Name, email address, phone number (required to book), company name, role, budget, preferred start date, your answers to booking questions (for example your goals and budget), the date and time of the call, and notes from the call | Steps at your request before entering into a contract (Article 6(1)(b)) and our legitimate interests in responding to and following up on enquiries (Article 6(1)(f)). You can also choose to receive marketing emails from us, including our newsletter Learn to Outbound, by ticking an optional, unticked box on the booking form. If you book a call without ticking it, we will not send you marketing emails. |
| General enquiries (email or other contact) | Name, email address, company, and anything you choose to tell us | Legitimate interests in responding to you, or steps before a contract where you ask about our services |
| Sending marketing emails: our newsletter, "Learn to Outbound", and occasional news and offers about Apolac's services | Email address, name (if given), sign-up date, time and source, confirmation of your double opt-in (website sign-ups), and whether you open or click our emails | Consent (Article 6(1)(a)). You sign up either through the form on our website (by ticking an unticked box and confirming by email) or by ticking an optional, unticked box on our Calendly booking form. Only people who tick a box are added; booking a call without ticking it does not add you to our marketing emails. You can withdraw at any time. |
| Our own B2B outreach (emailing businesses that may benefit from our services) | Business contact details: name, job title, work email address, company, company website, LinkedIn profile URL, and publicly available business information (for example company size, sector and recent news) | Legitimate interests in promoting our services to relevant businesses (Article 6(1)(f)). See "If we contacted you first" below. |
| Delivering services to our clients (running outreach campaigns on a client's behalf) | Business contact details of the client's prospects (as above) | We act as a processor for our client, who is the controller and decides the lawful basis. See section 3. |
| Managing our client relationships | Names and contact details of client staff, contracts, invoices and payment records | Performance of a contract (Article 6(1)(b)) and legal obligation for tax and accounting records (Article 6(1)(c)) |
| Keeping a suppression list so we do not contact people who have opted out | Email address (and name and company where needed to match records) and the date you opted out | Legitimate interests and compliance with PECR, so we respect your choice not to be contacted |
| Running and protecting our website | Technical data such as IP address, browser and device type, and pages visited. We use Plausible, a privacy-friendly analytics tool that does not use cookies or collect personal data. | Legitimate interests in keeping the site secure and working, or consent where cookies require it (see section 7) |
If we contacted you first (our B2B outreach)
If you received an email from Apolac without contacting us first, this section explains where we got your details (as required by Article 14 UK GDPR).
- Where your data came from: B2B data providers (Prospeo), and public sources such as your company website, Companies House and professional profiles such as LinkedIn.
- What we hold: your name, job title, work email address, company, and publicly available information about your business.
- Why: to send you a small number of relevant emails about our services. We weigh our interests against yours. We only contact people in a business role relevant to our services, at their work address, and every email tells you who we are and gives you a simple way to opt out.
- PECR: we only send unsolicited marketing emails to corporate subscribers (such as limited companies and LLPs). We do not cold email sole traders or ordinary partnerships without their consent or a previous relationship.
- Your right to object: you can object at any time by replying to any email or writing to contact@apolac.com. We will stop and add you to our suppression list.
3. Client campaigns: when we act for someone else
When we run outreach for a client, we process prospects' data on that client's behalf and under their instructions, under a written agreement. The client is the controller and is responsible for telling you how it uses your data. If you received a campaign email sent for one of our clients, please contact that client to exercise your rights. If you contact us, we will pass your request on to them promptly and, if you ask, stop the emails.
4. Who we share your data with
We do not sell your personal data. We share it only with service providers (processors) who help us run our business, under contracts that require them to keep it secure and use it only on our instructions:
- Google Workspace – email, documents and storage
- Instantly – sending and managing outreach emails
- Prospeo – finding and verifying business contact details
- Calendly – call booking and scheduling
- MailerLite – sending our newsletter
- Lovable – website hosting
- Plausible – website analytics
We may also share data with our professional advisers (such as accountants and lawyers), with a buyer if our business is sold, or where the law requires it (for example with HMRC or the police).
5. International transfers
Some of our providers are based in, or store data in, the United States or other countries outside the UK. When data is transferred outside the UK, we make sure it is protected by an approved safeguard, such as:
- the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), where the US provider is certified under it; or
- the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
- a UK adequacy decision for the destination country.
You can ask us for more detail on the safeguards used for a particular provider.
6. How long we keep your data
| Data | How long |
|---|---|
| Call bookers and enquirers who do not become clients | 3 years from our last contact with you |
| Prospects in our own B2B outreach | 3 years from our last contact with you, or sooner if you object |
| Marketing email subscribers | Until you unsubscribe, then moved to our suppression list. |
| Client records, contracts and invoices | 6 years after the contract ends, for tax and legal reasons |
| Client campaign data | As set out in our agreement with the client, then deleted or returned |
| Suppression list (people who have opted out) | Indefinitely, holding the minimum needed (usually just your email address), so we can make sure we never contact you again |
7. Cookies
apolac.com only uses cookies that are strictly necessary for the site to work and stay secure (for example, a security cookie set by our hosting provider). We do not use advertising or tracking cookies. Our analytics tool, Plausible, does not use cookies. If we ever add non-essential cookies, we will ask for your consent first.
8. Your rights
Under UK data protection law, you have the right to:
- Access – ask for a copy of the personal data we hold about you.
- Rectification – ask us to correct data that is wrong or incomplete.
- Erasure – ask us to delete your data (we will keep your email address on our suppression list if you have opted out, so we do not contact you again).
- Restriction – ask us to limit how we use your data in certain cases.
- Data portability – ask for data you gave us in a commonly used, machine-readable format, where we use it based on consent or a contract.
- Object – object to our use of your data based on legitimate interests. You have an absolute right to object to direct marketing, including our outreach emails. If you do, we will stop.
- Withdraw consent – where we rely on consent (such as marketing emails), you can withdraw it at any time. This does not affect anything we did before.
- Unsubscribe – every newsletter and outreach email has an unsubscribe link or opt-out instruction, or you can email contact@apolac.com.
To use any of these rights, email contact@apolac.com. We will respond within one month. There is usually no charge.
9. Complaints
If you are unhappy with how we have handled your data, please tell us first at contact@apolac.com and we will try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk (opens in a new tab), helpline 0303 123 1113.
10. Changes to this notice
We may update this notice from time to time, for example when we start using a new tool. We will post the updated version on this page and change the date at the top. If a change significantly affects you, we will let you know.
Last updated: