B2B Outreach Privacy Notice

This notice explains how Sonia Sp. z o.o. processes business contact details of companies we approach about wholesale cooperation. It is provided under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

We contact companies at their general business addresses, not individuals. Most of what we hold is company information, which is outside the scope of the GDPR. This notice applies where a business contact detail can nevertheless be linked to a person.

1. Who we are (Data Controller)

2. What data we process

For each company we hold:

• A general business email address published by the company (e.g. info@company.com, sales@company.com)
• Company name, legal form, registration numbers (VAT, commercial register), domain and country
• Publicly listed general business contact details and line of business
• The exact source address (URL) and the date on which we retrieved the data
• Records of our correspondence: messages sent, replies, unsubscribe and objection events

We do not process: names, job titles, individual or named email addresses (such as firstname.lastname@company.com), direct telephone numbers, social media profiles, or special categories of data (Art. 9 GDPR).

3. Where we got your data (Art. 14)

We obtain data only from sources in which a company has itself published its contact details as a channel for business contact:

• Company websites - contact, imprint, wholesale and partner pages
• Public B2B directories and trade platforms where companies register themselves
• Exhibitor and participant catalogues of trade fairs
• Public commercial registers (KRS, CEIDG, VIES and their equivalents) and chambers of commerce

Every message we send states the specific URL and retrieval date for the address we used, so the source can be verified.

We do not: buy, rent or exchange mailing lists; collect data from services whose terms prohibit it, including social networks; guess or generate email addresses from name patterns; bypass logins, access restrictions or paywalls.

4. Why we process it (purpose & legal basis)

5. How long we keep it

• Active prospects: up to 24 months from the last contact.
• If you object or unsubscribe: we permanently keep your address and company domain on a suppression list, stored as a cryptographic hash where that is technically sufficient. This is necessary to honour your objection and prevent re-contact. No content data is kept.
• Evidence of source (a copy of the page from which the address was taken): 24 months.
• Compliance records (which rules applied, what was sent, how an objection was handled): for the duration of processing and 3 years thereafter.
• Replies and correspondence: for the duration of any resulting business relationship, plus the statutory accounting and tax retention period (currently 5 years from the end of the relevant fiscal year, Polish accounting law).

6. Who we share data with

The following act as processors under Art. 28 GDPR:

• Eprojekty Jakub Milewski (Poland, NIP 7792145159) - technical service provider operating the outreach tooling and infrastructure on our instructions
• Zoho and Smartlead - email delivery
• Amazon Web Services and Railway - hosting and databases
• OpenAI - preparation of message content

We also disclose data to accounting and tax authorities where required by law. We do not sell, rent or exchange your data.

7. International transfers

Some processors (Railway, Smartlead, and the technical processing carried out by OpenAI and Amazon Web Services) may process data outside the European Economic Area. Such transfers are covered by Standard Contractual Clauses (Art. 46 GDPR) or another approved safeguard.

8. Your rights (Art. 15-21 GDPR)

At any time you may:

• Request access to your data (Art. 15)
• Request correction (Art. 16)
• Request erasure (Art. 17) - subject to the retention obligations above
• Request restriction of processing (Art. 18)
• Request data portability (Art. 20)
• Object to processing at any time, including direct marketing (Art. 21) - this stops outreach immediately and permanently
• Lodge a complaint with a supervisory authority (Art. 77) - in Poland: UODO; you may also contact your local authority

To exercise any right: email privacy@sonia-b2b.eu. We respond within 30 days. An objection is acted on within 24 hours.

9. Automated decisions

We do not make automated decisions producing legal or similarly significant effects in relation to you (Art. 22 GDPR). Message content is built from templates that we approve before each campaign; automated tools are used only to assemble and send those messages.

10. Limits we impose on ourselves

Beyond what the law requires, we have committed contractually to the following:

• We write only to companies, at general addresses - never to named individual addresses
• We never use purchased, rented or exchanged address lists
• We never guess or generate an address that we have not found published
• We send at most two messages and then stop
• We do not send at all to markets we have not cleared, and we do not send where we cannot establish which country's rules apply

11. Changes

We may update this notice. The current version is always at sonia-b2b.eu/privacy-b2b.html. Material changes will be reflected in the "Last updated" date.