Business outreach privacy

01 Controller identity, legal form, postal address, contact email

Controller legal name: Matias Eichner
Legal form / status: Einzelunternehmer
Trading name: Viewsnorth
Domain: viewsnorth.com
Postal location: 50858 Köln, Germany
Full serviceable postal address: n/a
Controller/privacy email: contact@viewsnorth.com
Privacy/complaint mailbox monitored: yes
Sender/reply-to mailbox: contact@viewsnorth.com
DPO name/contact: none
UK representative: n/a

Rights requests may be sent to either email address. Unless you expressly narrow the scope, a direct-marketing objection is applied across the controller’s six current service brands. Entries shown as “n/a” or “none” are the controller’s supplied declarations, not template placeholders.

02 Purpose of processing: B2B direct marketing for the service

We process the data for B2B direct marketing for the £250 net Shopify post-checkout migration-readiness audit for one standard-scope non-Plus store ahead of Shopify’s 26 August 2026 deadline; migration and purchase-tracking verification are separately quoted, usually at £1,250–£2,500 net; agencies can request a white-label pilot. We use it to assess professional relevance through AI-assisted research and controller review, send one initial email only with no non-response follow-up, handle replies and rights requests, and prevent repeat marketing.

The 26 August 2026 date is Shopify’s platform deadline for non-Plus post-checkout upgrades. It is not our audit-delivery deadline.

03 Lawful basis: legitimate interests

The lawful basis is legitimate interests under Article 6(1)(f) UK GDPR. The specific interest is finding and contacting relevant decision-makers at UK corporate Shopify merchants and agencies so the controller can make one relevant B2B audit offer and, if requested, separately quoted migration and purchase-tracking verification, supporting proportionate business development and revenue generation.

Safeguards include corporate-subscriber gates, traceable sources, controller review before sending, data minimisation, one marketing message only, no engagement tracking, and immediate operator-wide suppression after an objection. Legitimate interests do not override the Privacy and Electronic Communications Regulations (PECR). We do not email sole traders or non-corporate partnerships unless a valid PECR route exists.

04 Categories of personal data

Name, current job title and professional role published in a professional context.
Employer and corporate identity: legal/trading name, website, canonical domain, Companies House status, UK presence and evidenced parent or buying-group relationship where relevant.
Business email and verification data: exact corporate work address, source, date checked, validation class and deliverability result where a permitted verifier is used.
Professional role and fit evidence: source URLs and dates, role-authority evidence, Shopify/post-checkout signals and a short relevance assessment.
Qualification information: eligibility checks, source freshness, score/subscores, rejection reason and campaign choice.
Contact and suppression information: initial-send date, brand, reply, bounce, complaint, objection, customer/active-conversation state and operator-wide suppression matches.

We do not use personal mailboxes, private-life information, special-category data or criminal-offence data. The qualification score is a limited professional relevance profile; it is not based on tracked email engagement or private behaviour.

05 Source of the data

The actual public-source categories permitted and used are:

the employer’s or business’s official public website, online store, legal, contact, team, service, product and careers pages;
public Companies House entries used to confirm the UK corporate subscriber and active status;
current public professional profiles or professional pages that tie the individual to the employer and role;
public platform, partner, marketplace and technology directories; and
public job advertisements, projects, repositories, help pages, advertising-transparency sources and other current public evidence of the business’s Shopify, post-checkout or purchase-tracking setup.

Research and qualification are AI-assisted and reviewed by the controller. We do not buy or rent opaque lists, bypass logins, access private areas or guess addresses. The record keeps each exact source URL and date checked, which the data subject may request. No separate business-data, enrichment or email-verification provider may receive prospect data until that provider is named in this notice.

Suppression and prior-contact sources: at initial setup on 30 July 2026, the controller supplied “none” for previous outreach/suppression records. From the first authorised outreach onward, the sources are the controller’s correspondence and customer records, the operator-wide suppression ledger, email-delivery and bounce feedback, and any applicable provider or legal suppression lists.

06 Recipients and processors

Recipients and provider categories
Recipient / provider	Role
Microsoft Ireland Operations Limited and Microsoft Corporation	Microsoft 365 email provider and processor: sends and receives outreach, rights-request and complaint mail, and holds the resulting mailbox correspondence. The operator-wide suppression ledger is maintained separately by the controller.
AI-assisted research and technology service providers	Where used, these providers assist public-source research, organisation, drafting and quality review. They may receive the limited professional-contact data, public-source evidence, suppression comparisons and qualification information described in this notice. They do not make decisions producing legal or similarly significant effects.
Netlify, Inc.	Static-site hosting and CDN processor. When this notice is fetched, Netlify processes ordinary HTTP request and security-log data received directly from the requesting device. Those data are not part of the public-source prospect record; the prospect list is not submitted through this page. See the general website privacy notice.

Access is limited to the controller and the recipients or provider categories listed above. We do not sell the data, disclose it to third-party marketers or upload it to a CRM. No separate business-data, enrichment or email-verification provider is currently listed or authorised to receive prospect data; this notice must be updated before one is used.

07 International transfers and the safeguard relied on

Provider, destination and safeguard
Provider	Destination	Safeguard relied on
Controller	Germany	UK adequacy regulations covering transfers to the EEA.
Microsoft 365	United States and countries used by Microsoft’s listed subprocessors	Microsoft Products and Services DPA dated 22 May 2026: the 2021 Standard Contractual Clauses and Microsoft’s UK International Data Transfer Addendum; Microsoft is also certified under the UK Extension to the EU–US Data Privacy Framework.
AI-assisted research and technology service providers	United States and other countries disclosed by the applicable provider	The applicable provider’s published adequacy mechanism or, where required, EU Standard Contractual Clauses together with the UK International Data Transfer Addendum. Details or a copy of the relevant safeguard can be requested through the contact mailbox.
Netlify	United States and the countries on Netlify’s current subprocessor list	The UK Extension to the EU–US Data Privacy Framework; if unavailable, the EU Standard Contractual Clauses together with the UK IDTA under Netlify’s Data Processing Agreement.

Provider terms: Microsoft DPA, Netlify DPA. Transfer-safeguard details for an applicable AI-assisted research provider are available on request.

08 Retention criteria for prospect data and suppression records

Prospect data: deleted at the earlier of 90 days after the sole initial outreach message or six months after collection. The sole initial outreach message is the final marketing message; there is no non-response follow-up. If you begin a genuine business enquiry, the resulting correspondence leaves this prospect schedule and is kept under the separate enquiry, contract and legal-record schedule.

Suppression record: the minimum identifiers needed to prevent repeat contact are retained: normalised business email, name, employer or trading name, canonical company/domain, evidenced parent or buying group, campaign/brand, initial-send date, and reply, bounce, objection or suppression status and scope. These are used only to prevent repeat contact across the six brands and are retained for as long as any of the controller’s six current service brands conducts direct marketing, reviewed at least annually, and deleted when that purpose permanently ends and no legal need to retain it remains.

Objection-related suppression is kept under Article 6(1)(c) UK GDPR to comply with direct-marketing objection obligations. Non-objection one-contact and duplicate-prevention fields are kept under Article 6(1)(f) for the legitimate interest in avoiding repeated outreach.

Research-tool working copies: where an AI-assisted research or technology provider is used, the controller schedules deletion of working copies no later than the prospect-data deadline above, subject to the provider’s published technical, security and legal retention exceptions.

09 Data subject rights

Subject to the legal conditions, you may request access, rectification, erasure, restriction and data portability, and you may object. Portability applies only where its statutory conditions are met; because this processing relies on legitimate interests rather than consent or contract, portability will ordinarily not apply. Erasure may also leave the minimum suppression record needed to honour an objection.

Automated decision-making or profiling: AI-assisted research, qualification checks, suppression matching and a structured score are used to rank corporate prospects and identify relevant professional contacts; the controller decides whether to send, and no decision based solely on automated processing produces legal or similarly significant effects. We use no tracking pixel, read receipt, click tracking, unique tracking link, automated email sequence or post-send engagement score.

10 The absolute right to object to direct marketing

11 Right to complain

You can make a data-protection complaint directly by emailing contact@viewsnorth.com. The controller states that this mailbox is monitored. We record the complaint, acknowledge it within 30 days, investigate without undue delay, keep you informed without undue delay, and communicate the outcome and any action taken. See the public data-protection complaints process. A complaint that includes a marketing objection triggers immediate operator-wide suppression.

You may also complain to either authority below without first contacting us:

Information Commissioner’s Office (ICO), United Kingdom: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. Make a complaint to the ICO.
Competent German supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de, https://www.ldi.nrw.de/