Privacy & Cookie Notice
GTM Intelligence Ltd · Registered in England & Wales · Company no. 16414756
Last updated: 21 December 2025
Applies to: GTM Intelligence Ltd (“GTM”, “we”, “us”) and all online services branded “GTM Intelligence” or “neogtm”.
1. Who we are
GTM Intelligence Ltd
61 Standen Road
London SW18 5TH
United Kingdom
Company No.: 16414756
Contact: tiago@neogtm.com
For questions, requests, or concerns, you can contact us at tiago@neogtm.com.
2. What personal data we process and why
2.1 Categories of personal data
| Category | Source | Purpose | Legal basis |
|---|---|---|---|
| Professional contact data (including inferred work emails where applicable) — name, role, employer, work e-mail/phone, LinkedIn URL, business-profile notes | Public websites, professional networks, company disclosures, and (where applicable) inference based on publicly available employer email format patterns | Provide B2B sales-intelligence datasets to our customers | Legitimate Interests (GDPR Art 6(1)(f)) — balancing test maintained |
| Platform account and login data — name, business e-mail, authentication tokens, password hash where applicable, audit logs | Client admin/user; generated by the platform | Authenticate users, administer tenants, prevent fraud/abuse, support users | Contract (Art 6(1)(b)); Legitimate Interests (service security) |
| Tenant configuration data — tenant identifiers, region selection, access controls | Client admin/user; generated by the platform | Configure tenant environments, enforce tenant isolation, route users to the correct tenant | Contract (Art 6(1)(b)); Legitimate Interests (service security) |
| Optional customer-uploaded data (User Data) — e.g. CRM records, prospect lists, notes | Uploaded by a customer | Enrichment and analytics as instructed by the customer | Processor processing under the DPA (Art 28) |
| Usage and device data — IP address, device/browser info, session identifiers, event logs | Browser/device; generated by the platform | Secure sessions, detect abuse, troubleshoot, improve reliability; optional analytics if introduced and enabled | Legitimate Interests (essential/security); Consent for analytics (where required) |
| Support and communications — emails, tickets, messages | You / your organisation | Provide support, handle requests, maintain service communications | Contract; Legitimate Interests |
We do not intentionally collect:
- Special category or sensitive personal data (GDPR Art 9), or
- Children’s data.
3. Public-source methodology
We collect professional data only from publicly available, work-related sources, including (by way of example):
- Company and staff directories
- Press releases and public announcements
- Public LinkedIn profiles
- Public procurement portals
We do not intentionally collect data from:
- Private social media accounts
- Personal email services
- Inferred work email addresses
In some cases, where a work email address is not publicly listed, we may infer a likely work email address based on commonly used email formats at the relevant employer (for example, firstname.lastname@company.com). These inferred addresses may be inaccurate. Where we learn an address is incorrect (for example, through customer feedback, delivery failures, objections, or other reliability signals), we will update or suppress the record as appropriate.
4. How we share data
| Recipient | Purpose |
|---|---|
| GTM customers | Receive GTM Data for their own B2B outreach. Customers are responsible for respecting opt-out requests and applicable marketing laws. |
| Authorised sub-processors | Provide hosting, edge delivery, compute, database/auth/storage, security, email delivery, AI enrichment (where enabled), workflow automation, and development assistance. |
| Regulators or law enforcement | Only where legally required or necessary to protect our rights. |
Customer outreach responsibility
GTM provides GTM Data to customers for internal B2B go-to-market activities. Customers act as independent controllers for their outreach and are responsible for compliance with applicable direct marketing and communications rules (including notices, opt-outs/unsubscribes, suppression lists, and local legal requirements).
5. Where data is hosted and processed
5.1 Hosted SaaS delivery
The Services are delivered as a hosted SaaS platform using third-party cloud and hosting providers for edge delivery, server-side compute, and database/authentication/storage.
5.2 Per-tenant data residency
(a) Default region. The default region is the United Kingdom unless otherwise agreed with the customer.
(b) Optional regions. Where a customer requires specific residency, the tenant is configured so its primary Customer Data is stored in the agreed region (UK, EU, or US) using a dedicated environment or equivalent logical segregation and access controls.
5.3 Tenant access and isolation
Users access the Services via a single URL. After authentication, users are routed to the correct tenant environment and can access only data associated with that tenant, subject to access controls.
5.4 Operational data
Limited operational and security-related data may be processed in other locations to operate, maintain, and secure the Services. We minimise such data and apply appropriate safeguards.
6. International transfers
Some processing may involve international transfers due to the locations of sub-processors and the use of global edge delivery and security services.
Where personal data is transferred internationally, we apply appropriate safeguards, including:
- EU Standard Contractual Clauses (EU 2021/914)
- UK International Data Transfer Addendum / UK IDTA
- Supplementary measures where appropriate (including data minimisation and encryption)
Where required, we maintain and update transfer assessments for relevant international transfers and apply supplementary measures where appropriate.
7. Security
We implement technical and organisational measures designed to protect personal data, including:
- TLS encryption in transit
- Encryption at rest (provider-managed)
- Least-privilege access controls
- Enforced two-factor authentication (2FA) where supported
- Periodic access reviews
- Regular backups
Full technical and organisational measures (TOMs) are described in Section A of this pack.
8. Data retention
| Data | Retention |
|---|---|
| Professional contact data | Until found inaccurate or objected to; then updated or suppressed |
| Login and audit data | Contract term + 30 days, then deleted from active systems (subject to legal/operational requirements) |
| Customer-uploaded data (User Data) | Deleted or returned within the timeframes set out in the DPA, subject to legal requirements |
| Security logs and service telemetry | Retained for operational security and troubleshooting; retention varies by system and is minimised where practicable |
Backup copies are retained according to backup and disaster-recovery processes and overwritten on a rolling basis, unless retention is required by law or for security or audit purposes.
9. Your rights
You may have rights under data-protection law, including: Access, Rectification, Erasure, Objection, Restriction, Portability, and the right to complain to a regulator.
To exercise your rights, email tiago@neogtm.com. We respond within one month.
10. Opt-out of GTM Data
To opt out of GTM Data processing:
Email tiago@neogtm.com from your work email address.
We will suppress the record (including any associated or inferred work email addresses) and add your email to a do-not-add list to help prevent reintroduction.
11. Cookies
We use cookies and similar technologies that are strictly necessary for the Services to function properly, including to maintain secure sessions, protect against abuse, and ensure reliable service delivery.
We do not currently use analytics, advertising, or other non-essential cookies on the website or within the application. If non-essential cookies (including analytics cookies) are introduced in the future, we will implement them only where permitted by law, request user consent where required, and provide appropriate cookie preference controls.
Cookie categories
| Type | Purpose | Default |
|---|---|---|
| Essential session cookies | Maintain user login sessions; provide CSRF protection; enable core security and service functionality | Always on |
| Security / edge cookies (set by infrastructure providers) | Protect the Services from abuse, fraud, and malicious traffic; ensure reliable and performant delivery | Always on |
| Analytics cookies (if introduced) | Analyse usage patterns and improve features and service performance | Off by default; enabled only with consent where required |
Managing cookies
You may manage or disable cookies through your browser settings. If non-essential cookies are introduced, we will also provide an in-product or site-level mechanism to manage cookie preferences in accordance with applicable law.
12. Sub-processors
We use sub-processors to support the Services. Key categories include:
- Edge delivery and security
- Cloud compute
- Database, authentication, and storage
- Email and collaboration tools
- Workflow automation
- Optional AI enrichment (where enabled)
A current list of sub-processors is available on request. Where required by applicable law or contract, we will provide notice of material sub-processor changes where practicable.
13. Changes to this notice
We may update this Privacy & Cookie Notice from time to time. Where changes are material, we will provide notice as required by applicable law and, where practicable, via email or in-product messaging.