Privacy Built Around Responsible Intelligence.
This Policy explains how personal information is handled across the Prospexto™ website, platform, member services and AI-supported workflows.
For website, account, billing, support, security and our own communications data.
Where customers submit prospect personal data for platform processing under their instructions.
AI supports analysis and organisation; people remain responsible for commercial decisions.
We collect only the information reasonably needed to provide, secure and improve Prospexto™, manage business relationships and meet legal obligations. We do not sell personal information for third parties’ own marketing.
About This Policy
This Policy explains how The Digital Takeover handles personal information when you visit Prospexto.com, hold or use a Prospexto account, contact us, or interact with Prospexto services. Prospexto is one connected business-development platform. Its included workspaces may cover prospect research and qualification, opportunity intelligence, email outreach, cold calling, direct mail, execution, Prospexto CRM, reporting and AI assistance.
The platform may be accessed through a Prospexto-hosted account or an authorised WordPress deployment, as identified for the customer. The exact hosting, storage and processing arrangements for each deployment must be set out in the applicable service and data-processing documentation.
The Digital Takeover® is a trading name of John Thompson. Privacy enquiries can be sent to team@thedigitaltakeover.com. Our complete geographic business address is: [INSERT COMPLETE NON-RESIDENTIAL GEOGRAPHIC BUSINESS ADDRESS].
“Personal information” means information relating to an identified or identifiable living person. Purely corporate information that does not identify a person is not personal information, although we still handle business information responsibly.
Our Data-Protection Roles
When we are the controller
We act as controller when we decide why and how personal information is used for our website, account administration, subscription and billing, customer support, security, service management, legal compliance and our own business communications.
Customer workspace information
A customer may add, import or organise prospect, company and contact information in its Prospexto workspace and decide how to use it. For processing carried out only on that customer’s documented instructions, the customer will generally be the controller and we will act as its processor under the applicable Data Processing Addendum. The customer is responsible for its purposes, lawful basis, notices, outreach decisions and instructions.
Our role depends on the particular processing. Where we independently decide the purposes and means of processing information—for example, for our own account, security or legal obligations—we act as controller. The applicable service agreement and Data Processing Addendum describe the roles and responsibilities for customer workspace processing.
As processor, we may handle records and activity across the connected platform, including prospect and CRM records, qualification notes, outreach content, messages and replies, call and mail activity, tasks, schedules, campaign settings, AI inputs and outputs, reports, usage-credit events and customer-directed transfers. Our own billing, shared credit accounting, platform security and support administration remain controller activities where we determine their purposes.
Information We Collect
Name, business email, telephone number, organisation, role, account credentials, preferences and communications.
Order, subscription, licence, transaction, invoice, shared credit balance and usage, and payment-status information. Full card details are normally handled by the payment provider.
Business and prospect records, qualification activity, notes, workflow actions, outreach information, call and mail activity, schedules, tasks, usage events and generated outputs.
IP address, device and browser details, login events, diagnostics, audit trails, cookie identifiers, platform usage and security logs.
Messages, support requests, survey responses, product feedback and information supplied while resolving an issue.
Business contact details, professional information, postal addresses and telephone numbers; campaign and offer content; email drafts, outgoing messages and replies; call notes and outcomes; delivery and follow-up activity; and other information a customer chooses to use in its workflow.
Where calling features are used, call status, timestamps, duration, callback details, notes and outcomes, and—only where enabled and supported—recordings or transcripts.
Company, contact and deal records; notes, tasks, calendar activity, sales reports, workflow status, suppression and opt-out records, and information needed to prevent further marketing to opted-out recipients.
Where a customer enables a supported mailbox, calendar, telephony or other service connection: configuration, permissions, connection status, access tokens and the information required to perform that function.
Prompts, selected records and workflow context, AI requests, outputs, feedback, safety and usage logs, to the extent needed to provide and secure the requested AI feature.
Where Information Comes From
We may receive personal information:
- directly from you when you visit the website, contact us, create an account, purchase or use Prospexto;
- from your employer, organisation, account owner or an authorised user;
- from a Prospexto customer that submits prospect or contact information to its workspace, including authorised file imports;
- from authorised mailbox, calendar, telephony or other service connections that the customer enables;
- from public business websites, public registers, professional sources, search or mapping services, and business-information providers used by the platform; and
- automatically through platform use, cookies, logs, security technologies and service providers.
Where we act as controller and obtain your personal information from another source, we will provide the privacy information required by law, including the source or source category and whether it was publicly accessible, subject to any lawful exception. Where we act as processor, the customer controller is responsible for giving you the relevant information.
Before publication, add the actual public-data and business-information sources used by the live platform, where they can be identified.
Purposes and Lawful Bases
When we act as controller, we use personal information for the purposes below. The applicable lawful basis depends on the specific processing and circumstances.
Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against people’s rights and reasonable expectations. You can object to processing based on legitimate interests.
This table covers our controller activities; it is not a lawful-basis statement for customer campaigns. For customer-directed workspace processing, the customer determines and documents its lawful basis. We process workspace information under its documented instructions and the applicable Data Processing Addendum.
Customer Prospect Data
Prospexto provides one connected platform for customers to research and qualify businesses, select an appropriate outreach route, manage email, calls or direct-mail activity, record follow-up and manage the relationship in Prospexto CRM. A customer decides which people and businesses to add, why the information is processed, what actions to take and who may access its workspace.
Customers must use the platform lawfully, provide required privacy information, respect objections and suppression records, and comply with data-protection and direct-marketing laws that apply to their activity. Finding an address publicly or receiving a qualification result does not itself give permission to send marketing.
Email recipients and opt-outs
The customer decides which recipients to contact and must assess applicable electronic-marketing rules, including the distinction between corporate subscribers and individual subscribers such as sole traders and certain partnerships.
If you receive a marketing email sent by a Prospexto customer, use its unsubscribe option or contact the sender to object to further marketing. The platform may hold a minimum suppression record so that deleting or re-importing a contact does not restart marketing. The customer remains responsible for applying an objection to its other systems.
If your information appears in a customer’s workspace, that customer will normally be responsible for responding to your request. You may also contact us; where appropriate, we will help identify and notify the relevant controller.
AI-Supported Processing and Human Review
Ask Prospexto AI and other AI features may help users research and qualify prospects, understand opportunity information, prepare outreach, summarise activity, classify replies and plan follow-up. Where enabled, AI may support calling workflows. The AI feature available to a user may use relevant records and workflow context from across the connected Prospexto account that the user is authorised to access, together with the prompt or task the user submits.
To provide a requested or enabled AI feature, relevant inputs may be sent to the configured AI provider. Inputs can include prompts, selected company or contact details, qualification notes, message text, campaign criteria and related workflow context. We minimise the context sent to what is needed for the requested feature. The actual AI provider, its role, processing location, retention and use of inputs must be listed in the current provider and processing documentation before publication.
Optional automatic reviews or coaching process information for the selected feature when enabled by the customer. Turning an optional feature off prevents future use of that feature but does not itself delete earlier messages, review outputs or usage records.
AI analysis, classifications, drafts, scripts, summaries and suggestions may be incomplete or inaccurate. They are decision support, not verified facts. Customers remain responsible for human review and for deciding whether to act. The platform is not intended to make solely automated decisions about people that produce legal or similarly significant effects.
Before publication, confirm and state whether AI-provider inputs are used to train or improve general-purpose models, and the retention controls that apply.
Cookies and Similar Technologies
Strictly necessary cookies and similar technologies may be used to maintain sessions, authenticate users, protect security, remember essential settings and deliver a service you request.
We use non-essential analytics, preference or other storage and access technologies only where permitted and, where required, after you have given valid consent through the site’s cookie controls. You can change your preferences using those controls or your browser settings. Disabling strictly necessary technologies may prevent parts of the service from working.
The policy and cookie controls should identify the actual technologies in use, their purposes, providers and retention periods. This page currently requests font files from Google Fonts; Google may receive technical request information such as your IP address and browser details. See Google’s privacy information.
Before publication, scan the live site and add the actual cookie and storage-technology list, including the consent-management provider.
Who Receives Information
We do not sell personal information for another organisation’s own marketing. Depending on the feature and deployment, information may be disclosed to:
- hosting, cloud infrastructure, security and technical-support providers;
- payment, invoicing, accounting and fraud-prevention providers;
- AI, search, mapping and business-information providers used by enabled features;
- mailbox, calendar, telephony, voice, printing, postal or communications services selected or authorised by a customer;
- email, authentication, customer-support and consent-management providers;
- professional advisers, insurers, auditors and prospective business transaction parties under suitable confidentiality protections; and
- courts, regulators, law-enforcement bodies or other parties where disclosure is legally required or necessary to protect rights and security.
Prospexto CRM is the platform’s native customer-relationship workspace. Connecting an external CRM is not part of the Prospexto Platform described in this Policy.
Providers processing information on our behalf are bound by written terms. A customer-authorised provider may act under its own terms and privacy notice. The current provider names, processing purposes, roles and relevant locations must be listed in the applicable provider and subprocessor register.
Customer-authorised connections
Where a customer enables a supported mailbox, calendar or other connection, the information transferred depends on the feature, permissions and configuration. Customers control whether to connect a service and must check the information and permissions involved. Disconnecting a service does not automatically delete information already held by that provider; its own privacy notice and retention rules apply.
Before publication, replace this category list with or link to the verified current provider and subprocessor list.
International Transfers
Some service providers may store or access personal information outside the United Kingdom. Where this is a restricted transfer, we use a transfer mechanism permitted by UK data-protection law and implement any required safeguards. Depending on the destination and provider, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful mechanism.
The current list of providers should identify the countries where information is stored or accessed and the transfer mechanism used for each relevant transfer. You can contact us for information about safeguards that apply to your data.
How Long We Keep Information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to customer instructions, legal and tax duties, security needs and the time needed to resolve disputes. Where we act as processor, the customer’s instructions and Data Processing Addendum govern workspace retention and deletion.
- Account, subscription and contract records are kept for the customer relationship and the documented period needed for legal, financial and support purposes.
- Financial records are retained for the periods required by tax and accounting law.
- Support, enquiry and communication records are reviewed and deleted or anonymised when no longer reasonably needed.
- Security and diagnostic logs are kept for the documented operational or investigation period.
- Workspace records, AI inputs and outputs, messages, call or mail activity and tasks are retained according to the customer’s account, instructions and the Data Processing Addendum.
- After an account closes, workspace data is returned or deleted according to the customer agreement and DPA, subject to legal obligations and documented backup cycles.
- Connection credentials are held while needed for an authorised connection and removed under the applicable disconnection process. Credit and payment records may be retained for accounting, reconciliation or disputes.
- Minimum suppression information may be retained to honour an objection and prevent further marketing.
Where a fixed retention period is not appropriate, we use documented criteria to decide when information is no longer required. Information may be irreversibly anonymised and retained for analytics or service improvement.
Before publication, replace the general criteria above with the actual retention periods or specific criteria, including log, workspace-deletion and backup windows.
Security and Accountability
We use technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure and misuse. Depending on the deployment, these may include access controls, authentication, encryption in transit, logging, backups, restricted administrative access and incident procedures.
No internet service is completely risk-free. Customers must protect login details, use individual accounts where required, apply suitable device security and notify us promptly if they suspect unauthorised access. Customers must also control access to calling data, recordings or transcripts where those features are enabled.
Customers must protect authorised service connections, access tokens, exports and private calendar-feed links. A private feed link can provide access to calendar data; share it only with authorised services and rotate it if exposed. Do not include passwords or access tokens in AI prompts, message drafts or support tickets.
Customers must restrict access to company, contact, deal, inbox, task, calendar and reporting information to authorised users, and check destinations and permissions before transferring records.
Your Data-Protection Rights
Depending on the circumstances and the lawful basis, you may have the right to:
- receive information about processing and request access to your personal information;
- request correction of inaccurate or incomplete information;
- request erasure or restriction where the legal conditions apply;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive qualifying information in a portable format;
- withdraw consent without affecting earlier lawful processing; and
- receive safeguards and human intervention where the rules on solely automated decisions apply.
To exercise a right in relation to our controller processing, email team@thedigitaltakeover.com. We may request proportionate information to confirm your identity. Rights are not absolute and legal exemptions may apply.
If your request concerns information controlled by a Prospexto customer, we may refer it to that customer or assist it in responding. You can contact that customer directly.
Your right to object to direct marketing
You may object at any time to the use of your personal information for direct marketing, including related profiling. For marketing sent by a Prospexto customer, use the unsubscribe option or contact that sender. For our own marketing, contact us using the details below. We or the relevant customer may retain the minimum information needed to honour your objection.
You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address your concern first.
Children and Sensitive Information
Prospexto is a business platform intended for users aged 18 or over and is not directed at children.
The platform is not designed for special-category personal information, criminal-offence information or highly sensitive personal records. Customers must not submit such information unless its use has been expressly agreed, is necessary and lawful, and appropriate contractual and security measures are in place.
Contact, Questions and Policy Changes
Questions about this Policy or our handling of personal information can be sent to:
Data-protection complaints
You may submit a data-protection complaint using the email address above. We will acknowledge it within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and tell you the outcome. You may also complain to the Information Commissioner’s Office at any time.
We may update this Policy when services, providers, processing or legal requirements change. We will communicate material updates through an appropriate channel where required. The current version and effective date will be shown on this page.