The Business has a legitimate interest to process personal data relating to decision makers and budget holders in organisations in the UK as part of direct marketing in order to promote our business. All data is gathered from publicly available sources and / or directly from the companies concerned.

We engage in unsolicited and solicited B2B communications where we have a strong reason to believe that the business we are contacting could benefit from the offer contained within the communication; i.e. there is a clear logical connection to their business profile. We assert this as a legitimate interest of our business, as per Article 6.1 of the General Data Protection and Regulation (GDPR) and UKGDPR. We collect contact details for unsolicited B2B communications through publicly available sources such as company websites. Solicited details are obtained through third party providers.

In relation to the personal data of professional individuals from 3rd party sources. The privacy notices of the 3rd Parties provide that their personal data will be shared with selected with organisations for the purposes of providing promotional information.

In accordance with the provisions of UKGDPR, we do not collect or process the contact details of sole traders or partnerships unless they have explicitly opted in to receive updates from us. If you are a sole trader or partnership business and are receiving email communications from us, please contact us at info@lightbulbcredit.com and we will remove you from our database. Where details are provided by third party providers these are done so under the relevant agreement.

We use third-party software Mailchimp and Pipedrive to store contact details for marketing purposes. We use contact details only to communicate directly about our own products, services, events and platforms, and do not share data with any third parties.

Please report any violations to UKGDPR principles that have affected you to info@lightbulbcredit.com

Legitimate Interest Assessment

Lawful Business Objective

The processing is necessary in order to target relevant business decision makers and budget holders as part of business-to-business direct marketing activity as specifically identified by the Privacy and Electronic Communications Regulations 2003 (PECR) and Recital 47 of the GDPR. To collect and process basic data in order to make unsolicited and solicited communications to other businesses.

Reasonable Expectation

The data subjects are senior business people with decision making and budgetary responsibilities and can reasonably be expected to be contacted with marketing material relating to their professional roles.

Adequate, Relevant & Limited

The data collected is limited to names of senior managers and directors, their job titles, company addresses, company landline telephone numbers and corporate email addresses.

Purpose Test

Why do you want to process the data – what are you trying to achieve?

We aim to engage in unsolicited direct marketing that is related to our data services and products to make the recipients aware that we are able to help them. We believe that all of the products and services we offer are of interest to our customers, and indeed help them to run their businesses successfully. We need to process the data we have in order to maintain an effective channel of communication between the Business and our customers in order to meet their needs effectively.

The Business obtains the personal data of these categories of data subject either directly (via our website or previous subscriptions or purchases) or from 3rd parties who provide the Business with a database of contact details identified above.

Our privacy notice(s) includes a section on direct marketing which clearly indicates the ability of the individual to object to receiving direct marketing at any time.

In addition, each communication that is sent which contains direct marketing includes an unsubscribe link enabling the individual to unsubscribe and discontinue the direct marketing from the Business. The Business maintains a suppression list of individuals who have unsubscribed and ensures that those individuals do not receive further direct marketing from the Business.

The Business relies upon the ‘soft-opt in’ where appropriate available under the Privacy and Electronic Communications Regulations 2003 in relation to Subscribers and Existing Customers

Who benefits from the processing? In what way?

We benefit by raising awareness of our business and winning new contracts. The recipients benefit by receiving appropriate information about our products and services safety that can benefit their business and we can provide those benefits to the recipient if the direct marketing leads to a commercial relationship. Further we benefit from the processing because it makes those channels of communication much easier to establish and maintain, while our existing clients, and potential new clients, benefit as they have access they might otherwise have missed out on to products and services that help them to run their businesses more efficiently, effectively and successfully.

Are there any wider public benefits to the processing?

The core of our business offering, as well as the intellectual property that we share gives recipients the information they require to make an informed choice to regarding any current or future purchase of our intelligence software giving those businesses the tools they need to take a deep dive into the companies they work with. Gain a thorough understanding of their financial performance, protect themselves from fraud, and be instantly notified of any ongoing developments or changes as well as the interests of the recipient.

How important are those benefits?

The benefits are indirect. We do not claim that they are an important component of our legitimate interest.

What would the impact be if you couldn’t go ahead?

We would be limited to communicating only with businesses who are already aware of our business and had explicitly opted in. This would have a material impact on our ability to grow our business. It could damage the success of our business going forward and open up our existing customers, as well as potential new clients, to engaging with firms less competent, qualified and experienced as us.

If the Business could not provide direct marketing material, newsletters and updates to the categories of data subject identified this would limit their access to our products and limit their ability to access information about the innovations, developments and new products provided by Us.

Would your use of the data be unethical or unlawful in any way?

No. Our use of the data would be in no way unethical or unlawful – and we would never send out needless spam. Instead, we aim to send out communications no more than once per week, most likely every fortnight or month, and they would always be safe, relevant and appropriate to the recipient’s business needs.

Necessity Test

Does this processing actually help to further that interest?

Yes. It allows us to expand our direct marketing activities. This processing helps to further the interests of both our business and our customers’/potential customers’.

Is it a reasonable way to go about it?

Yes. It is in line with normal B2B marketing industry practice. Our direct marketing communications are a reasonable way to approach potential and existing customers, with safe, relevant and appropriate content.

Is there another less intrusive way to achieve the same result?

No. We believe that direct email marketing is the least intrusive way to communicate with existing and potential customers whose businesses would benefit greatly from our range of products and services. Processing activity enables us to personalise our marketing content and generate engagement with it that is relevant to individuals.

Any explicit unsubscribe requests are noted and dealt with accordingly. When updating mailing lists We do not re-add anyone who has unsubscribed

Balancing Test

What is the nature of your relationship with the individual?

We make unsolicited communications where there is an existing or potential commercial relationship, including partnerships to jointly provide services to others. We make solicited communications where third party data providers have providers have provided such data and data records to enable Us to make such communications.

• Existing client 
• Previous client (still relevant re qualification) 
• Current employee/associate/partner 
• A prospect lead that is in discussions with the Business about future service provision 
• A new lead sourced by telesales activity or via a direct enquiry
   
  Two-way relationships between Us and the individual include: 
• ongoing relationships with existing clients; 
• periodic relationships with previous clients (still relevant re qualification); 
• ongoing relationships with current employees/associates/partners; 
• leads that have made an enquiry or have been contacted by the Business.

As such have either done business with the individual previously, been given permission to contact them or they opted in to receiving our communications via our website and accordingly we are we are confident that we have a legitimate interest to contact them with news, products or services we believe will benefit the successful operation of their business as per this Legitimate Interests Assessment.

What is the nature of the data to be processed? Does data of this nature have any special protections under UKGDPR?

Only relevant data is processed including:

• Contact data 
• Role-specific information such as job title, industry/sector, business change area of interest/s 
• Organisational business change-related needs 

No Special Categories of Personal Data are processed.

Is any of the data particularly sensitive or private?

No. It is either publicly available or has already been collected through direct contact with the individual, e.g. exchange of business cards or emails. We only retain the name, email address, company name and job title of the people we send direct marketing communications to – none of which is particularly sensitive and certainly not private.

Would people expect you to use their data in this way?

Yes. We believe that everyone on our contacts list would not just expect us to use data in this way, but more often than not be pleased to hear about the products and services we can offer them to help their business.

In the case of direct marketing and email marketing to business contacts, the legitimate interest is not overridden by the interests of the individual, who as a business person with decision making and budgetary responsibilities can reasonably expect to be contacted with marketing information relating to his or her professional role. The information is highly relevant to the business or individual job role. The individual is presented with their right to object at the point of collection and subsequently thereafter, if they no longer wish to receive this information. During the sales process or client discussions we make it clear that we will share marketing information with them that is relevant to their role and/or industry.

Is there any imbalance in who holds the power between the organisation and the individual?

No imbalance and individuals are able to object to processing/review the information the Business holds on them/amend the information We hold on them at any time via clearly signposted links in emails and in our privacy policy on our website.

Are you happy to explain it to them?

Yes. We are happy to explain the way we use data to them, and indeed are explicitly clear with this in this LIA and our Privacy Policy, which can be found on our website.

Are some people likely to object or find it intrusive?

People may of course choose to opt-out, but we believe that it is highly unlikely that the collection and processing itself would be considered objectionable or intrusive. We believe it is very unlikely that anyone would object to our data handling or find our communications intrusive, but we always give recipients of our emails the opportunity to unsubscribe and, if they do so, we will immediately remove them from our contacts list.

Any explicit unsubscribe requests are noted and dealt with accordingly. When updating mailing lists We do not re-add anyone who has unsubscribed.

The processing is not intrusive or inappropriate. The Business takes a highly targeted approach to data processing for sales and marketing purposes. Data subjects are stringently qualified before being contacted for direct or email marketing purposes. 

The Business does not data mine or profile data.

What is the possible impact on the individual?

There is minimal negative impact. There is likely to be no real negative impact on the individual – the greatest possibility is that they discover something on our communications that has a positive impact on their business. 

A direct result of the processing is that the individual gains knowledge of relevant business change-related practices to use in their role; and understanding how products or services which the Business offers can add value to their organisation and help fulfil their business objective

How big an impact might it have on them?

Processing is not likely to negatively impact the individual’s interests and/or rights. Subjects’ have complete control over their data and can exercise this at any time In the unlikely event of a breach, the impact to the individual would be low based on the type of data that we process. The likely worst impact would be the inconvenience of opting out of our database.

Are the interests of the individual aligned with the party looking to rely on their legitimate interests for the processing?

The Business stringently qualify leads before processing their data to ensure the benefits to the Business are aligned to those of the subject. Qualification criteria applied:

• the subject’s organisation buys / has previously bought business change services from consultancy businesses; 
• the organisation has attributes that drive change that will benefit from Our services; 
• the organisation has a current/future need to deliver change that will require Our services; 
• the individual is the right person/role to make decisions and build relationships with Us

Are you processing children’s data?

No. We never process children’s data.

Are any of the individuals vulnerable in any other way?

Not that we are aware of – and our practices would never put them in any sort of danger or cause them harm.

Is the processing likely to result in unwarranted harm or distress to the individual?

The processing will not result in unwarranted harm or distress to the individual. Subjects’ have complete control over their data and can exercise this at any time. The data is regularly reviewed to ensure it is processed in line with the data protection principles. The data is secured by the methods detailed in our data security policy.

Can you adopt any safeguards to minimise the impact?

The scope of the processing activity has already been assessed to ensure the lowest possible impact to the individual in terms of privacy risks. The processing is minimal and directed at a business email address or contact number so the privacy risks related to this type of processing are relatively low in likelihood and impact. To ensure We have assessed all underlying risks fully, we have completed where required a Privacy Impact Assessment. We ensure the content of our communications is always relevant and appropriate to our recipients.

For sales and marketing where we only process contact and role- /organisation-specific information there is always a privacy policy statement and link to the full privacy policy in our emails

What existing safeguards are in place?

• DATA MINIMISATION 
  • Data only kept as long as there is legitimate business reason and subject remains fully qualified 
  • Minimum data held to fulfil sales and marketing activity and only relevant data 
  • No Special Categories of Personal Data stored 
• OPT OUT OPTIONS / SUBJECTS’ RIGHTS 
  • Clearly signposted in all sales and marketing emails, in web privacy policy, and verbally during telesales activity 
• ANNUAL TRAINING OF SALES AND MARKETING TEAM 
  • One single compliant process is followed for the processing of data 
  • Frequency of contact from the Business to individuals is kept to an absolute minimum and only to communicate relevant information for individual 
  • Smooth, manual process for handling opt outs and suppression list 
  • Smooth process and transparency for data subject enquiries 
• PRIVACY BY DESIGN (PIA) 
  • We carry out regular Privacy Impact Assessments 
  • Risks are minimised as we only have two third party processing systems for sales and marketing purposes (Pipedrive and Mailchimp) 
  • Highly targeted approach and low volume of stringently qualified data being processed by dedicated close-knit team 
  • We have strict cyber security processes to ensure data is secure and privacy is not compromised 
• WE DON’T SPAM OR BOMBARD INDIVIDUALS 
  • the number of calls and emails made to individuals is limited in terms of frequency and volume so as not to cause inconvenience

Would the processing limit or undermine the rights of individuals?

The processing does not limit or undermine the rights of the individual. Subjects’ have complete control over their data and can exercise this at any time. The data is regularly audited to ensure that the processing is still relevant to them.

Would there be a prejudice to Us if processing does not happen?

We would be restricted in: 

• generating new sales opportunities; 
• Engaging with sales leads and clients on a regular basis to maintain relationships; 
• nurturing sales leads and clients to keep Us in mind for potential sales opportunities relevant to the individual’s needs.

Can you offer an opt-out?

Yes, all communications will allow for a clear opt-out.

Any explicit unsubscribe requests are noted and dealt with accordingly. When updating mailing lists We do not re-add anyone who has unsubscribed

Privacy Policy

The Business has included reference to this assessment within its privacy policy to show that we are relying on legitimate interests to process data.

Privacy Outcome of Assessment

We believe that this Legitimate Interest Assessment proves Our ability to use Legitimate Interest as the lawful basis for processing sales and marketing data based on the following:

• In the case of direct marketing and email marketing to business contacts, the legitimate interest is not overridden by the interests of the individual, who as a business’ person with decision making and budgetary responsibilities can reasonably expect to be contacted with marketing information relating to his or her professional role. 
• Subjects are highly qualified and targeted to ensure there is a true legitimate interest to the business before contact is made 
• We adhere to strict data minimisation rules, only collect role-specific information and never process special categories of personal data
• Data is regularly cleansed and audited to ensure relevancy and ongoing legitimate interest
• Tight policies and procedures are in place to ensure subjects are able to exercise their rights, including their right to object, be erased, correction etc. 
• We have strict cyber security processes around data storage and processes to follow in the event of data breach. Privacy risk is minimised in this instance as we do not process special categories of personal data and only hold role-specific information for sales and marketing purposes. 
• We have built a reputation as though leaders in our industry; it’s in our interest, as an organisation, to ensure marketing and sales content is up-to-date, highly relevant and useful to our audiences and their roles/organisations. We only send marketing emails, on average, once a month
• We do not supply data for marketing purposes to any third parties

CLOSING STATEMENT

The Business statement on the data/contacts we hold

All of the contacts in our records have, to our greatest possible knowledge and genuine business intentions, a role within their organisation which means they are either directly or indirectly responsible for the purchase and/or use of our products and services, or have a legitimate, genuine and relevant interest in the products and services we offer from a business perspective.

This is based on previously doing business with these contacts, receiving inquiries from them/having an existing open dialogue with them already about services, having received their details from TP Data Providers or, in some cases, identifying them from our own in-house research based on the relevance of our services to their business needs.

This is to the extent that our would our products and services are integral to the success of their businesses and the operational running of their businesses therein. The products and services we offer can have a direct impact on improving the businesses we serve.

We have no reason to believe that the way we process our data carries any particular risks whatsoever to the contacts involved. We take great to ensure that our contacts lists are maintained in safe, secure spaces and we only intend to use these contacts to send them direct marketing materials (and nothing else non-business-related) from our business that relate specifically to products and services which are relevant to their businesses. We also ensure that we never ‘bombard’ our contacts with news, offers and information, and have absolutely no intention of ‘spamming’ them. Instead, we believe that it is only necessary to contact them when we have a legitimate reason for doing so, and thus intend to only do so one or two times per month at most. 

We offer our contacts the opportunity to opt out of receiving our email communications in every email we send and if they inform us that they do not wish to hear from us any more in a direct marketing context, we remove them from our lists/archive their details to ensure their wishes are adhered to.