Privacy Policy

Welcome to OutputX (“we”, “us”, “our”). We are committed to protecting your personal data and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation (EU GDPR) and other relevant data protection legislation.

This Privacy Policy explains how we collect, use, store, and share your personal data when you access or use the OutputX web application and related services (the “Service”). Please read it carefully.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

OutputX is the data controller responsible for your personal data. If you have any questions about this Policy or how we handle your data, please contact us at:

Data Controller: Lab11 Limited Email: support@outputx.ai Postal Address: 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE

If you are based in the European Economic Area (EEA), we have appointed a representative for GDPR purposes. Please contact us at the address above for details.

We collect and process the following categories of personal data:

3.1 Account Information

• Full name
• Email address
• Password (stored in hashed, encrypted form)
• Profile information you choose to provide

3.2 Payment and Billing Data

• Billing name and address
• Payment card details (processed and stored by our third-party payment processor; we do not store full card numbers)
• Transaction history and invoices
• VAT number (where applicable)

3.3 Usage and Analytics Data

• Log data (IP address, browser type, operating system, referring URLs)
• Pages and features accessed, time and duration of visits
• Clickstream data and in-app interactions
• Device identifiers
• Error logs and diagnostic data

3.4 Enriched Contact Data

Where we provide lead generation or sales enrichment features within the Service, we may source and process the following data about business contacts on behalf of our customers:

• Business email addresses
• Direct-dial and business telephone numbers
• Job title, seniority, and department
• Employer name and company information
• LinkedIn profile URL and other publicly available professional information

This data is sourced from third-party data enrichment providers, specifically Apollo.io and Enrich.so (see Section 4). It relates to individuals in a professional capacity and is used solely for legitimate B2B outreach purposes.

3.5 Communications

• Messages and enquiries sent to our support team
• Survey responses and feedback you provide voluntarily

We collect personal data in the following ways:

• Directly from you — when you register for an account, subscribe to a plan, make a payment, contact support, or otherwise interact with the Service.
• Automatically — through cookies, log files, and similar tracking technologies as you use the Service (see Section 10 on Cookies).
• From third parties — including payment processors (e.g. Stripe), analytics providers (e.g. Google Analytics), and authentication providers where you choose to use single sign-on (SSO).
• From data enrichment providers — we use Apollo.io and Enrich.so to source business contact information such as professional email addresses and telephone numbers for B2B lead generation purposes. Both providers compile data from publicly available sources and professional networks. Where required by applicable law, individuals whose data is sourced in this way will be informed at the point of first contact in accordance with Article 14 of the UK GDPR.

We process your personal data for the following purposes and on the following legal bases under UK GDPR:

Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests are not overridden by your rights and freedoms. You may request details of this assessment by contacting us.

Where we rely on consent, you may withdraw your consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

We will only send you marketing emails or product updates where you have explicitly opted in to receive them. You may unsubscribe at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at support@outputx.ai.

We do not sell your personal data to third parties for their marketing purposes.

7.1 How We Use Enrichment Providers

OutputX uses Apollo.io and Enrich.so to source professional contact data — including business email addresses and telephone numbers — to provide lead generation and sales enrichment features within the Service. This data relates to individuals acting in a professional capacity and is used exclusively for B2B outreach.

7.2 Lawful Basis

We rely on legitimate interests as our lawful basis for processing enriched contact data, having conducted a Legitimate Interests Assessment (LIA). Our legitimate interest is to enable our customers to conduct targeted, relevant B2B outreach to individuals in roles likely to have a professional interest in the products or services being offered.

We are satisfied that this interest is not overridden by the rights and freedoms of the individuals concerned, given that:

• The data relates to individuals in their professional capacity, not their private lives.
• Outreach is targeted and relevant to the individual’s professional role.
• Individuals are informed of the source of their data and their right to object at the point of first contact.

7.3 Notice to Individuals (Article 14 UK GDPR)

Where data is obtained from Apollo.io or Enrich.so rather than directly from the individual, we are required by Article 14 of the UK GDPR to provide certain information to that individual. We fulfil this obligation by:

• Including a clear statement in all first-contact communications disclosing that their contact details were sourced via Apollo.io and/or Enrich.so.
• Providing a link to this Privacy Policy in all such communications.
• Informing the individual of their right to object to processing and to request erasure.

7.4 PECR Compliance

The Privacy and Electronic Communications Regulations 2003 (PECR) apply to electronic marketing communications in addition to UK GDPR:

• Emails to corporate addresses (e.g. name@company.com) — permitted under legitimate interests, provided every communication includes a clear and easy mechanism to opt out.
• Emails to individual/personal addresses (e.g. Gmail, Hotmail) — require prior consent under PECR, even in a B2B context. We will not send unsolicited emails to personal addresses without consent.
• Telephone calls — we screen all telephone numbers against the Telephone Preference Service (TPS) register prior to making outbound calls, as required by PECR. We will not call numbers registered with the TPS without prior consent.

7.5 Opt-Out and Suppression

Any individual who objects to being contacted or requests erasure of their data will be:

• Removed from active outreach immediately upon request.
• Added to our suppression list to prevent future re-enrichment or re-contact via any provider.
• Responded to within one calendar month in accordance with their UK GDPR rights.

To opt out or submit a data removal request, please contact us at support@outputx.ai.

We may share your personal data with the following categories of recipients:

• Service providers and sub-processors — third parties who process data on our behalf (e.g. cloud hosting providers, payment processors, analytics providers, customer support tools). These parties are contractually obligated to protect your data and process it only on our instructions.
• Data enrichment providers — we use Apollo.io (Apollo.io, Inc., USA) and Enrich.so to provide business contact enrichment features within the Service. These providers act as data processors under our instructions and are subject to Data Processing Agreements. Apollo.io transfers data outside the UK/EEA under appropriate safeguards including Standard Contractual Clauses. You may review Apollo’s privacy policy at apollo.io/privacy-policy and Enrich.so’s at enrich.so/privacy.
• Professional advisers — solicitors, accountants, auditors, and insurers where necessary in the course of professional services they provide to us.
• Regulatory authorities and law enforcement — where we are required to do so by law, court order, or to protect the rights, property, or safety of Lab11 Limited, our users, or others.
• Business transfers — in the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to the relevant third party. We will notify you in advance of any such transfer.

We do not sell, rent, or trade your personal data to any third party.

We are based in the United Kingdom. Some of our third-party service providers operate outside the UK or EEA. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs) or EU Standard Contractual Clauses (SCCs), as applicable.
• Transfers to countries that have received an adequacy decision from the UK Government or European Commission.

This includes transfers of enriched contact data processed by Apollo.io, which is based in the United States. Such transfers are subject to appropriate safeguards including Standard Contractual Clauses.

You may request further information about international transfer safeguards by contacting support@outputx.ai.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting obligations.

When data is no longer required, we securely delete or anonymise it.

We use cookies and similar technologies to operate the Service, analyse usage, and (where you have consented) deliver personalised content.

Types of cookies we use:

• Strictly necessary cookies — essential for the Service to function. No consent is required.
• Analytics cookies — help us understand how users interact with the Service (e.g. Google Analytics). Set only with your consent.
• Preference cookies — remember your settings and preferences. Set only with your consent.
• Marketing cookies — used to deliver relevant advertising. Set only with your consent.

You can manage your cookie preferences at any time via the cookie settings banner on our website, or by adjusting your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encryption of data in transit (TLS) and at rest (AES-256)
• Access controls and role-based permissions
• Regular security testing and vulnerability assessments
• Staff training on data protection obligations

No method of transmission over the internet is entirely secure. Whilst we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours and inform affected users without undue delay where required by law.

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to request correction of inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) — to request deletion of your personal data in certain circumstances.
• Right to restrict processing — to request that we limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format and transfer it to another controller.
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes. This right applies in particular where your contact details were sourced via Apollo.io or Enrich.so.
• Rights related to automated decision-making — not to be subject to solely automated decisions that produce significant legal or similarly significant effects, without human review.
• Right to withdraw consent — where processing is based on consent, to withdraw it at any time.

To exercise any of these rights, please contact us at support@outputx.ai. We will respond within one calendar month of receiving your request. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk Telephone: 0303 123 1113 Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are based in the EEA, you may also lodge a complaint with your local supervisory authority.

The Service is not directed at children under the age of 13 (or under 16 where the relevant jurisdiction requires a higher age of digital consent). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take steps to delete such data promptly.

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies before providing any personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. Where changes are material, we will notify you by email or via a prominent notice within the Service at least 30 days before the changes take effect. The “Last updated” date at the top of this Policy will always reflect when it was most recently revised.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Data Protection team:

Email: support@outputx.ai Post: Data Protection, Lab11 Limited, 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE

We aim to respond to all enquiries within 5 business days.