Yellowdesk

Privacy notice

Last updated 2026-07-13

Draft. Not binding legal text.

This is the structure our compliance analysis requires, written out so the gaps are visible. The binding text is a legal deliverable: it must be written by counsel and translated professionally, not by us.

Who we are

We operate a sales-intelligence service for recruitment agencies. It identifies companies that are likely to be buying recruitment services, and lets a recruiter obtain the business contact details of the people who make that decision.

For the business contact data described below we act as a CONTROLLER, not a processor. That is the honest characterisation and it is the one that carries the obligations.

What we hold about you

If you are a decision maker at a company that hires: your name, your job title, your employer, your business e-mail address, your business phone number and your LinkedIn profile URL.

We hold this in a professional capacity only. We do not hold, and do not want, anything about your private life.

Where we got it

We did not get it from you. We obtain it from third-party business-contact data vendors, who compile it from public professional sources.

Every record we store carries the name of the vendor it came from and the date we retrieved it. If you ask us where a specific record came from, we can tell you, and we will.

Our lawful basis, and why we did not e-mail you

We process your business contact data on the basis of legitimate interests (GDPR Art. 6(1)(f)). We have carried out a Legitimate Interests Assessment.

GDPR Art. 14 would normally require us to contact you and tell you we hold your data. We rely on the exemption in Art. 14(5)(b): doing so for every person in the database would involve disproportionate effort.

That exemption is not a way out. It obliges us to take appropriate measures instead, INCLUDING making this information publicly available. This notice, and the opt-out page linked from it, are those measures. They are the reason you are reading this rather than receiving an e-mail from us.

How long we keep it

A contact record revealed to one of our customers is retained for 180 days from the date we retrieved it. After that, the e-mail address, the phone number and the LinkedIn URL are redacted from every account that holds them.

We do not retain revealed contact details indefinitely. A five-year retention window is exactly what the French regulator fined a competitor for.

Your rights, and the one that actually matters here

You have the right of access, rectification, erasure, restriction, portability and objection.

In practice the right you want is objection, and we have built one route that delivers all of them: the opt-out page. Ask to be suppressed and we purge your details from every customer account that holds them, including customers who already paid to see them, and we never enrich you again. It is permanent and we cannot undo it.

We action suppression requests within 30 days.

Who else sees it

Our sub-processors, listed publicly and kept current: our hosting, database, payment, e-mail, analytics and error-tracking providers, and the contact-data vendors named on each record.

Where we use a language model, it is hosted in the EU, and contact data is never sent to it. Only job advertisement text is.

Complaining

You can complain to your national supervisory authority. You do not have to come to us first, though we would rather you did, because we can fix it faster.

  • Privacy notice
  • Terms of service
  • Sub-processors
  • Contact opt-out