Effective date: 26 October 2026

1. For whom this notice is intended

This notice explains how we handle the personal data of business contacts and decision-makers we approach in a professional capacity, where we obtained your details from third-party sources rather than from you.

2. Who is responsible for your data

CEX.IO companies run this outreach for their own markets, and the company responsible for your personal data is the one whose outreach reached you. Where the position below differs between markets, it is marked.

United Kingdom market. CEX.IO Markets UK Ltd (company number 15140258), 78–79 Pall Mall, London SW1Y 5ES, United Kingdom, ICO registration ZC187035. It is the controller of your personal data under United Kingdom data protection law.

United States market. CEX.IO Corp., 100 SE 2nd St, Suite 3852, Miami, Florida 33131, United States.

Data protection contact: dpo@cex.io. 

If you go on to open an account or enter a commercial relationship, the CEX.IO entity that contracts with you becomes responsible for the personal data processed in that relationship, under its own privacy notice. That may be one of the entities above or, where the product is available and you choose to onboard to it, another company within CEX.IO. Their privacy notices are published at https://cex.io/legal/privacy.

Where CEX.IO provides business-to-business platform services (https://carabaas.com/legal/privacy-policy.html), the contracting CEX.IO entity processes personal data on the client’s instructions and not for its own purposes, acting as the client’s processor under the data processing terms of the service agreement rather than under this notice.

3. What personal data we process

• Professional identity – name, job title and seniority.
• Corporate contact details – work email address and employer or company name. A business telephone number may be present in a record we obtain, or you may give it to us; we do not add telephone numbers by enrichment and we do not use them for automated calling.
• Professional profile – your public professional-network profile address.
• Correspondence and engagement – the content of any reply you send, and whether a message was delivered, opened or clicked.

We do not process special category data, criminal offence data, home addresses or payment details in this pipeline.

4. Where we obtained your data

• Commercial business-contact databases, specifically Apollo.io (ZenLeads, Inc.).
• Publicly available professional profiles, including through LinkedIn Sales Navigator.
• Other commercial sources and public registers, where we use them. The current list is available on request.

5. Why we process it, and on what legal basis

Before you respond. We identify decision-makers at companies that may have use for CEX.IO’s products and make an introductory approach by email or on a professional network. United Kingdom: the legal basis is legitimate interests (Article 6(1)(f) UK GDPR) – our interest in finding prospective corporate customers, balanced against your interests, and limited by the controls described in this notice. Those controls are applied to every approach we make, in every market.

Email – United Kingdom. We rely on the position under PECR Regulation 22 that a message to a work address at your employer’s domain is sent to a corporate subscriber.

Email – United States. Our commercial emails carry a valid postal address and a clear way to opt out, and opt-outs are actioned within ten business days or sooner, as the CAN-SPAM Act requires.

Professional networks – every market. Our first contact is a connection request containing no commercial content; a commercial message follows only after you have replied.

In every message, on either channel and in every market, we identify ourselves and give you a way to stop hearing from us.

After you respond. If you reply, we keep a record of the exchange and manage the commercial dialogue in our customer relationship management system. United Kingdom: the basis remains legitimate interests, maintaining accurate records of business dealings, and your right to object continues to apply.

6. Who we share it with

• Our processors, acting only on our instructions. These may be third-party vendors or other companies in the CEX.IO group, and cover sales data sourcing and enrichment, campaign orchestration, email and professional-network sequencing, and customer relationship management. The current list is available on request.
• Other companies in the CEX.IO group, where your enquiry is passed to the entity that would serve you.
• Partners, vendors and professional advisers who support these functions, under contract and only as needed.

We do not sell your personal data, and we do not share it with organisations outside CEX.IO for their own marketing.

7. International transfers

Some of these recipients are outside the United Kingdom. Where personal data is transferred out of the United Kingdom to a destination not covered by United Kingdom adequacy regulations, the transfer is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, under an IDTA, or under the UK Extension to the EU–US Data Privacy Framework where the recipient is certified. 

8. Automated processing and artificial intelligence

We use automated tools to enrich and score business contact records so that our outreach is relevant, and model-backed features to help draft and classify messages. These support decisions taken by our team members. We do not take decisions about you by solely automated means that produce legal effects or similarly significantly affect you. Their use is assessed in advance and is limited to the purposes described in this notice. Providers acting on our behalf do so as processors under contract. Our people remain responsible for the outreach; these tools support their work rather than replace their judgement.

9. How long we keep it

• If you do not reply – erased from our outreach tools within 90 days of the final message.
• If you opt out – removed from campaign queues and the rest of the record erased; we keep a hashed identifier on a suppression list so that our tools continue to recognise your objection.
• If you reply and enter our records – kept for the commercial evaluation and reviewed after 24 months of inactivity.

The databases we source from hold their own records of business contacts for their own purposes, independently of us. Removing your record from our systems does not remove it from theirs; each operates its own removal route.

10. Your rights

You have the right to object to direct marketing at any time (Article 21(2) UK GDPR) — use the unsubscribe link in any email, or reply to any message to say you do not want to be contacted — and the rights of access (Article 15), rectification (Article 16), erasure (Article 17) and restriction (Article 18). To exercise any of them, write to dpo@cex.io. United Kingdom: these rights arise under United Kingdom data protection law. Other markets: you have the rights given to you by the data protection or privacy law that applies to you. The option to stop receiving our messages is available in every market.

11. Complaints

Write to us at dpo@cex.io in the first instance.

United Kingdom. You may also complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom: +44 (0)303 123 1113, www.ico.org.uk.

Other markets. You may also be able to complain to the data protection or privacy authority where you live.