Data Sources Statement

This statement explains where Intent Leads data comes from and how it is handled, so customers can complete their own privacy notices (for example under Article 14 UK GDPR), legitimate interests assessments and vendor reviews. It supplements our Data Protection Addendum.

1. Who supplies it

Intent Leads is operated by DBEE, Inc., a US company. The intent signals, contact data and website visitor matches come from licensed US data providers (our "data providers"), under written distribution licenses. They are contractually bound to comply with applicable law, and to send us suppression and deletion instructions, which we pass on to customers. DBEE adds its own checks (for example title-casing, de-duplication across exports and suppression of removed people) and, for website visitors, public professional profile details.

2. What the data covers

Intent Leads is a US-only data service (see GDPR). It does not supply data about people in the UK, the EEA or Switzerland, or data about children. Intent topics are business topics (for example "outsourced SDR teams") or consumer topics (for example "roof replacement" or "life insurance"). Topics may include sensitive areas; customers who choose them are responsible for using the data lawfully (see section 5 of the Terms of Service). We don't currently offer consumer topics about health conditions, mental, reproductive or sexual health, medicines or substance use. People can appear in their business capacity, as consumers, or both: their contact details can include a personal email address and personal mobile numbers as well as work ones, and each person can come with household details such as age range and estimated household income (section 4).

3. Intent signals

• What a signal is: a record that a person read web content about a business or consumer topic (for example "outsourced SDR teams" or "roof replacement") on a given day, with a strength (low, medium, high) and score.
• What a signal is not: an inquiry, an opt-in or consent to be contacted. A consumer who reads about roof replacement has shown interest, not asked anyone to call.
• How it's collected: our data providers observe visits to web content across websites that use their technology and those of their own data suppliers and identity partners (using first-party cookies, hashed email identifiers, IP address and browser data), and classify the content against a taxonomy of business and consumer topics.
• How a reading event is tied to a person: by deterministic identity resolution, for example a hashed email address the person used, rather than probabilistic "looks like" guessing from device or IP alone.
• Freshness: refreshed daily. A signal is dated and drops out after about two weeks.
• What customers receive: the person's contact details (section 4) plus the topics matched, the strength and score, and the first and last dates seen. Customers do not receive the pages read or the sites they were read on.

4. Contact data, including mobile numbers

• Sources: compiled by our data providers from their data suppliers and identity partners, from websites that use their technology, and from publicly available sources.
• What's included: business email (with a validation status), personal email when we have one, mobile, direct and company phone numbers (each mobile with a do-not-call flag), and LinkedIn profile.
• Household details: home city, state and ZIP code; age range; gender; household income and net worth bands; and whether the person owns their home, is married or has children at home. Income and net worth, and some of the other household details, are estimates our data providers model from other data, not facts the person gave. Like all Output Data they are for sales and marketing only, never for decisions about credit, insurance, employment or housing.
• Checks: validation statuses and do-not-call flags are as supplied at the time of export. They are informational and can be out of date: the customer must still do its own do-not-call and consent checks before calling or texting, including the consent the TCPA and state telemarketing laws require for automated calls and texts to consumers (see "Marketing to consumers" in section 7 of the Terms of Service).
• Where a person has more than one mobile number, customers receive all of them, each with its own flag.
• Personal email addresses need more care than work ones. Many laws treat marketing to a personal address more strictly: in the UK and EU, sending marketing email to an individual's personal address generally needs their prior consent, and Canada's CASL works the same way. In the US, CAN-SPAM applies to both. Customers must check the rules that apply to them before emailing a personal address.

5. Website visitor ID

• The customer installs a script on its own website. It sets a first-party cookie and sends page-visit events (page, time, browser, device and IP-derived location) for identification.
• A US visitor is matched to a person by deterministic identity resolution against the same licensed identity data as above. Visitors in the UK, EEA and Switzerland are never identified.
• The snippet may synchronize pseudonymous identifiers (such as a hashed email, together with IP address and consent signals) with our data providers' identity partners, to support identification. This honors opt-outs and the Global Privacy Control signal.
• Browsers that send the Global Privacy Control signal are not identified: no identity is attached to their visits.
• For identified visitors with a LinkedIn profile, DBEE adds public professional profile details (photo, headline, current title, company and location), checked just after the visit through a profile data service.
• The customer is responsible for the notice and consent its website needs (see Cookie Consent).

6. Opt-outs and removals

• Opt-out and deletion requests made to us, to our data providers, or through California's DROP are applied to the data before it is supplied. The Global Privacy Control signal works per browser: it stops website visitor identification for that browser (section 5); to opt out of the database itself, a person makes a request as below.
• When a person asks to be removed, DBEE clears their details in Intent Leads and notifies every customer who received them (dashboard, API, removals webhook and email). Customers must delete or suppress them within 10 business days.
• Anyone can ask DBEE what data it holds about them, or ask to be removed, at https://intentleads.si/your-privacy-choices or privacy@intentleads.si.

7. Suggested wording for a customer's privacy notice

Customers are independent controllers of the data they receive and must give their own notice. A UK-established customer is subject to the UK GDPR even when the people it contacts are in the US. Article 14 then requires it to tell people, among other things, where their data came from, what it will be used for, its legitimate interest, how long it keeps the data, and their rights, including (since 19 June 2026) the right to complain to the customer itself. The wording below covers those points for business-to-business outreach (if you contact people as consumers, say that instead). Adapt it and have your adviser check it.

Business contacts we did not get from you. We obtain business contact details (name, job title, employer, business and personal email, business and mobile phone numbers, professional profile), household details (such as home city, age range and estimated household income) and business-interest signals (business topics a person has recently researched online) from Intent Leads, a service of DBEE, Inc. (USA), which licenses them from US data providers. We use them to contact business people about products and services relevant to their role. Our lawful basis is our legitimate interest in business-to-business marketing; we have assessed that this does not override your interests, and you can ask us for that assessment. We keep these details for [period] after our last contact with you, and delete or suppress them earlier if you object. You can object to this use at any time (we will stop), and you can ask for access, correction, deletion or restriction, by replying to any message from us or writing to [contact]. You can complain to us at [contact], and to the Information Commissioner's Office (ico.org.uk). You can also ask DBEE directly at privacy@intentleads.si.

Timing: give this information within a reasonable period and at the latest within one month of getting the data, or in the first message if you contact the person sooner. The usual way is a short line with a link in the first message. Since 2026, a controller relying on the "disproportionate effort" exemption instead must publish the information and record why the exemption applies; for targeted outreach, the first-message route is simpler and safer.

Customers relying on legitimate interests should keep a written legitimate interests assessment. Since the Data (Use and Access) Act 2025, the UK GDPR says direct marketing may be a legitimate interest, but the balancing test still applies.