GDPR

There are no GDPR issues with Intent Leads

When we say "We are US-only, so GDPR doesn't apply", some people have follow-up questions. Here are the answers.

Overview of how Intent Leads doesn't relate to GDPR

Intent Leads is a US data product, resolving US data subjects.

Every person Intent Leads supplies, whether an intent lead, a Search result or an identified website visitor, is a person located in the United States. Intent signals come from US web reading, and website visitor ID only resolves US visitors. In other words, we don't have any product or service that is directed to the EU or the UK in a way that might even theoretically subject our services to the GDPR (or UK GDPR).

There are perhaps theoretical edge cases where our customers might themselves be subject to the GDPR. For example, a UK agency running outreach to US prospects is subject to the UK GDPR for its own processing, because it is established in the UK. That's something the customer would generally know, and we have an addendum for it (see below).

Aren't you collecting EU IP addresses to know when to identify a visitor?

That data collection is incidental and not tied to any product or other data. The relevant point is that we don't do anything with data that happens to come from the EU or UK: visitors located in the UK, the European Economic Area or Switzerland are never identified, never turned into a lead, and never delivered to you.

In other words (in GDPR terms), we don't have an "establishment" in Europe or the UK, because we don't engage in "the effective and real exercise of activities through stable arrangements", i.e. commercial arrangements, there. And we don't monitor the behavior of people in the EU or UK: no EU or UK data is involved in the products and services we offer.

What about an EU or UK citizen living in or traveling to the US and visiting my site?

Intent Leads only supplies people with a US location. Our data is designed to exclude personally identifiable information (such as emails and phone numbers) of EU or UK residents, wherever they happen to be at a given moment. That is not information we license into Intent Leads, and so it is not information we license out.

There may be rare instances where a data supplier inadvertently provides information about an EU or UK resident (for instance, a person with dual residency). But our services themselves are not directed at including that information, or marketed as doing so. So we avoid being a service directed to the EU or UK that is subject to the GDPR and similar laws.

I'm a multinational, or my company is based in the UK or EU. What about me?

Our customers generally use our US data to market US-directed products and services to US businesses and consumers.

If your company is established in the UK or the EU, the UK or EU GDPR may apply to your own use of the data, even though the people in it are in the US. If so:

• Our DPA already covers you. Its Schedule 1 (UK, EEA and Swiss terms) applies automatically when you accept our Terms. It covers the lists you upload to us and the UK or EU transfer rules (EU Standard Contractual Clauses and the UK International Data Transfer Addendum). There's nothing extra to sign, and you can download an executed copy under Settings → Legal.
• Give the people you contact a short privacy notice. Our Data Sources Statement explains where the data comes from and includes suggested wording.
• Use a consent tool on your website. If you run the visitor ID snippet on a website operated from the UK or EU, you MUST use a consent management tool so that the snippet loads only after the visitor accepts. See Cookie Consent.

If you are marketing UK- or EU-specific products from the UK or EU, you may wish to consult an attorney about whether the GDPR applies to you. That is a tricky question and can depend on the facts.

This is not legal advice. Consult a privacy attorney if you want more information about Intent Leads and the GDPR.

Questions? Contact support@intentleads.si.