Privacy at a glance
- We never sell personal data, and we never sell or rent the contact data members exchange.
- Prospects' contact details are only shared after they opt in to an introduction.
- You can export or delete your data at any time from Settings → Privacy.
- Data is hosted in the EU (Frankfurt) with encrypted backups in Ireland.
01Who we are
8connections Ltd. ("8connections", "we", "us") is the controller of the personal data described in this policy, except where we state that we act as a processor. We are registered in England and Wales (company no. 14820887) at Unit 8, 120 Bermondsey Street, London SE1 3TX, United Kingdom, and registered with the UK Information Commissioner's Office (ICO).
Our EU representative under Article 27 GDPR is 8connections Europe B.V., Keizersgracht 88, 1015 CT Amsterdam, the Netherlands. You can reach our Data Protection Officer at privacy@8connections.com.
02Scope of this policy
This policy applies to personal data we process when you visit 8connections.com, use our web and mobile apps, APIs and integrations (the "Service"), contact us, attend our events, or are referred to as a prospect through the Service. It does not apply to third-party websites or services you connect to the Service, which have their own policies.
If you use the Service through a Teams Workspace, your organisation may also act as a controller of certain data, and our processing on its behalf is governed by our Data Processing Addendum.
03Data we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, work email, password hash, phone (optional), profile photo | You |
| Professional profile | Employer, job title, territory, industries, ICP, products sold, deal size, languages | You; professional networks you connect |
| Verification | Email confirmation records, employer domain checks, verification status | You; verification providers |
| Network & activity | Matches, connections, intro requests, Lead Briefs, Credits, reputation signals, Deal Room activity, messages | Your use of the Service |
| CRM data | Deal names, stages, amounts and account names for synced opportunities | Integrations you enable |
| Payments & payouts | Billing address, plan, invoices, last 4 digits of card; payout status and tax forms | You; Stripe |
| Device & usage | IP address, browser, device type, app version, pages viewed, crash logs | Automatically; cookies and SDKs |
| Communications | Support tickets, contact-form submissions, survey answers, call recordings (with consent) | You |
We do not intentionally collect special-category data, and our Terms prohibit members from sharing it.
04Data about prospects shared by members
The Lead Exchange lets members share business opportunities. To protect the people those opportunities relate to ("prospects"), we have designed the Service as follows:
- Anonymised first. Leads are published as Lead Briefs containing only role, industry, company size band, region and need. Our systems scan Briefs and block obvious contact details.
- Double opt-in. A prospect's name and contact details are only revealed to the receiving member after the prospect agrees to the introduction via an email or in-app prompt we send on the referring member's behalf.
- Independent controllers. The referring and receiving members each act as independent controllers of the prospect's data and are contractually required to have a lawful basis and to comply with anti-spam laws. 8connections acts as a controller for operating the consent flow and logging, and keeps an audit trail of each exchange.
- Prospect rights. If you were introduced through 8connections and want to know what data was shared, object, or ask us to block future intros to you, email privacy@8connections.com. We will action blocks within 72 hours and notify the members involved.
05How we use data & our lawful bases
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Create and run your account, show your profile to matches, deliver intros, messages and Deal Rooms | Contract (Art. 6(1)(b)) |
| Verify identity and employment, prevent fraud, spam and abuse, enforce our Terms | Legitimate interests (Art. 6(1)(f)) in a trustworthy network |
| Calculate match scores, reputation scores and Credit values | Contract; legitimate interests |
| Operate the prospect double opt-in flow and keep consent records | Legitimate interests; legal obligation (accountability) |
| Process subscriptions, payouts, invoices and tax reporting | Contract; legal obligation (Art. 6(1)(c)) |
| Sync data with CRMs and tools you connect | Contract; your instructions |
| Improve and develop the Service, including aggregated analytics | Legitimate interests |
| Send product updates and newsletters | Consent, or legitimate interests for existing customers (soft opt-in), where permitted |
| Non-essential analytics cookies | Consent (Art. 6(1)(a)) |
06Matching, profiling & automated decisions
Our matching engine compares profile attributes (such as ICP, territory, industry and deal size) and anonymised activity signals to suggest relevant members. Reputation scores are computed from exchange outcomes. These are forms of profiling, but they do not produce legal or similarly significant effects: they rank suggestions and do not decide whether you can use the Service.
Account suspensions for abuse are always reviewed by a human before they become permanent. You can ask us to explain the main factors behind your match suggestions or reputation score, and you can contest them.
We do not use the content of your private messages, Deal Rooms or Lead Briefs to train general-purpose AI models. Where we use machine-learning models internally (for example spam detection), they are trained on de-identified or aggregated data.
08International transfers
Our primary infrastructure is in the European Union. Some providers may process data in the United States or other countries. Where data leaves the UK or EEA, we rely on adequacy decisions (including the EU–US Data Privacy Framework and the UK Extension, where the recipient is certified) or on Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures such as encryption. You can request a copy of the relevant safeguards from our DPO.
09Data retention
- Account and profile data — for as long as your account is active, then deleted within 30 days of closure (backups roll off within a further 35 days).
- Messages and Deal Rooms — until you or the other participants delete them, or your account is closed.
- Lead-exchange audit logs and consent records — 6 years after the exchange, to evidence compliance and handle claims.
- Billing, payout and tax records — 7 years, as required by tax law.
- Contact-form and sales enquiries — 24 months after our last interaction, unless you become a customer.
- Inactive Free accounts — deleted after 24 months of inactivity, with 30 days' email notice.
10Security
We protect data with encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, single sign-on and hardware-key MFA for staff, audit logging, regular third-party penetration tests and a responsible-disclosure programme. Our controls are audited annually against SOC 2 Type II and ISO/IEC 27001. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you and the relevant regulators as required by law.
Report vulnerabilities to security@8connections.com.
11Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict or object to processing, including processing based on legitimate interests and all direct marketing;
- data portability — receive your data in a machine-readable format (Settings → Privacy → Export);
- withdraw consent at any time, without affecting earlier processing; and
- lodge a complaint with a supervisory authority.
To exercise your rights, email privacy@8connections.com or use the self-service tools in Settings. We respond within one month (extendable by two months for complex requests) and may need to verify your identity first.
12US state privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of the sale or sharing of personal information and of targeted advertising; and not to be discriminated against for exercising these rights.
We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA), and we do not use sensitive personal information for purposes that would require a right to limit. We honour Global Privacy Control (GPC) signals. You may use an authorised agent to submit requests; we will ask for proof of authorisation. If we deny your request, you may appeal by replying to our decision email.
14Marketing communications
We send product announcements and our Warm Pipeline newsletter only where you have opted in or, for existing customers, where the law permits a soft opt-in. Every email includes an unsubscribe link, and you can manage preferences in Settings → Notifications. Service and security messages (such as billing receipts or intro notifications) are not marketing and will continue while your account is active.
15Children
The Service is intended for professionals aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
16Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by email or in-app at least 30 days before they take effect, and we will update the "Last updated" date above. Previous versions are available on request.
17Contact & complaints
- Data Protection Officer: privacy@8connections.com
- Legal enquiries: legal@8connections.com
- Post: 8connections Ltd., Attn: Data Protection Officer, Unit 8, 120 Bermondsey Street, London SE1 3TX, United Kingdom
If you are unhappy with how we handle your data, please contact us first so we can try to help. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to the data-protection authority in the EU country where you live or work.