Outreach Privacy Notice

Last updated: 13 September 2026

This notice explains how Buvo Ltd (trading as MyBuvo) handles personal data when we identify and contact business people who may be relevant to Signal Line.

Who we are

Buvo Ltd (trading as MyBuvo), a company registered in England and Wales (Company No. 15846940, ICO registration ZB805946), is the controller for this processing. Signal Line is our product name, not a separate company. Contact: privacy@mybuvo.co.uk.

What we may hold

• Name, role, employer, location, business email address, business phone number where it is published, and public business profile URL. Your business email address and phone number may have reached us indirectly through an enrichment provider rather than from you.
• Text you published about yourself and your work on your public LinkedIn profile: your headline, your About section (up to 700 characters) or, where there is no About section, up to 700 characters of the descriptions you wrote about your own roles, services or publications. We use it so that a first message can start from something you wrote, and we do not keep it if it appears to touch on sensitive matters such as health.
• Company information from public registers and company websites.
• Email validation status and campaign touch history.
• A directional communication-style assessment of you, inferred from your public professional profile, for a salesperson to read before a business conversation. It indicates how you may prefer to be communicated with. It is not a psychological or personality assessment, and no automated decision is made about you on the basis of it.

Where it came from

Sources may include public company registers, public business profile pages, your public LinkedIn profile, LinkedIn Sales Navigator, web search results that point to your public LinkedIn profile, company websites, enrichment providers, and information you or a customer provide to us. We read public LinkedIn profiles either directly or through Apify, a data-collection service acting for us. Apify also collects published business contact details from public professional sources and runs those web searches for us.

Why we process it

We process this data to identify relevant UK B2B prospects, make outreach more relevant, maintain suppression records, and deliver commissioned Assessments.

Lawful basis

Our lawful basis is legitimate interests under Article 6(1)(f) UK GDPR, subject to documented balancing tests and your right to object. If you object to direct marketing, we stop direct marketing and related profiling.

Who receives it

We use vetted service providers for enrichment (principally Apify), workflow orchestration, email verification, secure storage, payment, and delivery. We do not sell personal data.

We also use AI language model providers to read public information about you and write the research summary. The web search that finds that public material now runs on the model provider's own search, so no separate search company receives your details. The search itself contains your name, role and employer. Those providers are Anthropic, Google and Perplexity, reached through the routing service OpenRouter. They are based in the United States. We set them so they do not keep your data after answering, and do not use it to train their models. We previously also used two separate search and page-reading providers, Exa and Jina AI, and we removed both rather than continue sending your details to them.

The summary is produced for a salesperson to read before speaking to you. It is never sent to you, and we do not use it to make any automated decision about you.

Do we contact you directly?

Sometimes, yes. We may approach you ourselves about Signal Line, by email, by a message on a professional network such as LinkedIn, or by phone. It is low volume, we lead with something we think is genuinely useful to you rather than a pitch, and we cap how many times we will contact you about any one thing. Every first message says who we are and links to this notice. Our lawful basis is the same legitimate interests basis set out above, and it is supported by a documented internal assessment.

You have the right to object to direct marketing at any time, and we will always stop. You do not need to give a reason. Reply 'stop' to any message or email (replying 'remove' works too), say so in a message or on a call, or contact privacy@mybuvo.co.uk. We record it the same day, it applies across every channel rather than just the one you used, and it is permanent: we keep a minimal suppression record purely so that no future data collection can quietly add you back.

Existing-customer account reviews

Everything above applies equally if you are a contact at an existing customer of ours, and the review is being prepared for a renewal or expansion conversation rather than a first approach. Two things differ. We do not run a fresh public-profile enrichment of you in this case, drawing only on public company-register data, financial filings, and analysis we already hold about the account. And because our customer already has an active relationship with you, this notice is made available here rather than sent as a separate first-contact message.

How long we keep it

• Raw output from data-collection runs (before we pick out the fields we keep): short operational retention only.
• Your profile text (headline, About section, or the descriptions you wrote about your own work) and a basic profile record (name, role, employer, location, profile URL): kept while we plan to contact you, and reviewed no later than our pipeline review date, currently 31 December 2026. At that date, if we have not contacted you, we either contact you or delete the record. If we have contacted you, the campaign rule below applies.
• You can ask us to delete your details at any time, and we will do it straight away.
• Intelligence briefs (PDF): deleted automatically 30 days after creation, or earlier on request.
• Campaign state: normally up to 12 months from last touch.
• Communication-context scores: normally up to 6 months.
• Suppression records: retained minimally so we do not contact you again.

Standing monitoring

Where a company is on a customer's watchlist, we check public statutory registers (Companies House, the FCA register) daily for material changes to that company - for example a change of director, an insolvency filing, or a change of FCA status. We store these changes as dated, name-free events for up to 90 days. We do not store the names of directors or persons with significant control from this monitoring, and we make no automated decision about any individual. To object or ask for erasure, contact privacy@mybuvo.co.uk - we pause the watch and purge its events.

Your rights

You can ask for access, rectification, erasure, or restriction, and you can object to processing. You can also ask us where we obtained your details, and we will tell you. To stop hearing from us, see the opt-out route above, or contact privacy@mybuvo.co.uk at any time.

Complaining to us

If you think we have handled your details wrongly, you can complain to us directly. Reply to any message we have sent you, email privacy@mybuvo.co.uk, or write to Buvo Ltd, 320 Firecrest Court, Warrington, WA1 1RG. You do not need to use any particular form or wording, and you do not need to give a reason.

We will confirm we have received your complaint, look into it, keep you updated, and tell you the outcome.

You can also complain to the Information Commissioner's Office at any time, whether or not you have complained to us first. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.