Konsili — Privacy Policy

Last updated: 16 July 2026

1. About this Privacy Policy

This Privacy Policy explains how we process personal data relating to our Konsili platform. The Konsili platform is a B2B sales-research and outreach platform operated by Concordya Ltd, a company registered in England and Wales (company number 17189273) with its registered office at C/O Melon Accountants Ltd, 96 Wilton Road, London, England, SW1V 1DW (referred to in this Policy as “we”, “us” or “our”).

This Privacy Policy covers personal data relating to customers and users of the Konsili platform and also to the individuals who are business contacts whose details are processed within the Konsili platform. Section 3 contains definitions which are used in this Privacy Policy.

We usually act as a controller of the personal data we hold and processes. That is, we determine the purposes and means of processing for:

• the Prospects, i.e. business prospects and contacts the Konsili platform identifies, aggregates, enriches, ranks and presents through the Konsili platform;
• the Customers and Users who register and use the Konsili platform;

In limited circumstances — described in section 4.5 — we may act as a processor on behalf of a Customer.

Our role depends on the nature of the data and the purpose of the processing. In some cases, where we process uploaded data on a Customer’s behalf to provide the Konsili platform and carry out the Customer’s instructions, we act as a processor. We may also act as an independent controller for limited purposes for the same personal data for our account administration, billing, service security, fraud prevention, abuse detection, legal compliance, and product-performance analytics where we determine those purposes ourselves.

This Privacy Policy only covers our processing of personal data as a controller. Where we process personal data as a processor then that processing will be covered by the privacy policy of the controller of that personal data.

Where the Konsili platform currently operates

We currently offer the platform to Customers established in the United Kingdom, the United States and Canada. Customers established in other jurisdictions cannot register an Account.

This territorial restriction applies to Customer access. The Prospects database that the Konsili platform maintains is a global database of business prospects and contacts and individuals located in other jurisdictions, including in the EU/EEA, may appear in it. Where personal data of EU/EEA residents is processed within the Konsili platform’s prospect and contact database, we aim to process that data as though EU GDPR applies to that processing alongside the UK GDPR and UK GDPR and EU GDPR are very similar. We monitor regulatory developments in this area and always aim to process any personal data in compliance with any legal requirements.

We currently do not offer goods or services to individuals in the EU within the meaning of EU GDPR and our processing of Prospect Data does not involve behavioural tracking or monitoring of individuals in the EU within the meaning of EU GDPR. On that basis, we consider that EU GDPR does not apply to our activities and we do not need to appoint a European Union Representative. Also because we are not engaged in behavioural tracking or monitoring of Prospects and we do not process special category personal data we do not consider that we need to appoint a Data Protection Officer under UK GDPR.

So whilst strictly EU GDPR does not apply to us because of this, in the interests of good practice we aim to apply EU GDPR to the processing of any personal data relating to data subjects in the EU as if EU GDPR did apply except to the extent of any differences with UK GDPR. Also UK GDPR and EU GDPR are predominantly aligned and very similar in their requirements.

2. Quick summary

If you want a short version:

• If you are a Konsili platform Customer or User — we process your account, billing and usage data to provide the Konsili platform. We rely on the contract with you or the organisation you work for and on recognised legitimate interests and our legitimate interests in operating and improving the Konsili platform.
• If you are a Prospect, i.e. a business prospect and contact whose information appears in the Konsili platform — we process your business contact data (name, business email, work phone, role, employer, public LinkedIn URL, account-level firmographics) as controller, under recognised legitimate interests or our legitimate interests. This then allows our Customers to conduct lawful B2B sales outreach to the right buyers and contacts at target accounts.
• You have the right to object at any time to processing of your personal data where we rely on legitimate interests. Where your objection relates to direct marketing by us, that right is absolute. In other cases, we will assess your objection in accordance with applicable law but as a matter of policy if a Prospect objects to our processing of their data in the Konsili platform we remove them from our database. See section 11 for how to exercise your rights.
• We make relevant Prospect Data available to our Customers and Users only as part of the Konsili platform and subject to the Konsili platform terms and conditions, this Privacy Policy and applicable law. We never process consumer / personal-life data — only business-context information about business prospects and contacts.

3. Definitions

4. Personal data we collect about Customers and Users

When you register and use the Konsili platform as a Customer or User, we collect:

4.1 Account data

• Name, work email, work phone, role/title.
• Employer (Organisation), team / workspace assignment.
• Login credentials (managed via our authentication provider; see section 7).
• Communications you send to our support team.

4.2 Billing data

• Billing contact name, billing email, billing address.
• Payment-method tokens (held by our payment processor; we do not store full card numbers).
• Subscription plan, payment history, invoices.

4.3 Usage data

• IP address, device and browser metadata, session timestamps.
• Pages visited, features used, runs initiated, briefings generated, draft messages composed.
• Records of outreach messages you mark as sent — including, where you choose to provide it, a copy of the message text as you actually sent it.
• Error reports and diagnostic data.
• Audit log entries for sensitive operations (e.g., admin role changes, billing changes).

4.4 Where Customer and User Data comes from

We obtain Customer and User Data from our Customers and Users directly. In some cases we may also obtain Customer and User data from third parties such as lawyers or other third party professionals, usually in connection with enforcing our rights in relation to their use of the Konsili platform.

4.5 Content you upload (Customer Data)

Customer Data, for example seller-context documents, ICP definitions, account lists drawn from the Konsili platform’s own discovery features, generated briefings, drafts, is processed by us as controller for the purposes of providing the platform, securing it, preventing fraud, complying with law, and improving the service.

Where you upload Customer Data such as contact lists, customer correspondence, CRM extracts or other personal data that the Konsili platform would not have sourced for itself, and you direct us to perform processing operations on that data (collectively, “Customer-Directed Personal Data”), we act will be acting as a processor in respect of that Customer-Directed Personal Data.

5. Personal data we collect about Prospects

We source, aggregate and enrich business contact data about individuals at target organisations as controller, in support of our Customers’ and User’s B2B sales activities.

Our Prospects database is global in scope: it covers business professionals and contacts at organisations wherever they operate, irrespective of where the data subject is located. EU/EEA-resident professionals and contracts may appear in the database notwithstanding the Customer-side territorial restriction described in section 1. Where this occurs, the rights and safeguards described in this Policy apply. Whilst we are not currently subject to EU GDPR, given its similarity to UK GDPR, any EU residents will have similar rights under UK GDPR as if EU GDPR did apply to the relevant personal data.

5.1 Categories of Prospect Data we process

• Identification: full name, role / job title.
• Business contact: work email, work phone, work mobile (where available).
• Employer: company name, role/department, employer location.
• Public professional profile: public LinkedIn URL, professional bio, employment history (where publicly available).
• Firmographics about the employer: industry, size, location, revenue, recent news, hiring activity, funding events.

5.2 What we do not request or process about Prospects

• Personal email addresses (gmail, hotmail, yahoo, etc unless used for business purposes.). Our enrichment configuration requests work email only; the Konsili platform does not request the personal-email field from our enrichment provider.
• Personal phone numbers (where they appear personal rather than work-related).
• Home addresses.
• Date of birth, marital status, family information.
• Political opinions, religious beliefs, racial or ethnic origin, trade-union membership, health information, sex life, sexual orientation, biometric data, genetic data, or any other special-category data.
• Information about criminal offence and criminal records history.
• Information about anyone aged under 18.
• Information about consumers in their personal capacity.

If we receive any of the categories listed above as part of a third-party data feed, we aim to filter them out before storing and we aim not to retain them.

5.3 Where Prospect Data comes from

We obtain Prospect Data from the following sources:

• Our contact-enrichment provider: a third-party enrichment service that aggregates business contact data from public and licensed sources. We use this provider under its order form, master terms and data processing agreement, and we conduct supplier diligence on its privacy, security and compliance materials.
• Public web indexes and search engines: we use search engines to find publicly available information about target companies and the people working at them.
• LinkedIn public profile pages: we access publicly accessible LinkedIn profile pages of business professionals. We do not log in as a user, scrape behind a login wall, or circumvent LinkedIn’s access controls.
• Customer-uploaded data (the narrow processor case described in section 4.5): where a Customer uploads or otherwise provides information about a prospect (e.g., from their CRM or an account list).
• Other public sources: company websites, public press releases, news articles, public regulatory filings. For example these may include the UK Companies House register, the United States Securities and Exchange Commission’s EDGAR system, public company press releases.

5.4 What we do with Prospect Data

We use Prospect Data to:

• aggregate and enrich the Konsili platform’s own target-account and prospect intelligence;
• generate per-account briefings summarising the prospect business, the buying committee, and likely buying signals;
• present ranked prospect shortlists to Customers of the Konsili platform;
• draft outreach messages tailored to the prospect’s role and the Customer’s seller context;
• enable Customers to plan and run B2B sales workflows.

We do not use Prospect Data to:

• send communications to prospects automatically — the Konsili platform prepares drafts but never transmits them; every message is reviewed and sent by a person from their own mailbox;
• sell or rent Prospect Data to third parties not using the Konsili platform;
• enable consumer marketing.

6. Legal basis for processing

6.1 Customer and User personal data

We process Customer and User personal data on the following legal bases:

• Performance of a contract with the Customer — for providing the platform, processing payments, providing support.
• Recognised legitimate interests - if and to the extent they are applicable to our processing activities.
• Legitimate interests — for service operation, security, fraud prevention, abuse detection, platform improvement, and direct communication with Customers about service updates.
• Consent — for any optional marketing communications to you, where we ask separately and you may withdraw your consent at any time.
• Legal obligation — for tax, accounting, anti-money-laundering, sanctions, and other regulatory compliance.

6.2 Prospect Data

We process Prospect Data on the following legal bases:

• Recognised legitimate interests - if applicable.
• Legitimate interests - our main legitimate interest is enabling our Customers to identify the right buyers/contacts at target accounts and to conduct lawful B2B sales outreach to those buyers/contacts using available information.
• Legitimate interests (our own B2B sales and marketing) - where we use the Konsili platform ourselves, in the same way as a Customer, to identify and contact prospective customers of the Konsili platform, we rely on our legitimate interest in conducting lawful B2B sales and marketing of our own services. When we do this we stand in the sender's shoes: the responsibilities section 6.4 places on a sending Customer (an appropriate legal basis, PECR-compliant recipient selection, sender identification and an opt-out) apply to us in the same way, and an objection is honoured absolutely as direct marketing under section 11.7.

We have conducted a Legitimate Interests Assessment documenting: - the necessity of the processing (B2B sales intelligence relies on accurate, current contact information about working contacts and professionals); - the proportionality of the processing (limited to business-context data; no sensitive data; no consumer data; no children); - the safeguards in place (right-to-object mechanism, removal-on-valid objection process, data-minimisation, security, retention controls); - the balancing test against prospects’ reasonable expectations (business contacts and professionals may reasonably expect their public business contact information to be available to legitimate B2B sales-research, outreach businesses and potential suppliers).

These are the same legal basis used by the major B2B contact-data platforms (ZoomInfo, Cognism, Apollo, Lusha and others) and they are recognised by the Information Commissioner’s Office (ICO) and EU data protection authorities as a lawful basis for B2B contact data processing, subject to the safeguards we apply.

6.3 Article 14 UK GDPR notification posture

UK GDPR Article 14 requires controllers who obtain personal data from sources other than the data subject to notify the data subject within a reasonable period (and at most 1 month after collection), unless the notification involves “disproportionate effort” or other exemptions in Article 14(5) apply.

We rely on the disproportionate effort carve-out under Article 14(5)(b) and do not send a copy of this Privacy Policy to Prospects. Notifying every individual Prospect personally would defeat the purpose of B2B contact-data aggregation, would result in only marginal transparency benefit (as Prospects may reasonably expect their public business information to be used for marketing) would require independent transmission to a large number of individuals and would generate a disproportionate volume of unsolicited communications. Instead, we:

• publish this Privacy Policy publicly so that any Prospect data subject can read it;
• maintain a clearly-signposted right-to-object mechanism (see section 11);
• respect every objection received by removing the Prospect’s record and ensuring it is not re-imported in future;
• never enable direct outreach to data subjects we know have objected.

We monitor regulatory guidance from the ICO and EU data protection authorities and will adjust this posture if guidance changes.

6.4 Lawful basis for downstream Customer outreach

When a Customer or User of the Konsili platform uses Prospect Data to send a B2B outreach communication, the Customer is the controller of the personal data they choose to use, and is responsible for ensuring an appropriate legal basis for that outbound communication. Typical legal bases include:

• Legitimate interests - for processing the prospect’s data for lawful B2B sales outreach;
• PECR for B2B email — the “corporate subscriber” carve-out allows direct marketing email to “corporate subscribers” (limited companies, LLPs, government bodies, partnerships in Scotland) without prior consent, provided the recipient is identifiable and an opt-out is included. Different rules apply to sole traders, unincorporated partnerships and consumers.
• Privacy notice provision is generally satisfied at the Customer level by the Customer’s own privacy policy and by reasonable inclusion of an unsubscribe mechanism.

We require our Customers and Users (via the Terms and Conditions and Acceptable Use rules) to comply with applicable e-privacy and data-protection law in the Prospect’s jurisdiction and the jurisdiction where they process any data relating to the Prospect.

7. Sub-processors

To operate the Konsili platform we engage third-party service providers, each contractually bound to confidentiality, data protection and security obligations under appropriate transfer mechanisms.

7.1 Categories of recipients

The categories of third-party service providers that may process personal data on our behalf are:

• Cloud hosting and storage and other IT providers — to host the platform and store data.
• Identity and authentication providers — to register Customers and Users, manage sessions, and protect Customer and User accounts.
• Payment processing providers — to bill Customers and manage subscriptions.
• Large language model and AI processing providers — to generate briefings, classifications and drafts.
• Contact-data enrichment providers — to enrich prospect records with current business contact information.
• Public web search and indexing providers — to discover publicly available company and role information.
• Public profile fetching providers — to retrieve publicly accessible LinkedIn profile pages and similar public business sources.
• Embeddings and retrieval providers — to compute machine-readable representations of business documents for similarity search.
• Error monitoring and diagnostics providers — to detect and investigate platform errors.
• Transactional email and notification providers (where used) — to send service-operational messages to Customers.
• CRM integration providers (where a Customer opts in) — to synchronise account/contact records into the Customer’s connected CRM system.

We will provide relevant Prospect Data to Customers and Users where it is relevant to their B2B outreach and marketing activities.

We may also provide information relating to Users to the Customer to whom the Users relate.

We may also provide personal data to other third parties where we are legally permitted to do so, for example regulators, government agencies and law enforcement agencies.

7.2 Named sub-processor list

A current named list of our sub-processors, their location of processing and the international transfer mechanism that applies to each is provided to Customers subject to the confidentiality terms of the Konsili platform Terms and Conditions:

• automatically when they take out a subscription, via konsili.ai/sub-processors (accessible to subscribing Customers after sign-in); and
• on request before sign-up, by writing to privacy@konsili.ai.

The named sub-processor list is provided to Customers in confidence. The Konsili platform Terms and Conditions prohibit a Customer from using the named list, or any other non-public technical or commercial information disclosed by us, for competitive-intelligence purposes or from disclosing it to any third party.

We reserve the right to refuse access to the named list, decline creating an Account, or suspend or terminate an existing Account, where we reasonably believe the requestor or Customer is a competitor of ours, is acting on behalf of a competitor, or is seeking access to the Konsili platform for purposes other than the Customer’s own internal use of the Konsili platform and Prospect Data.

We notify Customers in advance of any material change to the named list and provide a reasonable opportunity to object.

8. International transfers

We are established in the United Kingdom. We process personal data primarily within the UK and EU but also use sub-processors in the United States and (depending on AWS region selection) elsewhere.

For transfers of personal data outside the UK or EU to a country that does not have an adequacy decision, we rely on:

• the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses (SCCs), for UK personal data;
• the EU Standard Contractual Clauses (SCCs) for EU personal data;
• supplementary measures where applicable (encryption in transit and at rest, access controls, contractual safeguards).

We assess transfer risks on an ongoing basis and update safeguards in line with regulatory guidance.

9. Retention

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law.

10. Security

We implement appropriate technical and organisational measures to protect personal data, taking into account the state of the art, the nature of the processing and the risk to data subjects. These measures include:

• Encryption in transit (TLS 1.2+) and appropriate encryption at rest for personal data and for credentials of connected third-party integrations.
• Access controls — least-privilege, role-based access, multi-factor authentication for staff with elevated access.
• Tenant isolation — Customer Data is segregated by Customer using composite identifiers; cross-tenant access is engineered out at the database layer and verified by automated tests in our build pipeline.
• Audit logging for sensitive operations (admin changes, billing changes, mass exports).
• Vendor management — sub-processor security and DPA review before onboarding.
• Security incident response procedures including personal data breach notification under UK GDPR Article 33 (to the ICO within 72 hours where required) and Article 34 UK GDPR (to data subjects where required).
• Regular review of security controls and infrastructure.

We do not store full payment card numbers and payment card data is handled directly by our payment processor.

11. Your rights

You have the following rights in respect of your personal data:

11.1 Right to be informed

This Privacy Policy fulfils this right.

11.2 Right of access

You can request a copy of the personal data we hold about you.

11.3 Right to rectification

You can ask us to correct inaccurate or incomplete personal data.

11.4 Right to erasure (“right to be forgotten”)

You can ask us to delete your personal data in certain circumstances — including where we have no overriding legitimate interest.

11.5 Right to restrict processing

You can ask us to limit how we process your personal data in certain circumstances.

11.6 Right to data portability

For personal data processed under contract or consent, you can ask us to provide a machine-readable copy.

11.7 Right to object — including to direct marketing and to legitimate-interest processing

You can object at any time. The easiest way to object is:

• email privacy@konsili.ai with the subject “Right to Object”;
• include your name, business email address(es), employer, and any other identifiers that will help us locate your record;
• on receipt of your objection we will assess and then if your objection is successful action your request within one month (and confirm to you), remove your record from the Konsili platform

For Prospects: as a matter of policy and in recognition of the nature of this processing, we will honour your objection and remove your record from the Konsili platform, subject to retaining a minimal set of identifiers to help to prevent re-import into our database in the future.

For Customers and Users: we will assess your objection in accordance with applicable law and will only continue processing where we have compelling legitimate grounds which override your interests, rights and freedoms, or where required for the establishment, exercise or defence of legal claims.

If you object to direct marketing by us —we will stop processing your data for that purpose immediately.

11.8 Rights regarding automated decision-making

We do not make decisions about you with legal or similarly significant effects based solely on automated processing.

11.9 Right to withdraw consent

Where we rely on consent, you can withdraw it at any time without affecting prior lawful processing.

11.10 Right to complain

You have the right to lodge a complaint with a supervisory authority:

• in the United Kingdom, the Information Commissioner’s Office (ICO) — see https://ico.org.uk;
• in the United States, where applicable state privacy laws (such as CCPA / CPRA in California, VCDPA in Virginia, CPA in Colorado, CTDPA in Connecticut, UCPA in Utah, TDPSA in Texas, or other state laws as they come into force) confer such rights, with the relevant state attorney general or supervisory authority;
• in Canada, the Office of the Privacy Commissioner of Canada (OPC) — see https://priv.gc.ca — and any applicable provincial commissioner (in British Columbia, Alberta or Quebec);
• in the EU/EEA, as we are currently not subject to EU GDPR then the easiest route is to make your complaint as if you are in the UK. In the future if we are subject to EU GDPR then you will be able to make a complaint to the data protection authority of your country of residence or place of work.

We ask that you raise concerns with us first via privacy@konsili.ai so we can try to resolve them. Any complaints will be dealt with by us in accordance with our complaints procedure and process. Some regulators will also require you to raise any complaint with us first and for that complaint not to have been resolved before they will accept a complaint from you.

12. How to exercise your rights

To request the exercise any of the rights above or to make a complaint to us, the easiest way is to contact:

• Email: privacy@konsili.ai
• Subject line: Your request type (e.g., “Data Subject Access Request”, “Right to Object”, “Erasure Request”)
• Information to include: your name, contact email, and enough information for us to locate your records and to know what your request or complaint relates to.

We will respond at the latest within 1 month of receipt. In complex cases we may extend this by up to 2 further months, in which case we will let you know within the first month and explain why.

We do not charge a fee for handling rights requests, except where the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request (and explain why).

13. Cookies and similar technologies

The konsili.ai website and the Konsili platform use cookies and similar technologies. We use:

• Strictly necessary cookies — for authentication, security and core functionality (no consent required).
• Functional cookies — to remember your preferences.
• Analytics cookies — to understand how the platform is used (where you have consented, in accordance with PECR).

A separate Cookies Policy at konsili.ai/cookies (or in-product cookie banner) describes the specific cookies in use and how to manage them.

14. Children’s data

The Konsili platform is a B2B platform. We do not knowingly process personal data of anyone under 18. If we learn that we have inadvertently processed personal data of a child, we will delete it.

15. Changes to this Policy

We may update this Privacy Policy. The “Last updated” date at the top reflects the most recent change. We will give Customers and Users reasonable advance notice of material changes (by in-app notification, email or website notice). For changes to Prospect Data processing, we will update the public Privacy Policy and rely on continued publication.

16. Contact us

For any questions about this Privacy Policy or our processing of your personal data:

• Email: privacy@konsili.ai
• Post: Concordya Ltd, C/O Melon Accountants Ltd, 96 Wilton Road, London, England, SW1V 1DW