Privacy notice: business contacts and partnership invitations
Last updated: 2 October 2026. This notice supplements our Privacy Policy.
Business contacts and partnership invitations
Conscious Innovation Lab OÜ, trading as MyPalmLeaf, Tööstuse tn 48, 10416 Tallinn, Estonia, is responsible for this processing. You can contact us or our Data Protection Officer, Marilis Puusepp, at info@mypalmleaf.com.
Where your details come from
We research organisations that may wish to offer their communities our partner coupons and affiliate programme. We obtain business details from organisations’ own public websites and from business directories, including OpenStreetMap, or directly from you. We record the source and the date. If you would like to know the source of the details we hold about you, ask us.
What we hold
An organisation’s name, activities, website and business location; professional contact names, roles and email addresses; source references; email-address validation results; and records of invitations, replies, delivery failures and opt-outs. We do not infer health, religion or other sensitive characteristics from the kind of business someone runs.
Why we use it, and on what basis
We use these details to assess a potential partnership, check that contact details are accurate, send relevant invitations, answer enquiries and avoid repeated or unwanted contact. Where the details identify a person, our legal basis is our legitimate interest in finding relevant business partners (Article 6(1)(f) GDPR), balanced against your privacy and reasonable expectations. This does not replace any consent that applicable electronic-marketing law requires. Where consent is required, we use consent-based routes. A person reviews each group of invitations. We make no decisions about you by automated means.
Who receives your details
Our authorised team maintains these records in our own system. We use Instantly (Foo Monk LLC) to validate email addresses and send invitations, and Google Workspace for sending mailboxes and correspondence. Email-infrastructure, hosting and backup providers act on our behalf, and our team may use AI assistants from providers such as OpenAI or Anthropic to help research and review. Our outreach emails contain no tracking pixels and no tracked links. We record sends, replies, delivery failures and objections.
Transfers outside the European Economic Area
Some of these providers are based in, or process data in, the United States. Instantly’s data processing agreement incorporates the EU Standard Contractual Clauses, and Google processes mailbox data under its Cloud Data Processing Addendum. If you want to know which safeguard applies to another provider, or want a copy, email info@mypalmleaf.com.
How long we keep it
We remove or anonymise unused prospect details within 90 days of collection (except postal business addresses, see below), and records of unsuccessful outreach within 90 days after the last invitation. Postal business addresses (a business’s name, address and website) that we hold so that we can write to the business by letter are kept for up to 12 months from collection, because we send letters in planned waves over several months. We remove them earlier if you object, or if the address turns out to be a private home address. If you enter a real partnership discussion, we keep that correspondence for up to 12 months after the last exchange unless an active relationship or a specific legal requirement justifies longer. A generic company mailbox that does not identify a person may be kept for up to 12 months. Routine synchronisation, verification and automated messages do not restart these periods. We keep a minimal do-not-contact record for as long as needed to respect your objection and review it yearly. Restricted backups follow their own rotation, and we apply current erasure and do-not-contact records before any restored copy is used.
Your rights
You may object to direct marketing at any time, free of charge: reply STOP to an invitation, or email info@mypalmleaf.com. You do not need an account or a reason. You may also ask for access, correction, restriction or erasure of your personal data, subject to applicable rights and retention obligations. We normally reply to rights requests within one month. You can complain to the Estonian Data Protection Inspectorate, or, if you are in the UK, to the Information Commissioner’s Office, or to another competent supervisory authority. Giving us business-contact details is voluntary, and choosing not to engage carries no obligation to join the programme.