Pre-launch disclosure. The operating legal entity, registered address, EU/UK representative (if required), actual hosting location and final retention schedule must be inserted and reviewed by qualified counsel before public production launch.
1. Who we are and when this notice applies
“WorldsContact”, “we”, “us” and “our” refer to the legal operator identified in the applicable order form or future company-details notice. This notice covers visitors, account holders, authorised workspace users, sales contacts and people whose business contact data is submitted to or generated through the service.
We act as a controller for account administration, website security, billing, service communications and enquiries. Where a customer instructs us to process contact or campaign data solely to provide the service, we generally act as that customer’s processor or service provider. The customer remains responsible for its collection, lawful basis, notices and communications.
2. Personal data we process
Username, name, work email, password hash, account status and authentication events.
Tool usage, credit ledger entries, plan or purchase records, settings and audit events.
Business emails, names, company domains, campaign content, audience fields and verification results submitted or generated at a customer’s direction.
Name, work email, company, job title, country, team size, message and consent record.
IP address, request time, browser information, session identifiers, CSRF tokens, error and security logs.
Support correspondence, feedback, service notices and choices about communications.
3. Where data comes from
- Directly from you, your employer or another authorised workspace user.
- From customer-provided files, domains, profile URLs and campaign audiences.
- From technical systems when you access the service.
- From providers instructed to perform verification, hosting, payment or support functions.
- From publicly accessible professional or company context where a customer initiates a permitted search. Customers must not bypass access controls or collect prohibited data.
4. Purposes and legal bases
| Purpose | Typical data | Typical EU/UK basis |
|---|---|---|
| Provide accounts and requested tools | Account, workspace and customer content | Contract; legitimate interests |
| Secure and prevent abuse | Authentication, device and audit data | Legitimate interests; legal obligation |
| Administer credits and payments | Account, ledger and transaction data | Contract; legal obligation |
| Respond to sales or support enquiries | Identity, company and correspondence | Pre-contract steps; legitimate interests |
| Send optional marketing to our own prospects | Business contact and preference data | Consent or legitimate interests where permitted |
| Improve reliability and product experience | Aggregated usage and error signals | Legitimate interests |
| Meet legal and regulatory duties | Relevant account and transaction records | Legal obligation |
The exact basis depends on the person, activity and jurisdiction. Where we rely on legitimate interests, we assess necessity, impact and reasonable expectations. Where consent applies, it may be withdrawn without affecting earlier lawful processing.
5. Business contact and campaign data
A work email identifying a person can still be personal data. Customers must determine whether they may lawfully collect, enrich, verify and contact each person; give required notices; respect objections; and comply with GDPR, UK GDPR, ePrivacy/PECR, CAN-SPAM, state privacy laws and other applicable rules. WorldsContact does not provide a lawful basis merely because a record can be found or verified.
6. Who receives data
We disclose data only as reasonably necessary to operate the service, follow customer instructions, complete transactions, secure the platform or meet law. Recipient categories may include hosting and database providers, verification infrastructure, email delivery providers selected by customers, payment processors, support services, professional advisers and competent authorities. The production register is maintained on our Subprocessor page. We do not knowingly sell account or enquiry data or share it for cross-context behavioural advertising.
7. International transfers
Where EEA, UK or Swiss personal data is transferred internationally, the production arrangement must use a recognised mechanism such as an adequacy decision, approved standard contractual clauses or another lawful safeguard, plus supplementary measures where appropriate. Transfer details depend on the configured hosting and service providers.
8. Retention and deletion
We keep data only for a documented business, security, contractual or legal need. The current development build does not yet implement every automated retention workflow. Before production, WorldsContact will publish final periods covering accounts, verification results, campaign content, suppression records, audit logs, billing records, enquiries and backups. Suppression data may need to be retained to ensure an opt-out remains honoured. Customers may request deletion subject to fraud prevention, legal holds and statutory recordkeeping.
9. Your privacy rights
Depending on location, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent, information about disclosures, or an appeal. California residents may also have rights to know, correct and delete information, opt out of sale or sharing, limit certain sensitive-data uses and receive non-discriminatory service. We do not knowingly sell or share personal information for cross-context behavioural advertising. See Privacy Rights & Requests for instructions.
10. Automated signals
Email status, confidence and ICP-fit indicators are operational decision-support signals. WorldsContact does not use them on its own to make decisions producing legal or similarly significant effects about individuals. Customers are responsible for appropriate human review and must not use these tools for unlawful eligibility, employment, housing, credit, insurance or similarly sensitive decisions.
11. Security and incidents
We use access controls, password hashing, CSRF protections, server-side secrets, transactional credit records and audit logging in the current application. Production security also depends on infrastructure configuration and customer practices. See the Trust Centre. If an incident creates notification duties, we will act according to applicable law and contractual commitments.
12. Children
WorldsContact is a business service not directed to children, and accounts are intended for people aged 18 or older. Customers may not use the service to build audiences of children or process children’s data without all legally required authorisation.
13. Contact, complaints and updates
Email privacy@worldscontact.com for privacy questions or requests. EEA/UK individuals may complain to their competent supervisory authority. We will post material changes here, update the effective date and provide additional notice where required.