Optimus Outreach: Privacy Notice
Version 1.4, 30 September 2026
Who this notice is for
If you have received an email from a business using Optimus Outreach, and it pointed you here, this page explains where your details came from, why you were contacted, and how to stop it. That is the first part of this notice.
If you use Optimus Outreach as a client, the second part explains what we hold about you and your account.
Part 1: If you have received an email
Who contacted you, and who we are
The email you received was sent by the business named in it, from that business's own mailbox. That business decided to contact you and is the data controller for your details. Nothing was sent through our systems.
Optimus Outreach is the software that business used to find your details and draft the email. It is built and run by Optimus Consulting (North West) Limited. In this arrangement we are the data processor: we operate the platform on the client's instructions and we do not decide who gets contacted.
Where your details came from
Optimus Outreach gathers business contact details about people in decision-making roles from sources that are already public. Depending on the record, that will be one or more of:
- Public business listings (Google Places), which give a business's name, address, phone number and website.
- The business's own website, read for a general enquiries address, a phone number, the company registration details it publishes, and, where a person's name is already known, an address in that person's name.
- Public professional profiles on LinkedIn, accessed through ReverseContact, a professional data provider, which gives a person's name, job title, headline, location and profile link.
- Web research carried out by an AI research service (Perplexity). Only the business's name, town and website are sent to it. It may return the name of an owner or manager where that name is already published on the web.
- The Companies House public register, searched by business name, or by the company number shown on the business's own website, to confirm whether a business is a registered company. It returns the company number, registered name and status.
- Email discovery and verification (Gojiberry), which is asked to find a business email address for a named person.
- Lists uploaded by the client from its own records.
We do not collect anything about your private life. We hold your name, job title, the business you work for, your business email address, your business phone number where published, your LinkedIn profile link where found, and notes the client's operator has written about the approach.
"Publicly available" does not mean "free to use for anything". The client relies on legitimate interests (Article 6(1)(f)) as its lawful basis: a business-to-business approach about something relevant to your role, with an easy way to say no. Each client documents that assessment before it starts using the platform.
Where the business that contacted you is established in the United Kingdom, the UK GDPR applies to it. Where it is established in the European Union, the EU GDPR applies. The two give you the same rights. Optimus Consulting is regulated by the UK Information Commissioner's Office in either case; the client is regulated by the supervisory authority where it is established, and it is responsible for complying with the marketing rules of the country it sends from and the country it sends to.
What happens to your details
The client's operator sees your details on screen, may ask the platform to draft an email to you, and sends it from the client's own mailbox. When an email is drafted, your name, your business's name and what it does, and the operator's notes are sent to an AI writing model (Google Gemini, via Lovable's AI gateway, under terms that do not allow your data to be used for training). Nothing else about you leaves the platform for that step.
A client may also choose to send prospect records to its own CRM system. If it does, that is the client's system and the client's responsibility.
Every email the platform drafts carries the sender's postal address and, for a registered company or partnership, its registered details, says where your details came from, tells you how to stop further contact, and links to this page.
How to stop it
Reply to the email and say so. The operator records your objection on the platform and it blocks any further email to you from that client, any further lookup of your details, and any further attempt to draft an email to you. Copying the text out to send it by hand is blocked on the same rule.
You can also write to us directly at chris@optimus-consulting.co.uk and we will pass your objection to the client, ask them to confirm it has been recorded, and follow it up if they do not.
An objection is recorded against the client account that contacted you.
An objection is kept even if the client stops using the platform, so that you are not rediscovered later.
How long your details are kept
If the client contacts you and there is no reply, no response and no other engagement, your details are deleted after 12 months from the last recorded contact. If you ask not to be contacted, the identifiers needed to honour that (your email address and profile link) are kept for as long as the block is needed, and nothing else about you is kept.
Your rights
You have the right to ask what personal data is held about you, to have it corrected, to have it deleted, to restrict how it is used, and to object to it being used at all. For details gathered through Optimus Outreach, you can use any of these rights by replying to the email that reached you or by contacting us at the address below, and we will pass it to the client, ask them to confirm it has been recorded, and follow it up if they do not. We aim to respond within one calendar month.
If you are not satisfied, you can complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Part 2: If you are a client user
For your own account, Optimus Consulting (North West) Limited is the data controller. We hold your name, work email address, the account you belong to, your role on it, and a record of what you do on the platform (records viewed, contacts looked up, emails drafted and logged as sent, objections recorded and lifted). The activity record exists so that both you and we can show what was done and when, which is part of how the platform meets its obligations to the people it contacts.
Your business profile (company name, website, what you sell, your value proposition), and any products you add (name, product page, what it sells, value proposition), are used to draft emails in your voice. Where you turn the feature on, your business profile is also used to check how your firm appears in AI search results through our AI Visibility Portal. Only your company-level details go to the portal, never a person's, and product details are not sent to it.
We keep your account data for the life of your subscription and for 12 months after it ends, then delete it, except that objection records collected while you used the platform are kept as described in Part 1.
Your lawful basis with us is the contract you have signed. Sub-processors and transfers are the same as in the section below.
Who we share data with
| Provider | What it does for Outreach | What it receives | Where | Transfer safeguard |
|---|---|---|---|---|
| Lovable and Supabase | Hosting, database, authentication | All platform data | AWS, European Union | UK adequacy for the EU. Lovable's DPA and sub-processor list at trust.lovable.dev |
| Google Gemini, via Lovable AI Gateway | Drafts outreach emails | Prospect name, business name and what it does, operator notes, client's business profile, or the product the record is worked from | EU routing via Lovable | Standard Contractual Clauses at the Lovable to Google layer. Zero retention, no training |
| Perplexity AI, Inc. | Business research and fit scoring | Business name, town, website and sector of the business being researched, and the client's own company name, description and value proposition, or the product the record is worked from. When a client sets up its profile or a product, its own website or product page address, its company name, and any description it types in. No prospect's personal data is sent | United States | EU Standard Contractual Clauses and the UK Addendum, in Perplexity's DPA. No training on customer content |
| Companies House | Checks whether a business is a registered company | The business name being searched, or a company number shown on the business's own website. For a sole trader the trading name may be a person's name. The postcode is compared on our side and not sent | United Kingdom, public register | No transfer outside the UK |
| ReverseContact (VISUM SAS) | Finds named decision makers from public professional profiles | Business name, and the search term used | France, EU-hosted | UK adequacy for the EU. DPA published |
| Gojiberry (Superfruits SAS) | Finds and verifies a business email address for a named person | Person's name, job title, profile link, business name. Not used for training, not shared with their other customers | France, EU-hosted. Its own providers include processors in the United States | UK adequacy for the EU. Gojiberry's own onward transfers, including email verification carried out on servers in the United States, are made under Standard Contractual Clauses or equivalent safeguards |
| Google Places | Business discovery | Search terms (sector and area), no person data | Google Ireland Ltd for UK users | UK adequacy for the EU, and Google's DPF UK Extension |
| Optimus AI Visibility Portal (our own system) | AI search visibility check, where the client turns it on | Company name, town, website, sector. No person data | AWS, European Union | Internal, same controller |
| Client's own CRM, via webhook | Only where the client configures it | Prospect records the client chooses to send | Client's choice | Client's responsibility |
We give clients 30 days' notice of any change to this list.
Who we are
Optimus Consulting (North West) Limited, registered in England and Wales, company number 13718490. ICO registration ZB883931. Registered office: 7-9 Macon Court, Crewe CW1 6EA. Data protection contact: chris@optimus-consulting.co.uk.
Changes to this notice
The date at the top of this page shows the current version. Material changes are notified to clients, who are responsible for pointing the people they contact at the current version.