Privacy & Cookies

Your privacy matters to Honch Data Limited ("Honch", "we", "us"). This policy explains what personal data we collect, how we use it, who we share it with, and what rights you have.

This policy covers personal data processed through:

• visits to honch.co and our other websites
• client relationships and accounts on the Honch platform
• business contact data held within Honch products
• AI-assisted features inside the platform, including Bernard and Prospector
• integrations that move data between Honch and client systems, including CRM platforms such as HubSpot and Salesforce
• connections made to the Honch Model Context Protocol (MCP) server by AI assistants and agents

Our sites contain links to third-party websites which this policy does not cover. We recommend reviewing their privacy policies separately.

1. Quick reference

2. Who we are and what role we play

Honch Data Limited
Company No: 12246723 (England and Wales)
24 Sunnyside Road, Epping, CM16 4JW, United Kingdom
ICO registration number: ZB101246

General enquiries: info@honch.co
Data protection, privacy rights and security: dpo@honch.co

Data Protection Officer: Millie Brown, contactable at dpo@honch.co or by post at the address above, marked for the attention of the Data Protection Officer.

EU representative (Article 27 EU GDPR): [NAME, ADDRESS, EMAIL]
Because we process personal data relating to individuals in the European Economic Area, we have appointed a representative in the EU. Individuals in the EEA may contact our representative on any matter relating to our processing of their personal data.

Our role differs depending on the service

We are the controller for:

• the Honch business contact database and everything we do to build, maintain and license it
• our websites, marketing and sales activity
• client account records, billing and support
• the platform audit and usage logs we keep for security

We are a processor acting on a client's instructions when:

• we sync or push records into a client's own systems at their direction
• we host or process data a client has uploaded into their Honch workspace, including their own lists and CRM records
• we run client-defined signal tracking against criteria the client sets
• a client's AI assistant queries our MCP server using their credentials and their prompts

Where we act as a processor, our Data Processing Agreement governs the processing. Our standard DPA is offered to every client as part of our contract and is available on request from dpo@honch.co.

A client using Honch data for their own outreach is a controller in their own right. They decide who to contact, what to send and on what legal basis. Their obligations under UK GDPR, EU GDPR, PECR, the German UWG and equivalent marketing laws are theirs to meet. We set out the restrictions that apply in our client terms.

3. Changes to this policy

We review this policy at least annually and whenever we make a material change to our products, our subprocessors or our processing.

Where a change is significant, we will update the version number and the date at the top of this page, publish a summary of what changed, and where appropriate notify account holders by email at least 14 days before the change takes effect.

Previous versions are available on request from dpo@honch.co.

Please tell us if your details change so that what we hold stays accurate.

4. Where we get personal data

We collect business contact data from four types of source:

Publicly available information. Company websites, press releases, public professional profiles, published appointment announcements, job advertisements, public social posts, companies registers, charity registers and similar public records.

Our own research and automated collection. We monitor publicly available sources at scale, including roughly half a million social and job posts each week, to identify professional changes such as new appointments, promotions and organisational moves.

Licensed third-party data suppliers. We license data from vendors who warrant to us that they collected it lawfully and that they are entitled to license it. We carry out supplier due diligence before onboarding and require contractual data protection commitments.

Direct input. Data submitted by clients and users through the platform, our website forms, support channels and integrations.

Telling you we hold your data (Article 14)

Where we obtain your professional details from a source other than you, UK and EU GDPR require us to tell you. We do this by:

• publishing this policy at a stable, public URL
• notifying individuals whose professional contact details we add to the database, using the contact details we hold, by the earliest of: one month from collection, our first communication with the individual, or the point at which we first disclose the record to a client
• including source information in every response to an access request, so you can see where your details came from

Because our service involves disclosing records to licensed clients, the third of those limits is usually the one that applies.

If you would like to know the specific source of your record, ask us and we will tell you.

5. What we collect and our lawful basis

5.1 Professional identity data

Name, job title, employer, company, seniority classification, role responsibilities, professional profile URLs such as LinkedIn, work location, and career movement history such as appointment and promotion dates.

Lawful basis: Legitimate interests (Article 6(1)(f)). Our interest is providing business intelligence to sales, marketing, recruitment and partnership teams. We have carried out a Legitimate Interests Assessment which balances this against the rights of the individuals concerned, and we review it annually. A summary is available on request.

5.2 Professional contact data

Business email addresses, business telephone numbers and business postal addresses.

Lawful basis: Legitimate interests, as above. Where the data relates to a client of Honch, contract (Article 6(1)(b)) and legal obligation for billing records.

5.3 Client account and billing data

Account holder names, business contact details, billing addresses, purchase history and payment records. Card details are handled by our payment provider and are not stored by Honch.

Lawful basis: Contract, and legal obligation (Article 6(1)(c)) for tax and accounting records.

5.4 Technical and usage data

IP address, login records, device and browser information, pages and features used, search and query history within the platform, API call logs and MCP session logs.

Lawful basis: Legitimate interests in operating a secure and reliable service, investigating misuse, enforcing our terms and improving the product.

5.5 AI interaction data

Prompts, queries, generated drafts, feedback and the records returned when you use AI-assisted features such as Bernard, Prospector, budget holder research, or when an AI assistant queries our MCP server.

Lawful basis: Contract, where the processing is needed to deliver the feature you asked for. Legitimate interests in monitoring quality, preventing abuse and improving our own systems.

5.6 What we do not collect

We do not seek out or knowingly process special category data as defined in Article 9 UK and EU GDPR. That means we do not process data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation.

We do not knowingly process criminal offence data, children's data, or data about individuals in a purely personal capacity.

If special category data reaches us incidentally, for example inside a public post we have indexed, we remove it when we identify it. Please tell us at dpo@honch.co if you find any.

6. How we use personal data

We do not sell personal data to advertising networks. Our own website does use advertising and visitor identification technologies, which are described in Section 13.

7. Artificial intelligence

This section explains how AI is used inside Honch, which AI providers process data on our behalf, and what commitments apply.

7.1 Where AI is used

Research and enrichment. When contacts are added to the platform, senior records may be escalated into an automated research process that draws on public sources to add context about the person's role and remit. Outputs are stored against the contact record.

Signal interpretation. We use AI to classify and summarise public posts, job advertisements and appointment announcements so they can be surfaced as ranked signals.

Drafting assistance. Bernard and our outreach features generate suggested opening lines and message drafts for users to review, edit and decide whether to send.

Search and retrieval. AI features help users find relevant records and build audiences from natural language descriptions.

7.2 AI providers we use

We use the following third-party AI providers as processors. Details of each are in the subprocessor table in Section 9.

• OpenAI, L.L.C. (GPT models, via the OpenAI API)
• [Anthropic PBC (Claude models, via the Anthropic API)]
• Honch's own models and infrastructure, including Bernard, which runs on servers we control

We contract with these providers on their enterprise or API terms, which include data processing terms. Under those terms:

• Your data is not used to train their models. Our AI providers state that data submitted through their APIs is not used to train or improve their models unless the customer explicitly opts in. We have not opted in and will not do so.
• Retention at the provider is limited. Provider-side retention is limited to what is needed for abuse monitoring and service delivery, currently up to 30 days for OpenAI's default API configuration. We keep this under review and will pursue zero data retention arrangements where they are available and appropriate.
• We limit what is sent. We send only the data the feature needs. We do not send client CRM records to AI providers unless the client has enabled a feature that requires it.

If we add or change an AI provider, we will update the subprocessor list and give notice as described in Section 9.

7.3 AI and automated decision-making

Honch's AI features assist human users. They do not make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 UK and EU GDPR.

Specifically:

• outputs are presented to a human user who reviews and decides whether to act
• no Honch feature makes hiring, credit, pricing or eligibility decisions about the individuals in our database
• seniority classification and signal ranking are prioritisation aids for a salesperson, not determinations about the individual

Seniority tagging uses keyword-based classification and can mis-categorise non-standard job titles. If your record is wrongly classified, tell us and we will correct it.

7.4 AI transparency

Where you interact directly with an AI feature in the Honch platform, we make that clear in the interface, consistent with the transparency requirements in Article 50 of the EU AI Act.

We consider Honch's AI features to fall outside the high-risk categories in Annex III of the EU AI Act, because they support business-to-business sales prospecting and do not make or materially inform decisions about employment, credit, education, essential services or law enforcement. We keep this assessment under review as guidance develops, and we will update this policy if our classification changes.

7.5 Honch's MCP server and third-party AI assistants

Honch operates a Model Context Protocol (MCP) server that allows a client's AI assistant or agent, for example Claude, ChatGPT or an in-house agent, to query Honch data on the client's behalf.

How it works. A client authenticates their AI assistant to the Honch MCP server using credentials issued to their account. The assistant sends queries. We return records the client is licensed to access, subject to the same permissions that apply in the platform.

What this means for personal data:

• Data leaves our environment when the client asks it to. When an assistant retrieves records through MCP, those records pass to the AI client the user has connected. From that point they are processed under the terms between the client and their AI provider, not under our contracts.
• The client chooses the AI assistant. We do not control which assistant a client connects, where that provider processes data, or what that provider's retention terms are. Clients are responsible for satisfying themselves that their chosen assistant meets their own data protection obligations, and for completing their own transfer risk assessment where relevant.
• We act as processor for MCP sessions. Queries made through a client's credentials are processed on that client's instructions and are covered by our DPA.
• We log MCP activity. We record which account made which query and when, for security, abuse prevention, billing and support. Logs are retained as set out in Section 11.
• Access is scoped and revocable. Credentials are issued per client account, can be scoped to specific capabilities, and can be revoked by the client or by us at any time.
• Rate limits and volume controls apply. We monitor for extraction patterns inconsistent with licensed use and may suspend access where we detect them.

The same principles apply to any future agent or assistant integration we offer, whether through MCP or a successor protocol.

8. Sharing data and integrations

8.1 Who we share personal data with

• Licensed clients. We disclose professional contact data to clients who hold a valid Honch licence, for sales, marketing, recruitment and partnership purposes, within the limits set by their contract.
• Subprocessors. Service providers who process personal data on our behalf, listed in Section 9.
• Professional advisers. Lawyers, accountants and auditors, under duties of confidentiality.
• Authorities. Where we are required to by law, court order or a regulator, or to establish, exercise or defend legal claims.
• A buyer or successor. If Honch is sold, merged or reorganised, personal data may transfer to the acquirer, who will be bound by this policy or an equivalent one. We will notify account holders where required.

8.2 CRM integrations

We provide integrations that let clients move records from Honch into their own systems, including HubSpot, Salesforce, Microsoft Dynamics, Pipedrive and similar platforms.

How the data flows. When a user pushes a contact, or when a scheduled sync runs, we send the record to the client's CRM instance using credentials the client has authorised. Records typically carry the contact's professional details plus the account or company name and the company profile URL.

Our integration infrastructure. Our CRM integrations are built on Albato, a third-party integration platform. Albato processes the records in transit between Honch and the client's CRM. Albato is a subprocessor and is listed in Section 9.

Roles. Once a record is in the client's CRM, the client is the controller of it. We do not control what the client then does with it, how long they keep it, or who they share it with. Honch acts as processor for the transfer itself.

Authorisation. Integrations only operate where the client has connected their CRM and authorised the connection. Clients can disconnect at any time from within the platform, which stops further syncing.

Deletion and suppression. Where we suppress or delete a record following a request from an individual, we notify clients who have received that record so they can action it in their own systems, as required by Article 19 UK and EU GDPR. We cannot delete records from a client's CRM ourselves.

8.3 Data Processing Agreements

We offer a DPA to every client. It sets out the subject matter and duration of processing, the types of personal data and categories of data subject, our obligations, the subprocessor authorisation, the security measures, the audit rights and the transfer mechanisms. Request a copy from dpo@honch.co.

9. Subprocessors

We use the following third-party providers to deliver the Honch platform and website. Each is bound by a data processing agreement requiring appropriate technical and organisational measures, and processing only on our instructions.

AI assistants connected by clients are not our subprocessors. Where a client connects Claude, ChatGPT or another assistant to our MCP server, that assistant is the client's own tool and the client's agreement with that provider governs it. See Section 7.5.

Client CRM platforms are not our subprocessors. A client's own Salesforce, HubSpot or Dynamics instance belongs to the client, and the client's agreement with that platform governs it. HubSpot appears in the table above only because we use it as our own CRM.

Changes to this list. We keep this list current and review it whenever we change provider. We give clients at least 30 days' notice before adding a new subprocessor that will process client data, during which a client may object on reasonable data protection grounds. Clients can ask to be added to the notification list by emailing dpo@honch.co.

10. International transfers

Our primary hosting is in the United Kingdom.

Some of our subprocessors process personal data outside the UK and the EEA, principally in the United States. Where that happens we rely on one or more of the following:

• transfer to a country covered by UK adequacy regulations or an EU adequacy decision
• the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum
• the EU Standard Contractual Clauses for transfers from the EEA
• the EU-US Data Privacy Framework and its UK Extension, where the recipient is certified

We carry out a Transfer Risk Assessment before relying on a transfer mechanism and we review those assessments annually.

On the EU-US Data Privacy Framework. The Framework was upheld by the EU General Court in September 2025 and remains valid, but an appeal to the Court of Justice of the European Union is pending. Because of that uncertainty, we treat the Standard Contractual Clauses and the UK IDTA as our primary transfer mechanism and use the Framework only as an additional safeguard. If the Framework is invalidated, our transfers will continue under the SCCs and IDTA without interruption.

We do not rely on the EU-US Privacy Shield, which ceased to be a valid mechanism in 2020.

A copy of the relevant safeguards is available on request.

11. Security and retention

11.1 Security measures

We maintain technical and organisational measures appropriate to the risk, including:

• encryption of data in transit using TLS, and encryption of data at rest
• role-based access controls, with access limited to personnel who need it
• multi-factor authentication on administrative and production systems
• scoped API and MCP credentials that can be revoked
• logging and monitoring of system and account activity
• rate limiting and anomaly detection to identify bulk extraction
• secure development practices, dependency monitoring and regular patching
• vetting and confidentiality obligations for employees and contractors
• supplier due diligence before onboarding, and periodic review
• backup and recovery procedures, tested periodically
• a documented incident response procedure

[Optional, include only if accurate: We hold [ISO 27001 / Cyber Essentials Plus / SOC 2 Type II] certification. Our security documentation is available to clients under NDA at [LINK].]

Breach notification. We will report a personal data breach to the ICO, and to other supervisory authorities where required, within 72 hours of becoming aware of it where the breach is likely to result in a risk to individuals. Where the risk is high, we will notify affected individuals without undue delay. Where we act as a processor, we will notify the affected client without undue delay so that they can meet their own obligations.

No system can be guaranteed secure, but we take reasonable steps to protect personal data against unauthorised access, loss, misuse and disclosure.

11.2 Retention

We delete or anonymise personal data at the end of the applicable period, unless we are required to keep it for a legal claim or regulatory obligation.

12. Your rights

12.1 Rights under UK and EU GDPR

You have the right to:

• be told what we hold and where we got it
• access a copy of your personal data
• rectify inaccurate or incomplete data
• erase your data, in the circumstances set out in Article 17
• restrict processing while a dispute is resolved
• object to processing based on legitimate interests
• object to direct marketing, at any time, and we must stop
• portability of data you provided to us under contract or consent
• withdraw consent where consent is the basis, without affecting prior processing
• not be subject to solely automated decisions with legal or similarly significant effects

Objecting to our legitimate interests processing. If you object to our processing of your professional contact data, we will stop processing it unless we can demonstrate compelling legitimate grounds that override your interests. In practice, our default response is to suppress the record.

12.2 How to exercise your rights

Email dpo@honch.co, or write to the Data Protection Officer at the address in Section 2.

Tell us your name, the employer we are likely to hold you under, and the email address you believe we hold. That is usually enough for us to locate the record. We may ask for further information to confirm your identity, but only what is necessary and proportionate.

Our response times:

• we acknowledge requests within 5 working days
• we respond substantively within one month, as required by Article 12(3)
• we may extend by up to two further months for complex requests, and we will tell you within the first month if we do
• there is no charge, unless a request is manifestly unfounded or excessive

What happens when you ask to be removed. We suppress your record so it can no longer be returned in searches, exports or API and MCP responses. We keep a minimal suppression entry so that we do not re-add you from a future data source. Where we have disclosed your record to clients, we notify those clients so they can action removal in their own systems.

12.3 US state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon, Utah, Montana or another US state with a comprehensive privacy law in force, you may have the right to:

• know what personal information we have collected about you, the sources, and the categories of third parties we disclose it to
• access a portable copy
• correct inaccurate personal information
• delete your personal information
• opt out of the sale or sharing of your personal information, and of targeted advertising
• opt out of profiling in furtherance of decisions producing legal or similarly significant effects
• be free from discrimination for exercising these rights

Note on business contact information. The California Consumer Privacy Act applies to personal information about individuals acting in a business capacity. The exemption that previously applied to business-to-business contact data expired on 1 January 2023. Our database is therefore in scope where it contains information about California residents.

Sale and sharing. Licensing professional contact data to our clients is likely to constitute a "sale" as that term is defined in the CCPA and in several other state laws, even though the individual data subject receives no payment and no advertising is involved. California residents and residents of other states with an opt-out right may opt out at Do Not Sell or Share My Personal Information or by emailing dpo@honch.co. We honour Global Privacy Control signals received through our website.

We do not sell or share the personal information of anyone we know to be under 16.

Authorised agents. You may use an authorised agent to submit a request. We will ask for proof of authorisation.

Appeals. If we decline your request, you may appeal by emailing dpo@honch.co with "Privacy Appeal" in the subject line. We will respond within 45 days with our decision and reasons. If we deny the appeal, we will tell you how to complain to your state Attorney General.

12.4 Data broker status

Honch licenses professional contact data about individuals with whom we do not have a direct relationship. In several US states that makes us a data broker, with registration and disclosure obligations.

[Complete or delete this block once the position is confirmed with US counsel. See the notes accompanying this draft.]

• California: [Registered with the California Privacy Protection Agency, registration number [NUMBER]. We access the Delete Request and Opt-Out Platform (DROP) at least once every 45 days, and we process each deletion request and report its status in DROP within 45 days.]
• Texas: [Honch Data Limited is a data broker as defined by Texas Business and Commerce Code Chapter 509. Registration number [NUMBER].]
• Vermont: [Registered with the Vermont Secretary of State, registration number [NUMBER].]
• Oregon: [Registered with the Oregon Department of Consumer and Business Services, registration number [NUMBER].]
• Connecticut: [Registration required by 1 January 2027.]
• New Jersey: [Registration window opens 1 April 2027.]

California residents can also submit a single deletion request to all registered data brokers through the CPPA's DROP platform at privacy.ca.gov.

13. Cookies

We use cookies and similar technologies in accordance with the Privacy and Electronic Communications Regulations (PECR) and, for EEA visitors, the ePrivacy Directive as implemented locally.

13.1 What we use

Strictly necessary. Required for the site and platform to work, including session management, authentication, security and error monitoring. These do not require consent.

Analytics and performance. Help us understand how the site is used. We use HubSpot analytics.

Advertising and conversion tracking. Let us measure the performance of our advertising and show relevant ads to people who have visited our site. We use Google Ads conversion and remarketing tags, the LinkedIn Insight Tag, and the HubSpot ads pixel.

Visitor identification. Identify the organisation a visitor is browsing from, so that our sales team can follow up with companies showing interest. We use Snitcher and Leadsy.

Embedded content. Video hosted by Vimeo sets its own cookies when a video is played.

A full, current cookie table, listing each cookie, its purpose, its provider and its lifespan, is available on our cookie settings page.

13.2 Consent

We ask for consent before setting any non-essential cookie. Our banner gives "Accept all" and "Reject all" equal prominence, and we do not treat continued browsing as consent. Advertising, visitor identification and embedded content technologies are not loaded until you consent to them.

You can change or withdraw your choices at any time through our cookie settings. Withdrawing consent is as easy as giving it.

The Data (Use and Access) Act 2025 created a limited exemption from consent, in force from 5 February 2026, for cookies whose sole purpose is collecting statistics to improve the service we provide. That exemption does not apply where analytics data is shared with a third party for that third party's own purposes, so we ask for consent for our analytics cookies rather than relying on it.

13.3 Visitor identification and your rights

Snitcher and Leadsy work by matching your IP address against business databases to infer the organisation you are browsing from. Where that inference relates to an identifiable individual, it is personal data and you have the rights set out in Section 12, including the right to object. Contact dpo@honch.co.

14. Complaints

14.1 Complain to us first

We operate a formal data protection complaints procedure, as required by section 164A of the Data Protection Act 2018 (inserted by the Data (Use and Access) Act 2025).

To make a complaint:

• use our data protection complaint form
• or email dpo@honch.co with "Data protection complaint" in the subject line
• or write to the Data Protection Officer, Honch Data Limited, 24 Sunnyside Road, Epping, CM16 4JW

What happens next:

1. We acknowledge your complaint within 30 days, and in practice within 5 working days.
2. We investigate without undue delay.
3. We keep you informed of progress, and we will tell you if we need more time.
4. We give you our decision in plain language, with reasons.
5. We tell you how to escalate if you are not satisfied.

14.2 Escalate to a regulator

You have the right to complain to a supervisory authority at any time. You do not have to come to us first, though we would like the chance to put things right.

United Kingdom: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF. Helpline 0303 123 1113. ico.org.uk

European Economic Area: the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred. A list is published by the European Data Protection Board at edpb.europa.eu. You may also contact our EU representative, named in Section 2.

United States: your state Attorney General, or the California Privacy Protection Agency for California residents.

15. Third-party links

Our website and platform contain links to third-party sites and applications, including client CRM platforms, AI assistants and public profiles. We do not control them and are not responsible for their privacy practices. Review their policies before providing personal information.

16. Contact

Data protection, privacy rights and security: dpo@honch.co
General enquiries: info@honch.co
Post: Data Protection Officer, Honch Data Limited, 24 Sunnyside Road, Epping, CM16 4JW, United Kingdom

EU representative: [NAME, ADDRESS, EMAIL]