Privacy notice — how we contact buyers (Art. 13/14 GDPR)

Who we are. FSFM GmbH, operator of Clacta. Fischerinsel 6, 10179 Berlin, Germany · Amtsgericht Charlottenburg, HRB 233209B · Managing director: Liguo Song. Privacy contact: nora@team.clacta.com.

What this covers. We contact individual people at companies — in purchasing, sourcing and category roles, or the managing director of a smaller company — one person at a time, to tell them about Clacta's supplier checks. This page explains what we hold about you if we contacted you.

What we hold. Your name, job title, company, business contact details (business email address or business postal address), the address of your public professional profile, public information about you in your professional role that we used to write to you (for example a company announcement, an interview or a talk — we keep its link), where we found your details, notes on your role in your company's purchasing as your profile or your company's website shows it (for example whom you report to), how we're connected to you on LinkedIn (for example through a mutual connection, or how many connections we share), the dates and content of our messages to you, and your replies — including your words if you said yes or asked us to stop.

Where we found it. Your public professional profile (LinkedIn or XING), your company's website (team page, press page or legal notice), trade press or event pages that name you in your professional role, or you gave it to us yourself (for example at a trade fair). A letter goes to your company's business address as published in its legal notice. The first message we send you names the specific source.

Why, and on what legal basis. To decide whom to contact and what to write about, and to contact you about supplier checks for your company. Legal basis: our legitimate interest in offering our service to businesses (Art. 6(1)(f) GDPR). Unless you have asked us to, we send you one letter, one email or one LinkedIn message — only one of them, and never a second one. On LinkedIn, a connection request may come first.

Who else processes it. Supabase (our database, EU) · Hetzner Online GmbH (our servers, Germany) · Resend, Inc. (email delivery, USA) · LetterXpress, A&O Fischer GmbH & Co. KG (printing and posting our letters, Germany) · IONOS (our mailbox for sending and receiving outreach e-mail, Germany) · TypeSafe AI, Inc. (sorting incoming email by sender and subject, USA) · LinkedIn (if we wrote to you there). Replies to our reply address are also forwarded to a Gmail mailbox of our company; Google (Google Ireland Limited, for the European Economic Area) provides that mailbox under its own terms and may process it on servers outside the country where you live. The postal service that delivers a letter receives your name and business address. Our outreach messages are drafted and handled by an AI agent; for this our team uses Claude, a service of Anthropic, which processes the text under its own terms, including in the USA. Transfers to the USA by Resend rely on EU Standard Contractual Clauses (Module 2) and the EU–U.S. Data Privacy Framework. Transfers to the USA by TypeSafe rely on EU Standard Contractual Clauses (Module 2).

How long. If you do not reply: deleted no later than 6 months after our last message. If you reply: we keep the conversation no longer than 6 months after the last message in it. If it leads to an order, the correspondence about that order is kept for the period German commercial and tax law requires (up to six years for business letters). If we found your details but never contacted you: deleted within 30 days. If we sent you a LinkedIn connection request and you didn't accept it: deleted within 30 days of finding your details. When we delete your details, we keep one thing: a one-way fingerprint made from your email address, or from your name and your company's web address. It holds nothing readable — no name, address, message or date — and we use it only to make sure we never write to you a second time. It is deleted 3 years after our message. If you ask us to stop: we keep your email address, or that fingerprint, on a do-not-contact list, only so that we never contact you again.

Your rights. You can ask for access, correction, deletion or restriction, and data portability. You can complain to a data protection supervisory authority — ours is Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Your right to object. You can object at any time to our use of your data for this kind of contact (Art. 21(2) GDPR). Reply "stop" to any message, or write to nora@team.clacta.com. We then stop and never contact you again.

Version outreach-notice-2026-11-02-i.