Prospect Privacy Notice

1. Who we are

Tuppence (tuppence.ai) is a payments platform for businesses. It is operated by Tuppence AI Ltd, a private limited company registered in England and Wales, with its registered office at 38 Greenvale Road, London SE9 1PD, United Kingdom (“we”, “us”, “our”). We are the controller of the personal data described in this notice.

For anything about this notice or your data, email contact@tuppence.ai with “Prospect privacy” in the subject line, or write to us at the address above. Our director is responsible for data protection at Tuppence.

2. Who this notice is for

This notice is for people who work at businesses we think might save money by taking card payments with Tuppence, and whom we may contact by email or on LinkedIn about it. It explains, as Article 14 of the UK General Data Protection Regulation (UK GDPR) requires, what we do with personal data we did not collect from you directly. If you use Tuppence or have signed up, our main Privacy Notice applies instead, and we will not send you these emails.

3. What we hold about you

• Work contact details: your name, job title or role, and work email address at your company.
• Facts about your company: its name, website, what it sells, how it appears to take payments online, prices published on its website, and its registration details on the public register. These are facts about the business; where one names you, we treat it as your personal data too.
• Your LinkedIn profile: if you have a public LinkedIn profile, the name, job title, company and profile link you published on it.
• Our assessment: how well we think Tuppence fits your company, with the facts it rests on.
• Our contact with you: the emails, LinkedIn connection requests and LinkedIn messages we sent, when, and your replies.
• Your choice to stop: if you unsubscribe or object, a one-way code made from your email address (or your company’s domain) and from your LinkedIn profile link, so we can keep that promise without keeping the address itself.

We do not collect sensitive personal data about you, and we do not use your personal email address, phone number or home address.

4. Where we found it

If you ask us where we found your details, we will tell you the actual source from our records.

5. Why we use it, and our lawful basis

We use this data to find businesses that might save money with Tuppence, to check that writing to them is allowed, to email or message the right person about it a few times at most, to answer replies, and to make sure that anyone who has asked us to stop is never contacted again.

Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR). Our interest is telling businesses about a service that may lower what they pay to take card payments; UK law recognises direct marketing as a possible legitimate interest. We have weighed it against your interests in a written legitimate interests assessment, and we limit what we do accordingly: we only use work contact details, only write about something relevant to your role, send at most four emails unless you reply, and make it easy to stop at any time. You can ask us for a summary of that assessment.

Keeping the one-way code of your address after you ask us to stop is necessary to honour your objection, which is also a legitimate interest, and yours as much as ours.

6. Who we email, and how often

In the UK we only email people at companies, limited liability partnerships and other corporate bodies, which the Privacy and Electronic Communications Regulations allow without prior consent. We do not send unsolicited emails to sole traders or ordinary partnerships. We never send marketing texts or make marketing calls.

Each sequence is at most four short emails over about three weeks, sent in business hours. It stops at once if you reply, unsubscribe, sign up, or if anything else tells us to stop. Every email says who we are, links to this notice and has a one-click unsubscribe.

On LinkedIn. We may also send you one connection request on LinkedIn from the account of a person at Tuppence, with a short note that does not sell anything. The same rule applies there: in the UK we only contact people at companies, limited liability partnerships and other corporate bodies. If you accept, any message we send you there is checked and sent by that person. We withdraw a request you have not accepted after about three weeks.

7. Software and AI

We use software, including AI models, to read public company websites, to summarise what a business does and to score how well Tuppence might fit it. Every fact it relies on is recorded with where it was found. These scores decide whether we might write to a company, which has no legal or similarly significant effect on you, and the rules that decide whether contact is allowed at all are fixed rules that the AI cannot override. A person approves our first emails.

8. Who we share it with

We do not sell your data. We share it only with service providers who handle it for us under contract and on our instructions:

• the data providers in section 4, when we ask them about a company or a contact;
• Smartlead, the service that sends our outreach emails and reports replies and unsubscribes to us;
• Unipile, a service based in France that connects our LinkedIn account to our software: it sends our connection requests and LinkedIn messages and passes your replies to us, and holds them in the European Union;
• Google, for our email accounts (Google Workspace) and the cloud servers that hold our records (Google Cloud);
• Anthropic, whose AI models summarise public company information and help draft replies, which a person approves.

LinkedIn itself carries our connection requests and messages, and your replies, under its own privacy policy. We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.

9. Where it is stored

We hold our records on Google Cloud in the europe-west2 region (London). Some of the providers in sections 4 and 8 process personal data in other countries, mainly the United States. When personal data is transferred outside the UK, we make sure it is protected by:

• UK adequacy regulations for the destination, including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it; or
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and any additional safeguards needed.

10. How long we keep it

• If you never engage with us, we delete your contact details and anything that names you 12 months after we last had reason to hold them.
• If you reply or become a customer, we keep what is needed for that conversation or relationship, under our main Privacy Notice.
• We keep our LinkedIn connection requests and messages, and your replies on LinkedIn, in the same way as our emails and your email replies.
• If you unsubscribe or object, we keep only the one-way code of your address (or domain) and of your LinkedIn profile link, for good, so that we never write to you again. It cannot be turned back into your address.

11. How to stop our emails

You have an absolute right to object to direct marketing, and we honour it at once, in every sequence. Any of these works:

• click unsubscribe in any of our emails, or use your email app’s own unsubscribe button;
• choose Nobody at our company wants these on the unsubscribe page, and we will not email anyone at your company’s email domain again;
• reply “no”, or anything that asks us to stop, to an email or on LinkedIn;
• email contact@tuppence.ai.

Stopping covers both: if you ask us to stop on LinkedIn, we will not email you either, and if you unsubscribe from our emails, we will not contact you on LinkedIn.

12. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and receive a copy;
• rectification of inaccurate or incomplete data;
• erasure, where there is no good reason for us to keep it (we keep the one-way code described in section 10 so we can honour your choice);
• restrict how we use it in certain circumstances;
• object to processing based on legitimate interests, and to direct marketing at any time (see section 11).

To exercise a right, email contact@tuppence.ai. We may need to confirm that the email address is yours. We will respond within one month, or tell you if we need longer because your request is complex.

13. Contact and complaints

If you have questions about this notice, email contact@tuppence.ai or write to Tuppence AI Ltd, 38 Greenvale Road, London SE9 1PD, United Kingdom.

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk. We would appreciate the chance to put things right first, so please contact us before you do.

14. About this notice

This notice explains how we handle personal data, as data protection law requires. It is not a contract. We will update it when our practices change; the version and date at the top show which one you are reading. If you are in the United States, our US Prospect Privacy Notice applies to you instead.