Privacy policy
How OPM Technology Ltd, trading as Konexus, collects and uses personal data through Envoy and the konexus.ai website.
- Who we are
- Who this policy covers
- Controller or processor
- The personal data we collect
- Where we get personal data from
- How we use personal data and our lawful bases
- How Envoy uses AI
- Who we share personal data with
- International transfers
- How long we keep personal data
- Keeping your data secure
- Your rights
- Complaints
- Children
- Changes to this policy
Who we are
Envoy is a managed outbound email service run by OPM Technology Ltd, trading as Konexus. We are registered in England and Wales under company number 15000659, and our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
For questions about this policy or your personal data, email rob@konexus.ai or write to us at our registered office. We have not appointed a Data Protection Officer, as the law does not require one for a business of our type, but these contact details reach the person responsible.
Who this policy covers
This policy explains how we handle personal data about:
- Visitors to our website, konexus.ai
- People who request a Five-Prospect Preview or otherwise contact us
- Our customers and the people who work for them
- People we contact about Envoy itself, when we use Envoy to find new customers for our own business
- People our customers contact through Envoy (prospects), where we act on our customer's behalf
Controller or processor
For most of the activities in this policy we decide how and why your personal data is used, which makes us the controller.
The exception is the outreach we run for our customers. When a business uses Envoy to contact you, that business is the controller and we act as its processor, working only on its instructions under a written data processing agreement. If you have received an email sent through Envoy on another business's behalf, that business is responsible for how your data is used, and its own privacy notice applies. You can still contact us, and we will pass your request to them and help them deal with it. Every email sent through Envoy, whether for us or for a customer, includes a way to opt out, and opt-outs are actioned straight away.
The personal data we collect
When you visit our website
- Information about how you use the site, such as pages viewed, time on page, the device and browser you use, the website that referred you and your approximate location. We collect this through Google Analytics. See our cookie policy.
- If you arrive through one of our campaign links and then send us a Five-Prospect Preview request, the campaign tag in that link (for example, which post or email you came from) is sent with your request. We do not store it on your device.
- Our website host keeps short-lived technical logs, including IP addresses, to run the site securely.
When you request a Five-Prospect Preview or contact us
- Your name and work email address (required, so we can send your preview)
- The five firms you would like to win (required, so we know who to research)
- What a new client is worth to you, if you choose to tell us
- The campaign tag in the link you arrived from, if any
- Anything else you choose to tell us in emails or on calls
Your request reaches us through FormSubmit, which also sends you an automatic confirmation email.
When you become a customer
- Names, job titles and business contact details of the people we deal with
- Your company details, billing records and subscription history. Card payments are handled by Stripe. We never see or store your full card number.
- The materials you give us to set up Envoy, such as your ideal client profile, knowledge base content, examples of your writing and your approval decisions
- Records of our communications with you
About prospects
We find and research prospects in three situations: for our own business, for a customer's campaigns, and for a Five-Prospect Preview, where we research decision-makers at the five firms the person requesting the preview has named. In each case we collect:
- Name, job title and employer
- Business email address and business telephone number
- Links to public professional profiles and company web pages
- Publicly available professional information about the person and their business, such as company news, services and published articles
- Records of the emails sent, replies received and any opt-out
We do not intend to collect special category data, such as health information or political opinions, and we instruct our systems not to.
Where we get personal data from
- From you, when you fill in our form, email us, speak to us or become a customer
- From your device, through cookies and similar technologies (see our cookie policy)
- From publicly available sources, such as company websites, Companies House, news articles and public professional profiles
- From business contact data providers, which supply professional contact details for people at companies
- From our customers, when they give us lists or instructions for their campaigns
How we use personal data and our lawful bases
| Purpose | What we do | Lawful basis |
|---|---|---|
| Running our website | Show you the site, keep it secure, fix faults | Legitimate interests: running a safe, working website |
| Understanding how the site is used | Aggregate analytics, to see which pages work and improve the site | Legitimate interests: improving our website. You can turn analytics off at any time |
| Knowing which campaign a request came from | Recording the campaign tag sent with a Five-Prospect Preview request | Legitimate interests: understanding which of our campaigns work |
| Your Five-Prospect Preview (you) | Prepare your preview, walk you through it and follow up about it | Steps taken at your request before entering into a contract |
| Your Five-Prospect Preview (the people researched) | Research decision-makers at the five firms you named and draft example emails to show you. We do not send these emails | Legitimate interests: showing a prospective customer how Envoy would work for them |
| Providing Envoy to customers | Set up and run campaigns, take approvals, send emails, handle replies, report | Contract |
| Billing and records | Take payments, keep invoices and accounting records | Contract and legal obligation |
| Our own outreach | Find businesses that may benefit from Envoy, research them and send a small number of relevant emails to people in their roles | Legitimate interests: promoting our services to businesses, balanced against your interests (see below) |
| Customers' outreach | Process prospect data on our customers' instructions | We act as processor. The customer is responsible for having a lawful basis |
| Legal claims and compliance | Keep records needed to defend claims or meet regulators' requests | Legitimate interests and legal obligation |
Our own business-to-business outreach
When we email someone about Envoy, we only contact people in roles where Envoy is relevant to their business, using business contact details. Before we start, we weigh our interest in finding customers against your privacy, and we keep the outreach limited and relevant. Every email says who we are and gives you a simple way to opt out. If you opt out or object, we stop and add your details to a suppression list so we do not contact you again.
Under the Privacy and Electronic Communications Regulations, sole traders and some partnerships are treated like individuals. We do not send them marketing emails unless they have consented, or we got their details while selling, or discussing selling, them a similar service and gave them a chance to opt out.
How Envoy uses AI
Envoy uses AI models to help research prospects and draft emails. The research into each prospect is used to personalise the email they receive. Customers can approve every email before it is sent. If a customer switches to automatic sending, emails go out without each one being reviewed, within the campaign settings the customer approved. We do not use AI to make decisions about you that have legal or similarly significant effects.
Who we share personal data with
We do not sell personal data.
Service providers acting for us
These providers process personal data on our behalf, under contracts that require them to protect it and use it only on our instructions:
| Type of provider | What they do |
|---|---|
| Website hosting (Vercel) | Hosts konexus.ai and its technical logs |
| Database and application hosting (Google Firebase) | Stores Envoy account, campaign and prospect data |
| AI model providers | Help research prospects and draft emails |
| Email sending and inbox services | Send approved emails and receive replies |
| Form delivery (FormSubmit) | Delivers Five-Prospect Preview requests to our inbox and sends your confirmation email |
| Analytics (Google Analytics) | Measures how our website is used. Google acts as our processor under its data processing terms |
Organisations that use data under their own terms
| Organisation | What they do |
|---|---|
| Payments (Stripe) | Takes and manages card payments. Stripe also uses payment data for its own fraud prevention and legal obligations, under its own privacy policy |
| Business contact data providers | Supply business contact details for prospects. They hold this data as controllers under their own privacy notices |
| Web fonts (Google Fonts) | Supplies the typefaces our pages use. Your browser requests them from Google, which receives your IP address under Google's own terms |
We keep a full list of the providers we use, by name, and will share it on request.
We may also share personal data with professional advisers such as lawyers and accountants, with authorities where the law requires it, and with a buyer or successor if our business is sold or reorganised.
International transfers
Some of our providers are based in, or store data in, the United States or other countries outside the UK. When personal data leaves the UK, we make sure it is protected by one of the safeguards UK law recognises, such as:
- UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US companies
- The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses
Contact us if you would like a copy of the safeguards that apply.
How long we keep personal data
| Data | How long |
|---|---|
| Five-Prospect Preview requests and enquiries that do not lead to a contract | 12 months from our last contact with you |
| Customer account and contract records, and campaign records such as settings, approvals and reports (not prospect personal data) | For the contract, then 6 years for legal and tax purposes |
| Prospect data in customer campaigns | Returned or deleted within 60 days of the contract ending, as our customer instructs |
| Prospect data in our own outreach | Up to 12 months after our last contact, unless you become a customer |
| Research into the people at the five firms named for a Five-Prospect Preview | Deleted within 90 days of the preview, unless the person who asked for it becomes a customer and asks us to contact those firms |
| Suppression lists (opt-outs) | For our own outreach, for as long as we contact businesses. For customer campaigns, as set out in our agreement with that customer. We keep only the minimum needed to respect your choice |
| Website analytics | 14 months in Google Analytics |
Keeping your data secure
We use access controls, encryption in transit, secure credential storage and limited staff access to protect personal data. Only people who need it for their work can see it, and they are bound by confidentiality.
Your rights
Your right to object. You can object at any time to our use of your personal data for direct marketing, and we will stop. You can also object where we rely on legitimate interests, and we will stop unless we have compelling grounds to continue. To object, reply to any of our emails, use the opt-out link in it, or email rob@konexus.ai.
Under UK data protection law you also have the right to:
- Ask for a copy of your personal data
- Ask us to correct data that is wrong or incomplete
- Ask us to delete your data
- Ask us to restrict how we use it
- Ask for your data in a portable format, where this applies
- Withdraw consent, where we rely on it
To use any of these rights, email rob@konexus.ai. We may ask you to confirm your identity. We will respond within one month. If your request is complex, we may extend this by up to two months and will tell you why.
If you received an email sent through Envoy on behalf of another business, that business is the controller. Contact them first, or contact us and we will pass your request on.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at rob@konexus.ai. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
Envoy is a business service. It is not aimed at children, and we do not knowingly collect children's personal data.
Changes to this policy
We will update this policy when the way we handle personal data changes. The date at the top shows when it was last updated. If a change is significant, we will tell our customers by email.