Business Contact Privacy Notice

1. Who this notice is for

This notice is for business contacts and leads— people who are not excede account holders — whose professional contact details may be stored and processed by a customer organization using the excede platform ("Customer"). You may have received a link to this page in outreach or correspondence from that organization.

For most Customer Data, the Customer organization is the data controller(or "business" under CCPA/CPRA). Excede, Inc. acts as a service provider / data processoron the Customer's instructions. Our general Privacy Policy is at /privacy.

2. Controller identity & contact

Customer organization (controller): the firm that stores your business contact record in excede and conducts outreach. Use the contact details they provided in their communication, or request them via the privacy path below if you are unsure which organization holds your data.

Excede, Inc. (processor / service provider):

3. Categories of personal data

Depending on what the Customer stores, processing may include:

• Identifiers and professional details (name, work email, phone, job title, company)
• Mailing or office address, where provided
• Business correspondence content exchanged with the Customer (e.g. email bodies)
• Inferences and scores derived from engagement history (lead heat scores, classification labels, outreach prioritization signals)

We do not intentionally process special-category (sensitive) data. Free-text email content could incidentally contain it; Customers and Excede apply minimization and retention limits described below.

4. Purposes & automated profiling

Customer organizations use excede for B2B relationship management. Automated processing over contact data may include:

• Lead heat-scoring — rule-based engagement scores to help prioritize outreach (heuristics; not solely LLM decisions)
• Contact / email classification — AI-assisted labeling of contacts and message intent for CRM hygiene
• Candidate selection — suggesting which contacts to include in outreach waves
• Outreach draft generation — AI-assisted draft emails reviewed by a human before send
• Company / market research — firmographic and market signals tied to your employer or domain

These outputs are advisory. A human selects contacts, reviews drafts, and sends outreach. There is no solely automated decision that produces legal or similarly significant effects on you within the meaning of GDPR Article 22.

5. Lawful basis summary

Where GDPR (or UK GDPR) applies, processing of business contact data for these purposes relies primarily on legitimate interests (Art. 6(1)(f)) — specifically, B2B relationship management and proportionate outreach prioritization — balanced against your rights and freedoms. Consent is not the primary basis for ordinary B2B contact processing.

Under CCPA/CPRA, processing is for the Customer's business purposes. Excede does not sell personal information for monetary consideration and does not share it for cross-context behavioral advertising. Certain automated scoring may still be treated as a "sale" or "share" in some jurisdictions; you may opt out via the scoring objection / do-not-sell path in Section 8.

6. Recipients & sub-processors

Personal data may be disclosed to: (a) the Customer organization and its authorized users; (b) Excede personnel under need-to-know access; and (c) sub-processors that host or assist the Service (for example cloud hosting, email delivery, and AI model providers), under contracts that limit use to providing the Service.

The current sub-processor list is at /subprocessors. Processing and hosting currently occur in the United States unless a Customer has a separate written arrangement.

7. Retention

• Contact / lead records and scoring data: retained while the Customer organization account is active; deleted when the account is closed or upon a verified deletion / score-deletion request
• Raw email body text used for contact-mining context: generally nulled after 90 days (metadata may be retained)
• Privacy request records: retained for 24 months after request closure (CCPA record-keeping)

Full schedules appear in our Privacy Policy (Data Retention Schedule).

8. Your rights — object, do-not-sell, erase

Depending on applicable law, you may:

• Object to AI / automated scoring and related profiling (GDPR Art. 21), including CCPA/CPRA opt-out of sale/share where that characterization applies
• Request erasure of your contact record and derived scoring data (subject to legal retention)
• Request access to personal data held about you in scope of the request
• Request human review of an automated scoring outcome

Excede honors scoring objections by excluding matching contacts from AI scoring and related AI processing paths before model calls. Submit a request here:

Privacy request form for business contacts →

Or email privacy@excede.ai. We aim to respond within 30 days (or sooner where law requires).

9. Further information

• Privacy Policy
• Sub-Processor List
• Data Security Addendum