Privacy policy
How we handle personal information for prospects, buyers, partners and visitors, and how to use your rights.
Who we are
This policy explains how IntroHarbor (“we”) handles personal information. IntroHarbor runs an introduction network that connects businesses that may need a product or service with vetted B2B companies that provide it (“buyers”), working with lead-generation professionals (“partners”) who submit opportunities to us. For the purposes of data protection law, we are the controller of the information described here. Contact: hello@introharbor.com.
Whose information we handle
- Prospects: business decision-makers who agreed, through a partner, to be introduced to a provider, whom our team contacts to verify the opportunity, and who may be introduced to a buyer.
- Buyers: staff of client companies who request opportunities.
- Partners and applicants: lead-generation professionals who apply to or work with us.
- Website visitors and anyone who contacts us.
Prospects: information we did not collect from you (GDPR Art. 14)
If a partner passed your details to us after you agreed to be introduced, or our team contacted you to verify an opportunity, this section is our notice to you.
Categories of information
- Identity and business contact details: name, job title, company, business email, business phone, LinkedIn profile URL.
- Company information: size, industry, location, website.
- Opportunity details: the services you're interested in, project scope, budget band or team size, timeline and notes from conversations.
- Records of consent, preferences and opt-outs, and call recordings where you were told about recording.
Sources
Partners who were in touch with you and passed your details to us after you agreed to be introduced, information you give our team on verification calls, your company's public website and professional profiles, and public business registers. We don't buy, rent or scrape contact lists, and we don't accept opportunities built from them. See our data sourcing policy.
Purposes and lawful bases
- Contacting you to verify an opportunity and check your interest: legitimate interests in business-to-business outreach (GDPR Art. 6(1)(f)), or consent where local law requires it, for example for some marketing email.
- Introducing you to a provider: your consent (Art. 6(1)(a)), which you can withdraw at any time.
- Keeping a suppression list so we don't contact you again: legal obligation and legitimate interests.
- Quality checks, fraud prevention, and defending legal claims: legitimate interests.
Recipients
With your agreement, we share your business contact details and opportunity notes with one vetted provider only. Each introduction is exclusive: we never pass it to a second company. That provider becomes an independent controller of the information and must use it only to discuss your enquiry. We also use service providers (processors) for hosting, email, telephony, CRM and form handling.
How long we keep it
Only as long as needed for the introduction and our legal obligations. Suppression records are kept as long as needed to honour your opt-out.
Buyers, partners and visitors
- Buyers: contact and company details, program preferences, contracts and billing records, to deliver our service (contract) and for our legitimate interests in managing the relationship.
- Partners and applicants: contact and professional details and the records needed to work together (contract and legitimate interests). Applications not taken forward are deleted once we've decided.
- Visitors and enquirers: what you submit through our forms and basic technical logs kept by our hosting provider for security.
International transfers
We work from India and the United States, and buyers may be anywhere. When we transfer personal data from the UK or EEA to countries without an adequacy decision, we use the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful mechanism. Ask us for a copy at hello@introharbor.com.
Your rights (UK, EU and elsewhere)
Depending on where you are, you can ask to access, correct or delete your information, restrict or object to processing (including an absolute right to object to direct marketing), withdraw consent and receive a portable copy. Use the opt-out and privacy request form or email hello@introharbor.com. We respond within one month, extendable where the law allows. You can also complain to your local data protection authority, for example the ICO in the UK.
Notice for California residents (CCPA/CPRA)
This section applies to California residents, including people contacted in a business-to-business context.
Categories collected in the last 12 months
| Category | Examples | Sold or shared? |
|---|---|---|
| Identifiers | Name, business email, phone, LinkedIn URL | Yes: disclosed to one vetted provider when you agree to an introduction |
| Professional or employment information | Job title, employer, role in purchasing | Yes, as above |
| Commercial information | Services of interest, project scope, budget band, timeline | Yes, as above |
| Audio information | Call recordings, with notice | No |
| Internet activity | Basic website logs | No |
We don't collect sensitive personal information for the purpose of inferring characteristics. Sources, purposes and retention are described above.
Sale and sharing
Introducing you to a provider in return for payment from that provider may be a “sale” under California law. We don't knowingly sell or share the personal information of anyone under 16. You can opt out at any time on our Do Not Sell or Share My Personal Information page. Our website honours Global Privacy Control (GPC) signals as an opt-out for the browser sending them.
Your rights
You have the right to know, access, delete and correct your information, to opt out of sale and sharing, to limit the use of sensitive information (which we don't use for that purpose) and not to be discriminated against for using these rights. We confirm receipt within 10 business days and respond within 45 days, which can be extended once by another 45 days with notice. We verify requests by matching the details you give us with our records. An authorised agent can make a request with your signed permission, and we may ask you to confirm your identity directly.
Notice for people in India (DPDP Act 2023)
Where the Digital Personal Data Protection Act, 2023 applies, we process your personal data for the purposes described above, on the basis of your consent or a legitimate use permitted by the Act. You can access a summary of your data, correct or erase it, withdraw consent and nominate another person to exercise your rights. Grievance contact: hello@introharbor.com. If you aren't satisfied with our response, you can contact the Data Protection Board of India.
Cookies and analytics
This website doesn't use advertising or tracking cookies. If we add privacy-friendly analytics, or anything that needs consent, we'll update this policy and ask for consent where required.
Security
We use access controls, encryption in transit, least-privilege access and contractual security obligations for buyers and service providers. We review incidents promptly and notify authorities and affected people where the law requires it.
Children
Our services are for businesses. We don't knowingly collect information from children.
Changes and contact
We'll post changes here and update the date above. Questions or requests: hello@introharbor.com.