Privacy Policy: Reachievable
Effective date: 1 October 2026
Controller: Reachievable, operating as an individual sole trader based in London, United Kingdom (“we”, “us”, “our”). For data-protection purposes, the controller is the sole trader operating as Reachievable.
Privacy contact: support (at) reachievable.com
This policy explains what personal data we collect, why, and what your rights are. It covers three groups of people: (1) visitors to our website, (2) our paying customers, and (3) the business contacts who appear in the lead lists we provide. If you are in group (3), please read Section 5 and Section 7 carefully. They are written for you.
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Where we serve customers or contacts in other regions, we also respect applicable local laws, including the EU GDPR, California's CCPA/CPRA, and Canada's PIPEDA and Quebec Law 25 (see Sections 13–14).
1. The personal data we collect
1a. Website visitors
- Contact details you give us (e.g. email address if you sign up or contact us).
- Technical data: IP address, device and browser type, pages visited, and approximate location, collected via strictly necessary cookies and, only with your consent, advertising cookies (see Section 8).
1b. Customers
- Account data: email address (used for magic-link sign-in via Supabase), subscription plan, and ICP (ideal customer profile) answers you provide on our onboarding form.
- Billing metadata: subscription status, invoices, and payment history. Card details are processed by Stripe and never touch our systems (see Section 9).
- Usage data: dashboard activity, list downloads.
1c. Business contacts in our lead lists
For each lead we compile and license to customers:
- Full name, job title, and verified work email address.
- Company information: company name, website, industry, employee count, headquarters location.
- Publicly available "trigger" evidence, such as a public job posting, funding announcement, or expansion news, with its source URL.
We do not collect personal (non-work) email addresses or personal/mobile phone numbers.
2. How we use personal data and our lawful bases (UK GDPR)
| Purpose | Data used | Lawful basis |
|---|---|---|
| Provide the service: accounts, dashboard, weekly list delivery | 1a, 1b | Contract (Art. 6(1)(b)) |
| Process payments and prevent fraud | 1b | Contract; legal obligation (Art. 6(1)(c)) for tax records |
| Compile, verify, and license B2B lead lists | 1c | Legitimate interests (Art. 6(1)(f)), see Section 5 |
| Send transactional emails (sign-in links, receipts, "your leads are ready") | 1b | Contract / legitimate interests |
| Send marketing emails about our own services | 1a, 1b | Legitimate interests; consent where required (see Section 6) |
| Website security, analytics, and improvement | 1a | Legitimate interests (strictly necessary functions) |
| Advertising measurement (Meta Pixel) | 1a | Consent (Art. 6(1)(a)), only after you opt in (see Section 8) |
| Comply with legal obligations | 1a, 1b, 1c | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have carried out a Legitimate Interests Assessment balancing our interests against individuals' rights. You may request a summary of it at support (at) reachievable.com.
3. Who we share personal data with
- Customers: business-contact data (Section 1c) is licensed to our paying subscribers as the core of our service.
- Sub-processors: the service providers described in Section 9, under data processing agreements.
- Authorities: where required by law, court order, or to protect our legal rights.
- We do not sell personal data other than through the licensed lead lists described in this policy (see Section 13 for California residents).
4. International transfers
Some of our sub-processors are based in the United States. Where personal data leaves the UK, we rely on:
- the UK–US Data Bridge (UK Extension to the EU–US Data Privacy Framework), where the recipient holds an active certification; or otherwise
- the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, plus a transfer risk assessment.
You may request a copy of the relevant safeguards at support (at) reachievable.com.
5. Our lead database: information for business contacts listed in it
What we hold: the categories in Section 1c: professional contact details and public business information only.
Where it comes from: publicly accessible sources (company websites, public professional profiles, public job postings, funding announcements) and licensed data partners. We record the source category for the data we hold.
Why we hold it: our legitimate interest in compiling and licensing B2B contact data so our customers can conduct business-to-business sales and marketing. Direct marketing can be a legitimate interest (GDPR Recital 47), and business contact details shared in a professional context carry a reasonable expectation of business-related contact. We have documented this assessment and keep it under review.
Who receives it: our paying subscribers, who are contractually required to comply with all applicable anti-spam and privacy laws (including CAN-SPAM, CASL, UK/EU GDPR, and PECR) when contacting you, and to honour opt-outs.
How long we keep it: we periodically re-verify records and remove or correct stale data. If you object or opt out (Section 7), we suppress your record and add it to a permanent do-not-contact list so it is never re-ingested or re-licensed.
Your rights: you have the same rights as any data subject under Section 6, including the absolute right to object to direct marketing and the right to object to processing based on legitimate interests. If you object, we will stop processing your data for the lead database.
6. Your rights
Under UK GDPR you have the right to: access your data; correct inaccurate data; erase your data; restrict processing; data portability; object to processing based on legitimate interests; object to direct marketing at any time (absolute right); and withdraw consent where consent was the basis.
To exercise any right, email support (at) reachievable.com. We respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
Marketing emails from us always include an unsubscribe link. If you are a business contact in our lead lists, see Section 7 for the dedicated opt-out channel.
7. Opt out / deletion: for people in our lead lists
If you are a business contact appearing in our lead database and want your information suppressed or deleted:
- Email support (at) reachievable.com with your name and work email.
- On a verified request we will suppress or delete your record and add your details to our permanent do-not-contact list so the data is never collected or licensed again.
- We will also notify customers who have received your data so they can remove it from their own systems.
We aim to action verified requests within 30 days.
8. Cookies and tracking
- Strictly necessary cookies (sign-in sessions, security, remembering your cookie choice) do not require consent.
- Advertising cookies: Meta Pixel: we use Meta Platforms, Inc. (US) pixel technology for ad measurement. This fires only after you give opt-in consent via our cookie banner. Our banner offers equally prominent Accept and Reject options, does not use pre-ticked boxes, and you can withdraw consent at any time via the "Cookie settings" link in our footer.
- Withdrawing consent stops future tracking; it does not affect processing already carried out.
9. Sub-processors
We use service providers for authentication and database hosting, payment processing, website hosting, transactional email, and consent-gated advertising measurement. They process personal data only on our instructions and under data processing agreements. We will give at least 30 days' notice before engaging a new sub-processor; you may object on reasonable data-protection grounds.
10. Data retention
| Category | Retention |
|---|---|
| Customer account data | Duration of subscription plus 2 years |
| Billing/invoice records | As required by tax law (typically 6 years, UK) |
| Lead database records | Until verified stale, or until objection/opt-out |
| Suppression / do-not-contact lists | Indefinitely (necessary to honour opt-outs) |
| Website logs | 90 days |
When retention periods end, data is deleted or anonymised. Quebec residents: our retention schedule is documented and published as required by Law 25, and data is deleted automatically once its purpose is fulfilled.
11. Security
We use encryption in transit and at rest, access controls, and reputable infrastructure providers (Supabase, Vercel, Stripe). No system is perfectly secure; we will notify you and the relevant authority of any personal data breach as required by law.
12. Children
Our service is for business use. We do not knowingly collect data from anyone under 18.
13. California residents (CCPA/CPRA)
If you are a California resident, you have the right to know what personal information we hold about you, to request deletion and correction, and to opt out of the sale or sharing of your personal information. Licensing lead lists that include California business contacts may constitute a "sale" under the CCPA.
- To exercise these rights, email support (at) reachievable.com.
- Do Not Sell or Share My Personal Information: email support (at) reachievable.com with the subject "Do Not Sell or Share". We will action verified requests within 45 days.
- We do not discriminate against anyone for exercising these rights.
14. Canada
Our processing of Canadian residents' data follows PIPEDA's principles, including meaningful consent, limited collection, and a 30-day response time for access requests. Our designated privacy contact is support (at) reachievable.com. Data transferred outside Canada (e.g. to our US sub-processors) may be subject to foreign laws, including lawful-access requests by foreign authorities.
Quebec residents: the sole trader operating as Reachievable is the person in charge of personal information. We complete a privacy impact assessment before any transfer of personal information outside Quebec, and you hold rights of access, correction, deletion, and portability under Law 25.
15. Changes to this policy
We will post any changes here and update the effective date. Material changes will be notified by email or prominent website notice at least 30 days before taking effect.
16. Contact and complaints
- Privacy questions and requests: support (at) reachievable.com
- Lead-list opt-out: support (at) reachievable.com
- UK supervisory authority: the Information Commissioner's Office (ico.org.uk/make-a-complaint)