If your data is in a Searchbase customer's list

Last updated: 2026-09-29

Searchbase is a tool that businesses use to find other businesses and the professionals who work there. If you have received a message from one of our customers, or you think your professional details may appear in a list built with Searchbase, this page is for you. It is the information that Art. 14 GDPR requires when personal data is not collected from the person it concerns.

You do not need a Searchbase account to use any of the rights described here.

1. Who is responsible

The Searchbase service is operated by the controller named in §1 of our Privacy Policy. Contact for everything on this page: [email protected].

2. What data

Professional data only. Depending on the source, a record may contain:

  • Name, job title, seniority and function
  • Employer, and information about the employer (name, website, industry, size, location)
  • Work location (city, region, country)
  • A business email address, and whether it appears to be deliverable
  • A business phone number, where a customer asks for one
  • Links to public professional profiles, a profile photo and headline, skills and education as listed on those profiles

We do not look for special categories of data (Art. 9 GDPR) such as health, religion or political opinions.

3. Where it comes from

We do not obtain this data from you. It comes from these categories of sources:

  • Public business websites, such as company "team" or contact pages
  • Public professional and social profiles
  • Search engine results
  • Commercial providers of business contact data, who license professional directories to companies like ours
  • Email-verification services, which check whether an address accepts mail without sending anything to it

On request we will tell you which source a specific record about you came from, where we still hold that information.

4. Why we process it

Our customers use Searchbase to find businesses to sell to, partner with or hire from, and to contact the relevant people at those businesses. The legal basis is legitimate interest (Art. 6(1)(f) GDPR): our customers' interest in business-to-business prospecting, and ours in providing the tool for it.

How we balanced that interest against yours. We limit the data to your professional role, which is the reason a business would contact you at all, and we do not look for private-life information. The data comes from sources where it is already available in a professional context. A business contact in your professional capacity is something a professional can reasonably expect. Our Acceptable Use Policy forbids customers from processing personal data without a lawful basis and from sending spam. And you can object at any time, without giving a reason, and the objection applies to every Searchbase customer, not only the one who contacted you (§6).

5. How long we keep it

  • Searchbase's own copy. When a customer runs a search, the contact list we build is kept in a cache for 7 days from its last update, and a count of how many contacts it held for 30 days. The cache is never written to a backup.
  • Copies a customer saves. When a customer keeps results in its own workspace (for example in a chat, a table or a campaign), those copies stay until the customer deletes them or deletes its account.

These are the same periods stated in §6 of our Privacy Policy.

6. Your rights, and how to use them

You can ask us to:

  • Stop using your data for direct marketing (Art. 21(2)–(3)). This objection is unconditional: you do not have to give a reason, and we do not weigh it against anyone's interest.
  • Erase your data (Art. 17).
  • Tell you what we hold about you and where it came from (Art. 15).
  • Correct it (Art. 16) or restrict its use (Art. 18).

How. Use our contact form and choose "My personal data (I'm in a customer's list)", or write to [email protected]. Include the email address, and if you can the name and employer, that the data would be listed under, so we can find it. The form sends you a link to follow the conversation; replying from it confirms the address is yours.

What happens next. Our privacy team reads every request. Once we have confirmed it, we add your email address and, if you give it, your LinkedIn profile to a suppression list that applies to all our customers. From then on Searchbase no longer returns you in any customer's searches, no longer looks up your contact details, and no longer sends you messages from any campaign run through Searchbase.

To keep that promise we have to remember who asked, so the list stores only a one-way fingerprint (a SHA-256 hash) of the address or profile, never the address itself, and it survives the deletion of the rest of your data.

Copies a customer had already saved or exported before your request stay under that customer's control; you can exercise your rights with that customer directly.

We answer within one month of receiving the request, as Art. 12(3) GDPR requires, and we tell you what we found and what we did. It is free.

Complaints. You can also complain to a data protection authority, for example the one where you live or work. The contacts are in §14 of our Privacy Policy.