Privacy Policy

1. Introduction and General Terms

This Privacy Policy covers the processing of personal data by GoodFit Limited (“GoodFit”, “we”, “us” or “our” in this policy) when providing its services to its clients.

GoodFit is committed to protecting and respecting your privacy. This Privacy Policy explains the basis on which personal data we collect from you or from public sources will be processed by us. We will comply with all applicable data protection laws, including the General Data Protection Regulation.

GoodFit acts as a controller where we determine the purposes and means of processing personal data, including when we create and maintain our business contact database, operate our website, manage sales activities, and administer our business operations. GoodFit acts as a processor when we provide our platform to clients and process personal data solely on their behalf and in accordance with their instructions.

To ensure transparency, it is important to distinguish our roles regarding different types of data:

GoodFit as a Data Controller: We act as the Data Controller for our own internal operations and proprietary products. This includes the personal data we collect for our own HR, payroll, and recruitment needs, as well as the data we source and aggregate to maintain our proprietary business intelligence platform. We determine the purposes and means of processing this data and are fully responsible for its compliance.
GoodFit as a Data Processor: For any data provided directly by our clients (such as customer lists, CRM files, or documents uploaded to our platform), GoodFit acts strictly as a Data Processor. In this capacity, we do not own, control, or independently use this client-provided data for our own purposes. The client remains the sole Data Controller for that information. We process such data solely on the client’s behalf, in accordance with their instructions, and as governed by a separate Data Processing Agreement (DPA). Any data a client manages within our platform is entirely separate from GoodFit’s own business intelligence database.

GoodFit offers a business intelligence platform through which businesses (“users” or “you”) can obtain information to assist them in better marketing to potential customers and others who may be interested in their offering.

2. Information We Collect

We may collect and process the following categories of personal data below.

Website and Sales Interactions

Name
Business email address
Job title and company information
Phone number
Information provided in communications or demo requests
Technical data such as IP address, cookies, and usage information
Transcripts, audio, and video recordings from sales and support interactions

Platform Users (Client Accounts)

Name
Business email address
Account credentials (encrypted password)
Activity and usage data within the platform

Business Contact Database

Name
Job title and employment history
Company name
Location
Business email address
Professional contact details (including phone where available)
Professional social media information

Derived Intelligence

We use AI-driven processing to extract and summarize data from public sources. This data is transformed into proprietary, aggregated datasets for our intelligence platform

We use AI and Large Language Models to extract, classify, and summarize data from public sources. This data is transformed into proprietary aggregated data blocks for our platform

Where a business email address is not available, we may infer or generate a business email address based on commonly used company email formats.

Sources of Data

The majority of personal data is obtained from publicly available sources such as professional networking platforms, company websites, public records, and other lawful third-party data providers. We may also derive or infer business contact details, including generating business email addresses based on commonly used company formats. Where we identify professional contact details, we do so exclusively for the purpose of facilitating business-to-business professional communication. We do not process private, non-professional contact details for these purposes.

Where we obtain personal data indirectly, we provide individuals with this information within a reasonable period as required by applicable data protection law.

We utilize third-party data enrichment providers (such as Surfe.com) to identify and verify business contact information for target accounts.

We are committed to transparency regarding how our business intelligence database is built. We collect business contact information primarily from publicly available sources, such as professional networking profiles, corporate websites, industry directories, and other public records.

To ensure our clients have accurate and relevant information for professional business-to-business (B2B) communications, we perform “data enrichment.” This process involves using specialized verification tools to confirm or update professional contact details (such as business email addresses or business phone numbers) associated with professional profiles.

Our data enrichment process is guided by the following principles:

Purpose Limitation: We only collect and enrich this data to facilitate legitimate, professional business-to-business communication.
Professional Focus: We do not collect, process, or enrich private, non-professional contact information (e.g., personal home addresses or private personal emails).
Data Quality: Enrichment is performed to ensure the data provided to our clients remains accurate and up-to-date, minimizing the use of outdated or incorrect contact details.

We act as the Data Controller for this database. We ensure that this collection and enrichment process is proportionate, serves a legitimate business interest, and does not override the rights and freedoms of the individuals involved.

3. Grounds of Processing

We process personal data on the following legal bases:

Legitimate interests (Article 6(1)(f)) — including operating and improving our business intelligence services, maintaining and providing access to a business contact database, supporting B2B marketing activities of our clients, ensuring platform security, preventing fraud, and analysing business performance. We rely on legitimate interests where processing is proportionate and does not override individuals’ rights. Individuals have the right to object to this processing at any time.
Contract (Article 6(1)(b)) — where processing is necessary to provide services to our clients or manage contractual relationships.
Legal obligations (Article 6(1)(c)) — where we are required to comply with applicable law.

We may also carry out limited profiling and analytics activities to improve the relevance of our services and marketing activities. This does not involve automated decision-making producing legal or similarly significant effects.

4. Sharing Your Information

We may share personal data with:

Our clients, where this forms part of the services we provide
Service providers and processors supporting our business operations (such as hosting, analytics, CRM, communication, and infrastructure providers)
Professional advisers and auditors
Authorities or regulators where required by law

Where GoodFit processes data on behalf of clients, we do so under contractual data processing agreements. Where we act as a controller, we share data only where there is a lawful basis to do so.

We share data only where necessary with authorized service providers, including: CRM and sales outreach platforms, payroll and HR management systems, cloud infrastructure providers, and AI/LLM model providers.

5. Your Privacy Rights

Individuals have the following rights, subject to applicable law:

Right of access
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object to our processing of your data, as well as objection to direct marketing and profiling related to marketing
Right to withdraw consent where consent is relied upon

If you ask where your data originated, we will inform you that your business contact information was sourced from publicly available business data sources or licensed data aggregators used for market intelligence.

Requests can be made via privacy@goodfit.io.

You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO).

6. Data Retention

We will hold your personal data for as long as is necessary for the relevant purpose.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. For more information about specific retention periods, please contact us.

7. Children

The Service is not intended for use by children under the age of 18.

We do not knowingly solicit data from or market to children under the age of 18. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us at privacy@goodfit.io. We will delete such information from our files within a reasonable time.

8. Security

We implement appropriate technical and organisational measures to protect personal data, including:

Encryption of credentials and sensitive data
Access controls and role-based permissions
Secure cloud infrastructure
Monitoring and logging
Staff confidentiality obligations
Periodic security reviews and risk assessments

9. International Transfers

Personal data may be transferred to countries outside the UK or European Economic Area where our service providers operate.

Where such transfers occur, we implement appropriate safeguards, including:

Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA)
Adequacy decisions where available
Additional technical and organisational safeguards where appropriate

Where required, we carry out transfer risk assessments and implement supplementary technical and organisational measures to ensure personal data remains protected.

Copies of relevant safeguards can be requested via privacy@goodfit.io.

10. Changes

We will notify you of any changes to this Privacy Policy by email and/or notice on the website, as appropriate.

11. AI and Automated Processing

We utilize AI-driven tools to extract structured data from websites and to generate summary narratives. These models are used to assist in our internal research and classification processes. We do not use user-specific prompts to train our foundation models, and we employ domain allow/deny lists to prevent our AI tools from targeting websites with restrictive anti-scraping or anti-AI terms.

Our platform provides “Derived Data” aggregated information that has been materially transformed through our proprietary logic. This is distinct from “Raw Data: collected from third-party sources. We have implemented technical and organizational measures to ensure this transformation provides value beyond the original source material.

12. Contact us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at privacy@goodfit.io. You may also contact the UK ICO for any reason.