Notice for contacted companies

Version: 2026-5. Effective from: 2026-11-08.

This page is for people who do not use Trendizz, but whose company's data may be in our database, or who have received an e-mail from one of our clients or from us. We did not receive the data from you, so we inform you here under Article 14 GDPR.

If you received an e-mail and do not want any more

1. Reply to the sender that you do not want any more e-mails. The system then stops sending e-mails to you in the sender's campaigns; the sender is responsible for respecting your request.
2. Write to [email protected] if the reply did not help, if you have a question, or if you request the erasure of your personal data.

Both are free of charge.

Who processes the data

Trendizz.com Korlátolt Felelősségű Társaság, registered office: 2651 Rétság, Jászteleki út 12. 2.a., Hungary; company registration number: 12-09-012013; tax number: 27864966-2-12; for data protection matters: [email protected]. We have not appointed a data protection officer.

Trendizz is a business search system. We build a company database from public company websites. Our clients search it for potential business partners and contact them from their own e-mail address.

Where the data come from

• From the company's own publicly available website, together with the structured data published on the site.
• Where available, from the open data of the official state company register. From these we use only the data of business companies and other legal persons, not the names of executive officers.
• We take the addresses of the websites to be processed from public, free domain lists and from links found on other websites.

We do not use purchased address lists, social networks or commercial company databases.

What we store

Company data alone are not personal data. Personal data are what identify a person: an e-mail address containing a name, the name, a direct telephone number, and for a sole trader the data of the business as well. Such data may also be among the website's contact details and text. We still store the contact person data from earlier processing today, and we are deleting them gradually.

What we use them for, and on what legal basis

• Search and outreach: our clients look for companies for which their product or service may be useful, and contact them for a business purpose.
• Trendizz's own outreach: we also contact companies, with the same database and under the same rules.
• Processing and model development: we analyse the text of websites by automated means, with our own models and a language model, and we also use it to develop our own analysis models.

The legal basis is our legitimate interest and our clients' legitimate interest in business outreach between businesses, and for model development our legitimate interest in developing our service (Article 6(1)(f) GDPR). We have recorded the legitimate interests assessment in a separate document; we send it on request. For every company that one of our clients receives from our system, a company-specific legitimate interest record is also prepared: why this company, from which source, as of which date. The client can download the record and show it to you if you ask. We process the fingerprint of erased data to fulfil erasure requests lastingly (GDPR Article 6(1)(c)). We do not make decisions based solely on automated processing that have a legal effect on you.

To whom we disclose the data

• To our clients: we show them the company data and contact details within the system. We do not hand over or sell the database as a whole. A client may also add the contact details of a contacted company to its own records for its own contact management; there, the client is the controller. It can take them out as a file (CSV or Excel), or into its own system by machine (API, webhook), only in two cases: if the company replied with interest or they reached an agreement, the company's contact details and contact persons; if it sends the company a postal letter, the company name, the recipient's name and the postal address. The client can also download the legitimate interest record for that company; it may use it only to demonstrate its legitimate interest to you or to an authority. The record contains company data and the reasoning, not the value of any named contact detail.
• To our processors, on our instructions, under a data processing agreement:
  • Anthropic Ireland, Limited and OpenAI Ireland Ltd. (Ireland; language model: analysing the text of websites, company summaries, writing e-mails, classifying replies). They do not use the data to train their models, and keep them for at most 30 days.
  • Cloudflare, Inc. (serving our website and the system, for which it relays the traffic; storing the encrypted backups in a European data centre, the key is held only by us).
  • A proxy provider with its registered office in the European Union (the network route for downloading public websites; its identity is a trade secret).

The database is on our own servers in Hungary. At Anthropic and OpenAI the processing takes place partly in the United States, and Cloudflare is a US company. The transfer is based on an adequacy decision or on the European Commission's standard contractual clauses (SCC, Article 46 GDPR); you can request a copy of the safeguards at [email protected]. An authority may receive data on the basis of the law. For the geographic coordinates we send only the name of the town and the country to the public OpenStreetMap (Nominatim) service; this is not personal data.

How long we keep the data

• We keep the company data and contact details as long as the company's website is public, and we update them when the website is processed again.
• Of the website text, we keep only the most recently processed version.
• We keep the deliverability facts as long as they are needed to check deliverability (see below).
• We delete personal data on request (see below).
• We keep the fingerprint of erased data for the period described under erasure (see below).
• Deleted data disappear from the backups within 6 months at the latest; until then they can be used only for restoration.

If you received an e-mail from one of our clients

The e-mail was sent by our client, from its own address, in its own name. For the outreach and the related correspondence, the client is the controller; we operate the system on its behalf, as a processor.

The sender informs you about the outreach. If the sender has entered the address of its own privacy notice for its mailbox, the system adds that address to the end of the first e-mail sent to named addresses and to other e-mail addresses that qualify as personal data. This page informs you about the company database the contact details come from.

• If you reply to the sender that you do not want any more e-mails, the system recognises this and stops sending e-mails to you in the sender's campaigns. The exclusion belongs to the sender, and the sender is also responsible for the lawfulness of the outreach.
• If the reply did not help, or you have another request, write to [email protected]. We record your request as an exclusion in the sender's account and forward it to the sender.

We keep a record of the fact of the exclusion (the excluded address or domain and the time) on the sender's behalf, in the sender's account, so that the exclusion stays in place. As an independent controller, on the basis of legitimate interest, we record about an address whether it is deliverable, whether a reply came from it, the job title of the person who replied and the date of the observation, so that no e-mail goes to a wrong or closed address again. We do not take over the content of the e-mails. We keep this as long as it is needed to check deliverability.

If you received an e-mail from Trendizz

In that case we are the sender and the controller. You can stop the outreach with a reply. If no cooperation comes about, we delete the correspondence 12 months after the last e-mail.

Your rights

You can request that we tell you what data of yours we process and give you a copy; that we rectify inaccurate data; that we erase your personal data (see below); and that we restrict processing until a dispute is clarified.

Objection. You can object at any time to the processing of your data based on legitimate interest. An objection to outreach is always fulfilled by whoever contacted you: for Trendizz's own outreach by us, for outreach by one of our clients by the sending client (see above). We fulfil an objection to processing for direct marketing purposes unconditionally (Article 21(3) GDPR). For processing for other purposes (for example building the company database) we continue processing the data only if there are compelling legitimate grounds for it, or if it is needed to establish, exercise or defend legal claims (Article 21(1) GDPR). If you object with us to your contact details being given to our clients for outreach, we delete your personal contact details from the company database and do not take them up again; we do this in every case, without requiring a reason.

Erasure. Write to [email protected]. You can request erasure of your personal data: your name, your e-mail address and telephone number containing your name, and as a sole trader the data of your business as well. The company's data (company name, address, general contact details, activity) are not personal data, so we do not delete them on request.

What happens after your request: we delete the personal data of yours that we hold as controller, and if one of our clients is currently writing to you, we forward your request to them. So that the deleted data do not come back when the company's website is processed later, we keep a one-way fingerprint (SHA-256) of the deleted name (together with the company's domain), e-mail address and telephone number in an internal register, and we do not add matching data again. The register holds only the fingerprint, not the data itself; our clients cannot see it, and we use it for this purpose only (legal basis: lasting fulfilment of the erasure request, GDPR Article 6(1)(c), read with Article 17 and Article 5(2)). We keep the fingerprint for as long as we build our company database from public websites, because until then the data could come back.

Before answering, we may check your identity. We answer within one month at the latest; where justified, this can be extended by two months, and we will notify you of that. Fulfilling the request is free of charge.

Complaints

If you feel that we have infringed your rights, you can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH; 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; telephone: +36 1 391 1400; e-mail: [email protected]; naih.hu), or with the supervisory authority of another EU Member State where you habitually reside, where you work, or where the alleged infringement took place. You can also go to court.