How we source contact data

This is the notice required by Article 14 of the EU and UK General Data Protection Regulation — the article that applies where a company holds personal data it did not obtain from the person that data is about — and it covers the business contact data Richport Media Inc. collects for outreach.

What we hold, and why. We collect business contact details — name, role, employer, business email — from public company registers and from pages companies publish about themselves. They are used for one purpose: to ask whether an investor-awareness campaign for the company you work for is of interest. We do not sell, rent or license the data. It contains no consumer data and nothing in the Article 9 special categories. An objection stops contact, unconditionally. Instead of erasing a record, we keep a one-way record of the address so that the same address cannot be collected into our system again; that mechanism is set out below.

Last updated 12 August 2026. Richport Media Inc., 1225 Ave Ponce De Leon, PH 2020, San Juan, PR 00907, United States.

The controller

Article 14(1)(a) requires the identity of the controller and of its representatives.

  • ControllerRichport Media Inc., a Puerto Rico corporation. 1225 Ave Ponce De Leon, PH 2020, San Juan, PR 00907, United States. Richport Media Inc. determines what is collected, what is written, and who is emailed.
  • Contact[email protected]. Objections, access requests, corrections and complaints under this notice go to that address, and email is the only channel for them. Do not use the booking form on /contact for a records request: it is a scheduling tool with its own notice.
  • Representative in the European UnionA representative appointed under Article 27. Not yet designated. There is no EU representative to write to; write to [email protected].
  • Representative in the United KingdomThe same obligation applies under Article 27 of the UK GDPR. Not yet designated. The UK appointment is separate from the EU one. There is no UK representative to write to; write to [email protected].
  • Data Protection OfficerNone appointed. If one is appointed, this notice will name them.
  • Application of the GDPRRichport Media Inc. is established in the United States. We have taken the position that the GDPR applies to this processing.

Categories of data

Article 14(1)(d) requires the categories of personal data. These are the fields a contact record contains.

  • NameAs it appears on the register entry or the company page we read.
  • RoleDirector, officer or equivalent title, with the appointment date where the register carries one.
  • EmployerCompany name, registration number, jurisdiction and registered office — all of it public record.
  • Business email addressA work address, at the company’s domain. It is the only field on this list that does not come from a register; the provenance section sets out where it comes from.
  • Jurisdiction and entity typeWhich country’s register the company sits in, and whether it is a company or a sole trader. Together they determine whether we are permitted to email you at all; see the country section.
  • ProvenanceThree fields — the name of the source, the address of the page, and the date it was collected. They are being added. Records created after they go live carry them; records created earlier may not, and cannot be repaired retrospectively.
  • CorrespondenceIf you reply, your reply and our answer. If you object, the objection and its date.
  • What is not in itNo home address, no personal email account, no date of birth, no financial information, no identity documents, and nothing in the Article 9 special categories. Data is held in a professional capacity only.

Sources

Article 14(2)(f) requires the source, and whether it was publicly accessible. In December 2024 the CNIL fined Kaspr €240,000, in part for telling people their data came from “publicly accessible sources” while holding the granular provenance. Every source below is public and readable without payment or a login.

  • Public company registersThe statutory register of the jurisdiction a company is incorporated in. In the United Kingdom that is Companies House. Registers publish directors and officers by name, with role, appointment date and the company attached, because the law requires publication.
  • Pages the company published itselfTeam pages, leadership pages, contact pages and announcements a company put on the open web about its own people.
  • What a register never containsAn email address. No company register publishes one. A work address we hold was either printed on a page your company published or constructed from the pattern your colleagues’ published addresses follow. A constructed address can be wrong. Ask us which applies to your record; where the record predates the provenance fields, we will tell you that.
  • The rule the collection agent runs underThe agent runs logged out. It does not create accounts, does not authenticate, and does not accept a site’s terms of use in order to reach data behind them. Only what is readable to any member of the public is collected.
  • What we are notWe are not a data broker. There is no list product, no enrichment service and no resale, and we do not sell, rent or license this data to anyone. The data exists in our system only because we intend to email you ourselves, from our own domain, about our own service.

Objecting to direct marketing

Article 21(4) requires this right to be brought to your attention explicitly and presented clearly and separately from all other information.

How to object. Reply to any email from us and say stop, or write to [email protected]. You do not have to give a reason, prove who you are, create an account, log in, complete a form, or click through more than one page. Under Article 21(2) the right to object to direct marketing is absolute and unconditional, and nothing is balanced against it. We act on an objection when we see it, and in no case later than the ten business days that 15 U.S.C. 7704(a)(3) allows for an opt-out.

Objecting stops contact. It is not the same as asking us to erase the record; the difference is set out under suppression.

Suppression after an objection

An objection removes the contact record from the marketing database and leaves a suppression entry behind. Article 17(3)(b) is the basis for retaining that entry.

Deletion and re-collection. Your name is on a public register, and that register does not change because you wrote to us. If your record is erased in full, the record that you asked us to stop is erased with it, and the next collection cycle reads the same register entry and produces the same email.
What is kept instead. Your contact record comes out of the marketing database. A suppression entry remains — a list that is only ever added to, never edited and never emptied — checked before anything is written into the database, and again immediately before any message is sent.
  • A one-way hash of your addressYour email address, normalised and hashed. The address itself is not retained.
  • Your company’s domainKept separately, so a company can stop all contact at once rather than person by person.
  • The date, and what kind of stop it wasAn unsubscribe, an objection under Article 21, or a formal legal demand. Demands are flagged so that a re-send cannot be automated past them.
  • Nothing elseNo name, no role, no employer, no notes on why. The entry exists to recognise an address, not to describe a person.
  • The basis for keeping itArticle 17(3)(b). Your objection creates an obligation we have to be able to honour, and the suppression entry is the minimum we can hold in order to honour it. Article 21(2) requires us to cease processing for marketing, not to forget that you told us to.
Status on 12 August 2026. The suppression list is being built and is not running. Until it runs, an objection is actioned by removing you from the sending list and from the marketing database. That stops us sending. It does not stop a future collection cycle from reading the same register entry and finding you again.
Deleting the suppression entry. On request we will delete the suppression entry as well, once there is one. Nothing in our system will then record that you objected, your entry on the public register will be unchanged, and a future collection cycle can find you again.

Legitimate interests

Article 14(1)(c) requires the purpose and the legal basis. Article 14(2)(b) requires the specific interest, not the category. The basis is Article 6(1)(f), legitimate interests, and the interest is commercial.

  • The purposeOne purpose only: to contact companies that may want investor-awareness marketing, and to reach the people at those companies whose role covers that decision. These records are never uploaded to an advertising platform, never used to build an audience, and never combined with consumer data. What this website does in your browser is covered at /cookies.
  • The interestFinding clients for a small marketing firm. Recital 47 accepts direct marketing as a possible legitimate interest, and in C-621/22 (4 October 2024) the Court of Justice confirmed that a purely commercial interest can qualify.
  • NecessityWe cannot ask a company whether it wants a campaign without holding a way to reach the officer who would decide. The register entry does not carry one.
  • The balance, against usYou did not ask to hear from us, you had no expectation of it, and you were not told at the moment of collection.
  • The balance, for usThe data is business contact data about your professional role, published by a statutory register or by your own employer. The message concerns your company’s business rather than your private life. The volume is one firm’s own outreach, not a data product sold onward. Contact stops on a one-word reply.
  • Where the balance endsIf you object to direct marketing, it ends in your favour immediately, by operation of Article 21(2), with no test applied at all.

The written assessment behind this — purpose, necessity, balance, signed and dated — does not exist. What is set out above is reasoning, not a completed record.

Automated enrichment

Enrichment runs through Anthropic, in the United States. Article 14(1)(e) requires recipients to be named rather than described.

  • What it receivesThe public text already collected — the register entry, the company page. No other data is sent.
  • What it is asked forStructure and summary: normalising a company name, establishing what the business does, and judging whether investor-awareness marketing is plausibly relevant to it. The output goes back into the same record.
  • What follows from itWhether the company is contacted. That is the only consequence. No score is shared with anyone, nothing is sold, and there is no outcome for you beyond an email.
  • Article 14(2)(g)This is the sub-paragraph on automated decision-making and profiling. No determination under it has been published; what is set out here is the mechanism as it runs.
  • The paperworkThe Article 28 processor agreement covering this leg, and the transfer clauses that ride with it, are not signed.

Countries we contact

Article 13(1) of the ePrivacy Directive made prior consent the rule for individual subscribers everywhere. Article 13(5) let each Member State decide how far to extend that to companies, and they decided differently. The Regulation intended to harmonise it was withdrawn by the Commission on 11 February 2025, so the divergence is permanent.

  • Prior-consent markets — excludedGermany (UWG §7 Abs 2 Nr 2), Austria, the Netherlands, Poland (PKE Art 398), Denmark (Markedsføringsloven §10), Belgium, Spain (LSSI Art 21.1), Italy (Art 130 Codice Privacy) and Switzerland (UWG Art 3 Abs 1 lit. o). In those markets no footer, no disclosure and no wording makes an unsolicited commercial email lawful. We do not build lists there; an approach has to come from the company.
  • Opt-out markets — and only to companiesThe United Kingdom, France, Ireland, Sweden and the United States. The exemption those countries give is for corporate subscribers — a limited company, an LLP, a PLC. A sole trader or an ordinary partnership is an individual subscriber under PECR regulation 22 in the UK and under Marknadsföringslagen 19 § in Sweden, and needs consent. In Ireland unsolicited marketing to an individual subscriber is a criminal offence rather than a fine. Entity type is taken from the register entry and never inferred from an email domain.
  • CanadaExcluded. Under CASL section 13 the burden of proving consent falls on the sender, and we do not keep the per-record proof that would discharge it.
  • Who we are, everywhereConcealing the sender’s identity is prohibited regardless of consent — PECR regulation 23 in the UK, UWG §7 Abs 2 Nr 3 in Germany, Article 13(4) of the ePrivacy Directive across the Union. We send as Richport Media Inc., from a domain that resolves to us, to a reply-to address that a person reads.
  • What every message has to carryThe elements 15 U.S.C. 7704(a)(5) requires: that the message is a solicitation, how to decline further messages, and our postal address — 1225 Ave Ponce De Leon, PH 2020, San Juan, PR 00907. The address is required whether or not the recipient asked to hear from us. In France, the CNIL’s business-to-business route additionally requires the source to be named in the message itself. 16 CFR 316.5 forbids a fee, a login, a required reason, or a process longer than one page in order to decline.

These rules are applied when a list is assembled. The automatic country check inside the sending job — the one that blocks a send outright when the country field is empty rather than guessing — is not built. It is listed under what is not built yet.

Retention

Article 14(2)(a) allows a period or the criteria that set one. Both are below.

  • Contact recordsThree years from your last contact with us — a reply, a call, a booking. The benchmark is the CNIL’s Délibération 2021-131, under which opening an email is not a contact from you. Silence runs the clock down; it never resets it.
  • After an objectionThe contact record comes out of the marketing database at that point, wherever the three years stood.
  • The suppression entryKept indefinitely, once the list exists. It is what prevents the same details being collected again from the same public source, so no retention limit is applied to it.
  • CorrespondenceReplies and our answers stay in the mailbox they were sent to, which is Proton, in Switzerland. There is no schedule that clears that mailbox.

The three-year period is applied by hand. It is not a scheduled job, and the scheduler is listed under what is not built yet. On request we apply the period to a record on the day we read the request.

Recipients and transfers

Article 14(1)(e) requires the recipients. Article 14(1)(f) requires the fact of transfer to a third country and the safeguard relied on. This is the complete list for the outreach pipeline; the website and the scheduler are separate systems with separate processors, set out at /cookies and /booking-privacy.

  • The databaseA self-hosted Twenty CRM running on hardware we own in Puerto Rico. Puerto Rico is a United States territory, so for data-protection purposes this is a United States location. It is not in a third-party cloud, and it is not in the European Union.
  • Anthropic, PBC — United StatesThe enrichment step described above, as our processor. The contract that makes that formal is not concluded.
  • Proton AG — SwitzerlandMail for our domain is delivered to Proton, and our outbound mail is relayed through it. Anything we write to you and anything you write back is transmitted and stored there. The European Commission recognises Switzerland as providing an adequate level of protection, so that leg needs no separate transfer mechanism.
  • Cloudflare, Inc. — United StatesRuns DNS for richportmedia.ai and receives the DMARC aggregate reports that mail providers generate about messages claiming to come from our domain. Those reports carry sending IP addresses and message counts. They do not carry your address, and they do not carry anything you wrote.
  • Nobody elseNo advertising platform, no list broker, no lead marketplace, no affiliate, and no resale of any kind.
  • The United States legsWe are not certified under the EU–US Data Privacy Framework and do not intend to self-certify. Our systems are in the United States from the moment a record is created — a United States company collecting into United States hardware. Where a record reaches a processor, the safeguard is the Article 28 contract with that processor and the transfer clauses that ride with it. Contracts not yet signed are listed under what is not built yet.

Your rights

Article 14(2)(c) requires the rights under Articles 15 to 21 to be listed.

  • Access — Article 15A copy of everything we hold about you. Article 15(1)(g) also entitles you to the source. Where we cannot give the exact source for your record, you will be told that.
  • Rectification — Article 16If the role, the employer or the address is wrong, tell us and we correct it.
  • Erasure — Article 17We delete the record. Where the objective is to stop hearing from us, objecting is the stronger request; see the suppression section.
  • Restriction — Article 18We keep the record but stop using it while something about it is contested.
  • Objection to direct marketing — Article 21(2)Absolute and unconditional. Set out on its own above.
  • Objection generally — Article 21(1)A separate right to object to processing based on legitimate interests, on grounds relating to your situation. That objection is weighed against whether we have compelling legitimate grounds, and for a marketing database we will rarely have them.
  • Portability — Article 20Does not apply here. Article 20(1) covers data you provided under consent or a contract, processed by automated means. You provided us nothing and there is no contract, so there is nothing to port.
  • Notification to others — Article 19If we correct, erase or restrict a record, we tell anyone we passed it to, and we tell you who they were if you ask. The only parties a record reaches are the processors named above.
  • Complaint — Article 77You can complain to the supervisory authority where you live or work — the ICO in the United Kingdom, your national authority in the EU — without coming to us first.
  • How to use any of themEmail [email protected], ideally from the address we contacted, or tell us which address to look for. There is no fee (Article 12(5)) and the deadline we work to is the statutory one — a month from receipt, under Article 12(3).

What is not built yet

Some of what is described above is enforced by code and some is enforced by a person following the rule. Puerto Rico’s Act 39-2012 makes publishing a privacy policy that does not correspond to actual practice an offence in its own right. The position on 12 August 2026 is as follows.

  • The suppression listBeing built, and first in the queue. Until it runs, an objection stops us sending but does not stop a future collection cycle from re-finding a public register entry.
  • Provenance fieldsSource name, source address and collection date are being added to every record. Records created before they go live may not carry them and cannot be repaired retrospectively.
  • The country check in the sending jobThe market rules are applied when a list is assembled. The automatic block inside the send job, including the rule that an empty country field blocks rather than defaults to sending, does not exist.
  • The outreach templateOne template produces every message we send. The elements listed under what every message has to carry, the link to this notice, and the machine-readable unsubscribe headers are not yet consolidated into it.
  • The three-year clockNot a scheduled job. On request we apply it to a record on the day we read the request.
  • The written balancing assessmentThere is no signed, dated document behind the reasoning on this page.
  • The processor contract with AnthropicNot concluded. The Article 28 agreement and the transfer clauses that ride with it are unsigned.
  • A published security descriptionThere is none. There is no documented security assessment of the machine holding the CRM. The systems are ours and self-hosted rather than spread across third-party platforms. When an assessment exists, it goes on /privacy.
  • The Article 27 representativesDesignation is in progress in both the EU and the UK. Neither is designated, so there is no representative in either jurisdiction; write to [email protected].

Related notices

Article 14(3)(a) sets an outside limit of one month from the day the data was collected for giving this notice, and Article 14(3)(b) brings that forward to our first message to you where that comes sooner. The link in that message is how the notice is given. If a message from us arrives without one, report it to [email protected].

  • PrivacyEverything else we do with personal data, including the parts that have nothing to do with outreach.
  • CookiesWhat this website places in your browser, who receives it, and the consent choice that governs it, including what this page sends to Google while you read it. Different system, different processors, different rules.
  • Booking privacyThe Article 13 notice for the scheduler on /contact. Details typed into that form are given to us directly, which is a different article and a different notice.
  • DisclosuresWhat we are paid, by whom, and how paid articles are labelled.
  • TermsThe terms that govern this site.