Privacy Notice

1. The personal data we process

Qwirva is a B2B lead-verification engine. We process business-contact personal data — that is, professional contact details, not consumer/special-category data. The categories we hold are:

• Business identifiers: company / workspace name, business domain and website, country and region.
• Professional contact points: business email address, business phone number, WhatsApp business registration status.
• Role & firmographic signals: a contact's first / last name, job role or title, and public professional profile links (e.g. a LinkedIn page) where present.
• Verification & realness results: deliverability verdicts, domain / web-recon signals, and an LLM business-realness score derived from the above.

We do not seek or store special-category data, payment-card data, or location-tracking data about data subjects.

2. Where the data comes from (source)

Because we are an Article 14 controller (we usually do not collect data directly from the individual), here is the source of the personal data:

• Lists our customers upload for verification and the leads they discover through Qwirva.
• Publicly available business sources — company websites, public web presence, business directories, and public corporate registries (e.g. Companies House, GLEIF).
• The shared Qwirva lead corpus (see below), which is itself built from the two sources above.

3. The shared B2B lead corpus

Qwirva maintains a shared, deduplicated B2B lead corpus. When eligible business records are verified, discovered, scouted or enriched through the service, they are pooled into this corpus so that the next lookup is faster, cheaper and already graded. This pooling is a core part of how the service works and is enabled by default.

Pooling is guard-railed by eligibility, not by a per-user switch. A record is only pooled into the shared corpus when it is business-contact data on a recognised lawful basis and the subject has not been suppressed. Records collected on a consent basis, and records that have been suppressed (through erasure, objection or a complaint), are never pooled or re-purposed.

4. Why we process it & our lawful basis

We process business-contact personal data to provide the verification, discovery and corpus service — grading leads on deliverability and realness so that businesses contact organisations that actually exist.

• EU / UK: our lawful basis for processing business-contact data and for the shared corpus is legitimate interest (GDPR / UK GDPR Art 6(1)(f)) — the legitimate interest of providing and improving a B2B data-quality service, balanced against the limited, professional nature of the data. We have carried out a legitimate-interest assessment for this.
• GCC: for the Gulf region we take a more consent-leaning approach in line with local data-protection law; data collected on a consent basis is processed only for the purpose it was collected for and is excluded from the cross-tenant shared corpus.

Cross-border movement of records between regions (EU/UK and GCC) is gated separately and only happens where a lawful transfer mechanism is in place.

5. Your rights as a data subject

Wherever you are, you can exercise the following rights over your personal data, free of charge:

• Access — ask what data we hold about you and obtain a copy.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have your data deleted (the "right to be forgotten"); erased subjects are permanently suppressed from the corpus.
• Objection — object to our processing, including the legitimate-interest processing and the shared corpus; on objection your details are suppressed.
• Restriction — ask us to restrict processing while a request is resolved.

The fastest way to object or be erased is the public opt-out — no account required: /privacy/opt-out. You also have the right to lodge a complaint with your data-protection supervisory authority.

6. How we keep data minimal & safe

We store only business-card-grade fields, suppress on request and retain verification results only for as long as they are useful to the service. Suppressed records are not resurrected by a later re-discovery.

7. Contact

To exercise any right above, or for any privacy question, use the opt-out form or email [email protected]. You can also write to J. Servo LLC, the controller for Qwirva.