Privacy Notice
CRESELLE LTD processes personal data for its own founding-pilot acquisition and, where a business client has agreed a pilot, for research and individually authorised one-to-one emails introducing that named client. We do not use Apollo or any paid data-enrichment service, bought lists, Instantly outreach sequences, or behavioural email tracking. A person authorises each send. We do not guess email addresses.
1. Who we are (controller).
CRESELLE LTD, company number 17486195. Registered office: 35 Barnsley Road, Flockton, Wakefield, England, WF4 4DW. Private company limited by shares. Incorporated 28 September 2026. Status: Active. CRESELLE LTD is the controller of prospect research, selection, outreach, reply handling, qualification, booking and suppression for the activity in this notice. Where we introduce a named business client, we are not that client’s processor for the outreach. The client is a separate controller of its own sales activity and of the meeting details it receives. Privacy, rights, complaints and marketing objections: reuben@meetcreselle.com. Commercial email: reuben@withcreselle.com. If you send an opt-out to the commercial address, we still action it. Director: Reuben Harrison Tutin. No data-protection officer is appointed. creselle.com is the brand domain. meetcreselle.com is the operations and privacy domain. withcreselle.com is the commercial domain, used for hand-sent email and connected to Instantly for deliverability warm-up only.
2. What this notice covers.
This notice covers personal data about business contacts researched or contacted for Creselle’s own founding pilot, and business contacts researched or contacted so Creselle can introduce a named UK business client. It also covers people who enquire, reply, book, or become clients, people who object or complain, and people who visit creselle.com. Founding-pilot outreach is limited to named people at UK limited companies and limited liability partnerships. Sole traders, and ordinary partnerships in England, Wales and Northern Ireland, are out of scope. We do not use personal email addresses, mobile numbers, home addresses, or special-category data for this outreach. Still not used, and not covered as a live activity: Apollo or other paid enrichment, bought lists, Instantly sequences to prospects, and open or click tracking. If any of those were later authorised, this notice would be revised first.
3. Categories.
Identity and role: name, professional title. Work contact: a business email with a recorded public source, and the company. Company context: the limited company or LLP, and public commercial facts. Often not personal data until a person is named. Relevance note: a short sourced note on why the company and person fit. Not invented. Correspondence: email content, qualification notes, meeting outcome, after a reply or a booking. Preference and rights: an objection, an opt-out, a minimal suppression stub, a complaint record. Website technical data: IP address, browser type, pages and times, and error logs, processed by Cloudflare to deliver and secure the site. No analytics, no advertising, no cookies. We do not collect home address, date of birth, personal email, personal mobile, special-category data, or guessed addresses for this outreach.
4. Sources.
If we did not get your details from you, they came from publicly accessible professional or company sources, such as a company website, a public professional page, or Companies House for the organisation. The first email names the source category and, where reasonably possible, the page. We do not use Apollo, paid enrichment, or bought lists. Information you give us in a reply is a separate, direct source.
5. Purposes and lawful basis.
Legitimate interests (UK GDPR Article 6(1)(f)) is the basis we propose for identifying a named business contact, sending one introduction, handling the reply, qualifying it against the agreed pre-meeting standard, and sharing the minimum details with the named client once the person is qualified for introduction and has agreed to the meeting, so that meeting can be arranged. It is not automatic. Direct marketing is a statutory example of a purpose that may be a legitimate interest. It is lawful only if the three-part test is met and recorded. We do not rely on recognised legitimate interests (Article 6(1)(ea)). The interests are Creselle’s interest in providing a small, founder-supervised introduction service, and the named client’s interest in a meeting that meets a standard agreed in advance. The written assessment is the Track B legitimate-interests note of 5 October 2026. It passes only with the conditions in that note. We also rely on legitimate interests, and where relevant steps toward a contract, to handle enquiries. An objection to direct marketing requires us to stop using the data for that purpose. That stop is not itself a second marketing basis. Separately, we keep a minimal suppression stub so the objection continues to be honoured. The basis for that limited record is legitimate interests: it is necessary to avoid contacting you again, and it is not a marketing list. Rights requests and complaints are handled under a legal obligation where one applies. Website delivery is legitimate interests in running a secure site, and involves technical data only.
6. What the first email tells you.
If we did not get your details from you, the first email tells you who we are, why we wrote, that the details came from publicly accessible professional or company sources, that we may pass your name, role, company and work email to the named client only if you are qualified for introduction and have agreed to the meeting, so that meeting can be arranged. Sharing those details is not the same as a chargeable meeting. A chargeable qualifying held meeting still requires the agreed company, the agreed person, that you knew why it was arranged, and that you attend. The email also tells you how to object, and gives a link to this notice. That is how we meet the duty to inform you when the data did not come from you.
7. Recipients.
We do not sell personal data. If you are qualified for introduction against the agreed pre-meeting standard and have agreed to the meeting, we disclose your name, role, company and business email to the named client so that meeting can be arranged. That disclosure is not the charge point. We do not pass a research file. The client must not use those details for other marketing. Service providers, unchanged from v0.3 where still accurate: Google Workspace (email and documents; Cloud Data Processing Addendum accepted 28 September 2026); Airtable (operations and suppression record; Data Processing Addendum executed 28 September 2026; AI features not used); AI tools under human control for research and drafting, not permitted to authorise a send, decide eligibility, dismiss an objection, or override suppression; Instantly, limited to warm-up of reuben@withcreselle.com and one internal test on 29 September 2026, no prospect lists loaded; Cloudflare, for website delivery and security. Apollo is not used.
8. Transfers.
Google, Airtable and Cloudflare may process personal data outside the United Kingdom, including in the United States. Safeguards are those in the provider terms: Google’s Cloud Data Processing Addendum, accepted 28 September 2026, and Airtable’s Data Processing Addendum of the same date, incorporating the ICO international data transfer addendum and EU standard contractual clauses, Module 2. We do not claim a wider adequacy finding than those terms provide. Ask reuben@meetcreselle.com for more on the safeguards.
9. Retention.
For a client introduction, we keep the prospect record for the six-week pilot, then delete it, unless a meeting was booked and a short invoice record is still needed, or you have objected. After an objection we keep a minimal suppression stub — the address, the fact of the objection, and the date — so we do not contact you again. That stub is our control for honouring the stop. It is not a marketing list. Complaint records are kept for as long as needed to handle the complaint. Website logs are kept by Cloudflare under its terms for security.
10. Your rights.
You can ask for access, correction, erasure, restriction, and a copy of the relevant transfer safeguards. You can object to processing based on legitimate interests. You can complain to us at reuben@meetcreselle.com, and to the Information Commission. The right to object to direct marketing is absolute. If you object, we stop. Reply STOP, or email reuben@meetcreselle.com. We action an opt-out sent to reuben@withcreselle.com as well. We tell the named client if we have already shared your details. The objection overrides any later draft or instruction.
11. What we do not do.
We do not disguise who the email is from. It is from Reuben at Creselle. It may name the client we are introducing. It is not sent from the client’s domain. We do not run an automated sequence, and we do not use open or click tracking. We do not buy lists, guess addresses, or target sole traders or ordinary partnerships in England, Wales or Northern Ireland for this pilot.