Privacy Notice

How TOLVEN handles personal data in business outreach · Last updated 25 August 2026

Who is responsible for your data

The data controller is Kristers Gabrāns, trading as TOLVEN, an individual established in Latvia. TOLVEN is a trading name, not a registered company.

You can contact us about anything on this page at [email protected]. We answer every message about personal data ourselves; there is no ticketing system to get past.

Where we got your details

This is the part most notices bury, so it is first. If you received an email from us and did not give us your address, we obtained it from one of the following publicly available business sources:

• Your company's own website, where a business contact address is published
• UK Companies House, for company details and the names of directors
• Your company's public professional or social profiles
• Public business directories and industry membership listings

We record the specific source and the date of collection for every contact, and we will tell you exactly where yours came from if you ask. We do not buy contact lists.

What we hold

• Your name and business role
• Your business email address, and sometimes a business phone number
• Your employer, its website and its public company information
• Publicly published information about your company relevant to our services, such as roles it is advertising
• A record of messages we sent you and any reply, so we do not contact you twice

We do not hold special category data, and we do not want any. Please do not send us any.

Why we process it, and on what basis

Purpose: to contact businesses that may want help winning clients, and to manage that correspondence.

Lawful basis: legitimate interests (UK GDPR Art. 6(1)(f)) — our interest in offering a relevant business service to the person at a company who would decide on it. We have carried out and documented a legitimate interests assessment, weighing that against your interests and rights. You can request a copy.

We contact you in your professional capacity, about your professional responsibilities. We do not use personal or private addresses for this.

Stopping it

You have an absolute right to object to direct marketing. There is no balancing test and we do not get to weigh it against anything. Reply stop to any email, or write to the address above, and we will stop.

When you object we add your address to a suppression list rather than deleting it. That is deliberate and it is how we make sure you are not contacted again by a later campaign. The suppression record holds only your address and the date, and nothing on it is ever used to market to you.

Your other rights

• Ask what we hold about you, and get a copy
• Have inaccurate details corrected
• Have your data erased
• Restrict how we use it, or object to the processing
• Receive your data in a portable format

We respond within one month. There is no charge. We do not make automated decisions that produce legal effects concerning you.

Who else sees it

• Instantly.ai — the platform that sends and receives our business email
• Google Workspace — our email accounts

These are processors acting on our instructions under written terms. Some are outside the UK/EEA, and those transfers rely on the relevant adequacy decision or on Standard Contractual Clauses. We do not sell or share your data for anyone else's marketing.

How long we keep it

• No reply after a sequence ends: deleted within 12 months of collection
• You asked us to stop: address and date kept indefinitely on the suppression list, so the objection is honoured permanently
• We are in conversation, or you become a client: kept for the relationship and then per our normal business records

Complaints

Tell us first and we will try to fix it. You can also complain to a supervisory authority: the Information Commissioner's Office in the UK, the Data Protection Commission in Ireland, or the Datu valsts inspekcija in Latvia, where we are established.