Fair Processing Policy – EEA, CH and UK and other Jurisdictions with similar requirements
Last updated: August 2026
Our policy for handling your personal data when it was not received from you directly.
DEMAND AI handles personal data in compliance with the General Data Protection Regulation (GDPR), the UK GDPR and national data protection legislation where applicable. We recognise the importance of correct and lawful processing of personal data in maintaining confidence in our operations and ensuring transparency for data subjects. We fully endorse and adhere to the principles set out in the GDPR.
The data controller for the purposes of this policy is Demand AI Limited, a company registered in Ireland under company number 780859, with its registered office at RBK House, Irishtown, Co. Westmeath. Where personal data is transferred to or processed by Demand AI Group Inc. (our US parent company), they are bound by contractual agreements obliging them to implement and have the same data protection standards.
- DEMAND AI's Processing of Personal Data
- Where does DEMAND AI get your Personal Data?
- What legal basis do we use to process your Personal Data?
- How does DEMAND AI obtain your consent?
- Retaining personal data
- Your rights under the GDPR
- Complaints about how we process your personal data
DEMAND AI's Processing of Personal Data
DEMAND AI only processes business contact data for individuals with the aim of sending them relevant direct marketing emails on behalf of our customers, where we believe those events, products or services may be of interest to the individuals in their professional capacity.
Where does DEMAND AI get your Personal Data?
DEMAND AI collects business contact data through two channels: (i) from verified third-party data providers, engaged under a Data Processing Agreement that includes contractual warranties as to the lawfulness of their original collection and sourcing practices; and (ii) from publicly available sources, including company websites, publicly available blogs, articles, honourable mentions, and publicly available staff directories, where permitted. The types of data we collect are limited to business card-type contact information, such as name, job title, employer, and business email address.
As we obtain your data from sources other than you directly, we provide this policy no later than the time of our first communication with you, in line with Article 14(3)(b) GDPR.
What legal basis do we use to process your Personal Data?
The table below sets out the legal bases DEMAND AI relies on for each type of processing activity:
| Processing Activity | Legal Basis |
|---|---|
| Collection of data from verified third-party data providers under a Data Processing Agreement | Legitimate Interest (Article 6(1)(f) GDPR or equivalent |
| Collection of data from publicly available sources | Legitimate Interest |
| Sending you direct marketing emails | Legitimate Interest |
| Tracking whether the direct marketing email was opened | Consent. Required across the EEA, UK and Switzerland under the ePrivacy Directive Art. 5(3) or its equivalent. |
| Tracking your interaction with content on the landing page | Consent (obtained via link-click in the email — see below) |
| Sharing your contact details with our customers for them to contact you directly about their events, products or services | Consent (obtained via opt-in on the landing page — see below). In some countries, a double opt-in is legally required. |
Where we rely on Legitimate Interest as our legal basis, we have carried out a Legitimate Interests Assessment (LIA) to balance our interests against your rights and freedoms. You have the right to object to processing carried out on this basis at any time going forward.
How does DEMAND AI obtain your consent?
Consent to track your interaction with landing page content
The direct marketing email we send you will clearly state that by clicking the link to the landing page, you are consenting to DEMAND AI tracking your interaction with the content on that page. If you do not wish to give this consent, please do not click the link.
Consent for your details to be shared with our customer
The landing page is hosted by or on behalf of our customer (the business whose products or services are being promoted). On arrival at that page, you will be presented with a clear and separate opt-in request asking whether you consent to your business contact details being shared with that customer so they can contact you directly. Your data will only be shared with the customer if you actively opt in and, where applicable, complete a double opt-in involving a second email asking for confirmation. You are under no obligation to opt in, and declining will not affect your ability to view the landing page content.
Ensuring your personal data is safe and accurate
DEMAND AI takes appropriate technical and organisational measures to ensure that personal data held on our systems is secure, and protected against unauthorised or unlawful processing, accidental loss, destruction, or damage.
Where you give us consent to pass your contact details to one of our customers and that customer is located outside the European Economic Area (EEA), Switzerland (CH), or the United Kingdom (UK) we will ensure that appropriate safeguards are in place before any transfer is made. Where the recipient customer is certified under the EU-U.S. Data Privacy Framework (DPF), UK Extension to the DPF, or Swiss-U.S. DPF (as applicable), we will rely on that certification as the transfer mechanism. For transfers to customers not covered by an applicable DPF certification, we will rely on other appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, Swiss Authority or the UK ICO, or an adequacy decision covering the destination country.
Where your personal data is also accessed or processed by Demand AI Group Inc. in the United States (our US parent company), acting as our processor, that transfer is separately covered by contractual obligations as required by law.
DEMAND AI only collects and records personal data that is necessary for our business purposes, and we take steps to ensure that the data we hold is accurate and kept up to date.
Retaining personal data
We retain personal data for as long as a legitimate business processing purpose exists and you have not objected to its processing.
We consider a record to remain active where either of the following conditions is met:
Interaction: you have interacted with at least one campaign within the preceding 24 months. Interaction includes opening an email, clicking a link, or visiting a landing page. Each interaction resets the 24-month period.
Data refresh: You have not objected to the processing of your personal data and your contact data has been re-verified or refreshed from publicly available sources within the preceding 24 months, confirming that the information remains current and accurate. Each refresh event constitutes a new collection and resets the 24-month period.
Where neither condition has been met for a continuous period of 24 months, your record will be reviewed and suppressed from further marketing activity or deleted.
We maintain two categories of suppressed record:
Inactive suppression: where a record is suppressed solely due to 24 months of inactivity with no explicit objection or erasure request having been made. These records contain only the minimum data necessary to prevent inadvertent re-collection (typically email address and an inactivity flag) and are retained for a maximum of seven (7) years from the date of suppression, after which they are deleted. If the individual's details are re-verified as current from publicly available sources, they may be treated as a new data subject and re-collected, subject to a fresh fair processing policy being issued.
Objection and erasure suppression: where an individual has explicitly objected to direct marketing under Article 21(2) of the GDPR or its equivalent or has submitted an erasure request. The right to object to direct marketing is absolute and does not expire. These records which will consist of the business email address and the date of objection are red-flagged and retained indefinitely to ensure they are never re-added to our database unless consent is received. No re-collection will take place in respect of these individuals regardless of the passage of time unless consent is given. These records are kept separately to our live database.
Change of employment and new contact details
An objection or erasure request is associated with the specific business contact details held at the time it was made. DEMAND AI's suppression matching operates on the basis of business email address. Where an individual moves to a new employer and acquires a genuinely different business email address and role, that new contact data does not appear on our suppression list and may be legitimately collected from publicly available sources and treated as a new data subject record, subject to a fresh fair processing policy being issued.
This is not a mechanism for circumventing a previous objection. Where DEMAND AI has actual knowledge that a newly collected record relates to an individual who has previously objected or requested erasure, that record will not be processed for direct marketing purposes and will be added to the suppression list.
Your rights under the GDPR
Under the GDPR (and its equivalent), you have the following rights in relation to your personal data:
| Right | Description |
|---|---|
| Right of access | You may request a copy of the personal data we hold about you. |
| Right to rectification | You may ask us to correct inaccurate or incomplete data. |
| Right to erasure ('right to be forgotten') | You may ask us to delete your personal data in certain circumstances. |
| Right to restriction of processing | You may ask us to restrict how we use your data while a complaint or query is being resolved. |
| Right to data portability | Where processing is based on your consent and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format. |
| Right to object | You have the right to object to processing based on Legitimate Interest at any time. You have an absolute right to object to your data being used for direct marketing purposes, including any profiling carried out for direct marketing purposes; on receipt of such an objection we will, without undue delay, cease processing from that time going forward. |
| Right to withdraw consent | Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. |
To exercise any of these rights, please email us at privacy@demandai.co and include your full name. If you hold more than one email address, please submit a separate request from each. We aim to resolve your request within one month of receipt. If additional time is required, we will notify you within that month.
For further information about our processing of personal data please refer to our full Privacy Policy.
Complaints about how we process your personal data
If you have a concern about how DEMAND AI processes your personal data, please contact us in the first instance at privacy@demandai.co
You may also contact our Data Protection Officer at dpo@demandai.co
You also have the right to lodge a complaint with the relevant supervisory authority.
Irish Data Protection Commission (DPC)
The DPC is the lead supervisory authority for DEMAND AI under the GDPR. You may contact the DPC by visiting their website:
https://www.dataprotection.ie/en
UK Information Commissioner's Office (ICO)
If you are based in the United Kingdom. You may contact the ICO by visiting their website:
You also have the right to lodge a complaint with the supervisory authority in your own country of residence or work, in addition to the DPC.