Privacy Policy
Effective date: 28 October 2026 Last updated: 28 October 2026
This policy explains how Polecat collects and uses personal information when you visit polecat.com, contact us, download our publications, attend our events, or receive our communications. It also covers business contact information we collect for prospecting. It is written in plain English. If anything is unclear, contact us (section 2).
This policy covers our website, marketing and business-development activities. When we provide our platforms (for example PolecatX, Polecat Hub at hub.polecat.com, or our API and MCP services) to a customer under contract, the customer's agreement with us, and any data processing agreement, govern that processing.
1. Who we are
Polecat Limited ("Polecat", "we", "us", "our") is the controller of the personal information described in this policy. "Polecat" is a trading name of Polecat Limited.
- Registered in England and Wales, company number 06058441
- Registered office: Newminster House, 27-29 Baldwin Street, Bristol, BS1 1LT, United Kingdom
- ICO registration number: Z1227157
Our offices: London (71 Central Street, London, EC1V 8AB, United Kingdom); Bristol (registered office, above); California, USA.
Group company: Polecat Intelligence Limited, registered in Ireland (company number 467888), registered office Fitzwilliam Business Centre, 26 Upper Pembroke Street, Dublin 2, D02 W296, Ireland. It owns the Polecat™ trade mark, and acts as our representative in the EU (section 2).
2. How to contact us about privacy
We have not appointed a formal Data Protection Officer. Our privacy lead handles all privacy questions and requests.
- Email: info@polecat.com (please put "Privacy" in the subject line)
- Post: Privacy Lead, Polecat Limited, Newminster House, 27-29 Baldwin Street, Bristol, BS1 1LT, United Kingdom
EU representative (Article 27 GDPR). If you are in the EU or EEA, you can also contact our EU representative: Polecat Intelligence Limited, Fitzwilliam Business Centre, 26 Upper Pembroke Street, Dublin 2, D02 W296, Ireland. Email: info@polecat.com.
3. The personal information we collect
Information you give us
| Category | Examples | When |
|---|---|---|
| Contact and identity details | Name, work email address, company, job title or role | Contact form, demo or white-paper requests, emails, event registration |
| Enquiry details | Area of interest (e.g. "Risk & compliance"), message content | Contact form, email, calls |
| Marketing preferences | Whether you opted in to insights and events, unsubscribe requests | White-paper form, emails |
| Event details | Registration and attendance, meeting notes, and any dietary or accessibility needs you tell us | Events, webinars, meetings |
| Job applicant information | CV and application details | If you apply for a role (through a recruitment platform) |
Information collected automatically
| Category | Examples | How |
|---|---|---|
| Website usage | Pages viewed, referring page, browser and device type, language, approximate location (country), page performance | Our analytics (PostHog). Before you consent, we measure without cookies and without storing your IP address. After you accept analytics cookies, we use a persistent identifier |
| Advertising and conversion data | That your browser visited our site, actions taken, LinkedIn cookie identifiers | LinkedIn Insight Tag, only if you accept marketing cookies |
| Technical and security data | IP address, request logs, bot-detection signals | Our hosting and security providers, when your browser connects |
Information from other sources (B2B prospecting)
We look for people whose roles make Polecat relevant to them, for example in risk, compliance, communications, strategy or finance teams.
| Source | What |
|---|---|
| LinkedIn, including LinkedIn Sales Navigator | Name, job title, employer, professional profile information |
| 11x (an AI-assisted sales platform) | Business contact details (e.g. work email), job title, and company information compiled from public and commercial business sources |
| Public sources (company websites, press, public filings) | Name, role, business contact details |
If we obtained your details this way, we will give you the information in this policy, and the source of your data, no later than our first communication with you (and in any case within one month). You can object at any time to our using your details for prospecting or marketing. We will stop and keep only a suppression record, so we don't contact you again.
We do not intentionally collect special category data (such as health or political opinions) for marketing. Please don't include it in messages. If you tell us about dietary or accessibility needs for an event, we use that information only to make arrangements for you.
4. How we use your information, and our lawful basis
| Purpose | Data used | Lawful basis (UK GDPR / EU GDPR) |
|---|---|---|
| Responding to your enquiry or demo request | Contact and enquiry details | Legitimate interests (responding to business enquiries). Where relevant, steps prior to entering a contract |
| Sending you a white paper you requested | Work email, the content requested | Legitimate interests (providing the content you asked for) |
| Sending insights and event invitations after you tick the box on our white-paper form | Contact details, preferences | Consent, which you can withdraw at any time |
| B2B prospecting and marketing to business contacts (including outreach based on LinkedIn Sales Navigator and 11x data) | Contact details, role, company, interaction data | Legitimate interests (promoting our services to relevant professionals), in line with PECR and Irish e-privacy rules (section 10). Consent where those rules require it |
| Running events and webinars | Registration details, attendance, any dietary or accessibility needs | Legitimate interests. Explicit consent for any health-related details |
| Cookieless website measurement (before you make a cookie choice) | Aggregated usage data, no cookies, IP address not stored | Legitimate interests (understanding and improving our website) |
| Analytics cookies (after you accept) | Usage data, PostHog cookie identifier | Consent |
| Advertising and retargeting on LinkedIn, and measuring campaign conversions | LinkedIn Insight Tag data | Consent |
| Producing content, analysis and drafting correspondence with AI tools | Business contact and company information where relevant | Legitimate interests (operating efficiently), with the safeguards described in section 5 |
| Keeping the site secure, preventing spam and bots | Technical and security data | Legitimate interests (security) |
| Managing customer and supplier relationships, and customer support | Contact details, correspondence, support chats | Contract (if you are the contracting party), or legitimate interests (if you work for a customer or supplier) |
| Recruitment | Applicant information | Steps prior to entering a contract; legitimate interests |
| Legal obligations, and establishing or defending legal claims | Any relevant data | Legal obligation; legitimate interests |
| Business reorganisation or sale | Any relevant data | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details, and you can object at any time (section 9).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI tools help us draft and analyse; people make the decisions.
5. Who we share your information with
We do not sell your personal information. We share it only as follows:
| Recipient | Purpose | Role |
|---|---|---|
| Lovable | Website hosting and build platform | Processor |
| Cloudflare | Content delivery, security and bot protection | Processor |
| Supabase (EMEA region) | Database that stores contact-form and white-paper submissions | Processor |
| PostHog | Website analytics | Processor |
| Wix (static.wixstatic.com) | Hosting some images shown on our website | Processor (it receives your IP address and browser information when it loads images) |
| Salesforce and HubSpot | CRM, contact management and marketing email | Processors |
| Intercom | Customer communication and support | Processor |
| LinkedIn (including Sales Navigator and the LinkedIn Insight Tag) | Prospecting; advertising, retargeting and conversion measurement (Insight Tag only with your consent) | LinkedIn acts as a joint or independent controller for Insight Tag data. See LinkedIn's privacy policy |
| 11x | AI-assisted prospecting and outreach | Processor |
| AI assistants and LLM-based tools (e.g. Anthropic Claude) | Producing content and analysis, and drafting correspondence. These tools may process business contact or company information | Processors. Used under business terms that do not allow our data to be used to train their models, and with access limited to what is needed |
| A recruitment platform | Managing job applications | Processor |
| Event venues and platforms | Running events and webinars | Processors or independent controllers |
| Group companies (Polecat Intelligence Limited) | Running our business and acting as EU representative | Group company |
| Professional advisers | Legal, accounting, audit and insurance | Under a duty of confidentiality |
| Authorities and law enforcement | Where required by law, or to protect rights and safety | Independent controllers |
| Purchasers or investors | If our business, or part of it, is sold or restructured | Subject to confidentiality |
Our processors may use your data only on our instructions and under written contracts that meet Article 28 GDPR.
6. International transfers
We are based in the UK. Some of our providers (for example Salesforce, HubSpot, Intercom, LinkedIn, 11x, PostHog and AI tool providers) process data in the United States or other countries. When personal data leaves the UK or the EEA, we protect it with:
- Adequacy: transfers between the UK and the EEA rely on the UK's adequacy regulations and the European Commission's UK adequacy decision.
- The UK–US data bridge and the EU–US Data Privacy Framework: for US recipients certified under the DPF (and its UK Extension).
- Standard contractual clauses: the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU SCCs, for UK data; the EU Standard Contractual Clauses for EEA data. Both are supported by transfer risk assessments.
Our Supabase database is hosted in the EMEA region. Contact us for more information about the safeguards for any transfer.
7. Cookies and similar technologies
We use strictly necessary cookies to run and secure the site. Before you choose, we measure visits without cookies. With your consent, we use analytics cookies (PostHog) and marketing cookies (LinkedIn Insight Tag, for advertising and retargeting). You can accept, reject, or choose by category in our cookie banner, and change your mind at any time with the Cookie settings link in the footer. Our Cookie Policy gives full details.
8. How long we keep your information
| Data | Retention |
|---|---|
| Enquiries that don't lead to a relationship | 24 months from our last contact |
| White-paper requests, marketing and prospecting contacts | Until you unsubscribe or object, or 24 months without engagement. We keep a minimal suppression record so we don't contact you again |
| Customer and supplier contacts | For the relationship, plus 6 years |
| Event registration data | 24 months after the event. Dietary and accessibility details are deleted after the event |
| Website analytics data | For as long as needed for aggregated reporting, and no longer than 26 months |
| Security logs | Up to 90 days |
| Unsuccessful job applications | 6 months after the role closes |
When retention ends, we delete or anonymise the data.
9. Your rights
Under UK GDPR and EU GDPR, you have the right to:
- access a copy of your personal data;
- rectify inaccurate or incomplete data;
- erase your data, in certain circumstances;
- restrict our use of your data, in certain circumstances;
- object to processing based on legitimate interests, and at any time to direct marketing and prospecting (this right is absolute);
- data portability, where processing is based on consent or contract and is automated;
- withdraw consent at any time (for example, untick your marketing preference or change your cookie settings). This does not affect processing before you withdrew.
How to exercise them: email info@polecat.com (subject "Privacy"), or write to our privacy lead at the address in section 2. We may need to verify your identity. We will respond within one month; this can be extended by up to two months for complex requests. There is usually no fee. Every marketing email includes an unsubscribe link.
10. Business-to-business marketing
We market our services to people in their professional capacity.
- UK (PECR): we may email corporate subscribers (for example name@company.com) without prior consent. We always identify ourselves and include a simple opt-out. For individual subscribers (including sole traders and some partnerships), we email only with consent or under the "soft opt-in".
- Ireland and the EU: we follow the local e-privacy rules (in Ireland, S.I. No. 336 of 2011) and ask for consent where those rules require it.
- United States: we comply with the CAN-SPAM Act. Every email includes our postal address and an opt-out.
- Calls: we screen against the UK Corporate Telephone Preference Service (CTPS) and TPS where required.
- White papers: we'll send the white paper you request whether or not you tick the optional box. We send insights and event invitations only if you tick the box "Send me Polecat insights and event invitations", which is unticked by default.
11. Security
We use appropriate technical and organisational measures to protect personal data. These include encryption in transit (HTTPS with HSTS), access controls, supplier due diligence and contracts. No internet transmission is completely secure. If a breach is likely to result in a high risk to your rights, we will tell you without undue delay, as the law requires.
12. Links to other websites
Our site links to other sites, such as LinkedIn and the Polecat Hub sign-in. They have their own privacy policies, and we are not responsible for them.
13. Children
Our website and services are for business users. They are not aimed at children under 18, and we do not knowingly collect children's data. If you think a child has given us information, contact us and we'll delete it.
14. Complaints
If you have a concern, please contact us first. We'll try to resolve it. You also have the right to complain to a supervisory authority:
- UK: Information Commissioner's Office (ICO). Website: ico.org.uk. Telephone: 0303 123 1113.
- Ireland: Data Protection Commission (DPC), 21 Fitzwilliam Square South, Dublin 2, D02 RD28. Website: dataprotection.ie.
- Other EEA countries: your local data protection authority.
15. Changes to this policy
We may update this policy from time to time. We'll post the new version here with a new "Last updated" date. Where changes are significant, we'll tell you by a notice on the website or by email.
Polecat is a trading name of Polecat Limited, registered in England and Wales, company number 06058441. Registered office: Newminster House, 27-29 Baldwin Street, Bristol, BS1 1LT. ICO registration Z1227157.