Privacy policy

Who we are

Allreach OÜ (registry code 17470030, VAT EE103010308), Jõe tn 2a, Kesklinna linnaosa, Tallinn, Harju maakond 10151, Estonia, is the controller of the personal data described in this policy. If you have a question about anything on this page, write to ivan@allreach.co and it comes straight to us.

We are a B2B go-to-market company. Almost everyone whose data we hold is a business contact: someone who filled in a form here, booked a call, subscribed to our newsletter, or works at a client or prospect company. We do not knowingly process the data of consumers or of children.

We are not required to appoint a Data Protection Officer and have not appointed one. Privacy questions go to the address above.

Information we collect

We may collect and process the following personal information:

Identity and contact data: full name, work email address, phone number, company name, job title.

What you tell us in a form: your market, ideal customer, revenue band, timing, budget and similar answers you choose to give us so that we can prepare something useful for you.

Usage data: how you use our website, including IP address, browser and device information, the pages you view, and the campaign or referring site that brought you here.

Marketing and communication preferences: whether you have opted in to our newsletter, and any objection or unsubscribe request you have sent us.

We collect this data when you:

• Fill out a form on our website
• Book a call with us
• Subscribe to The Signal, our newsletter
• Interact with our website, including via cookies and analytics, where you have allowed them
• Engage with our campaigns, as a client or as a prospect

How we use your information

We use the information we collect for:

• Preparing and sending you the thing you asked for: a strategy, a sample sequence, a playbook, a scope or a quote
• Replying to you, and running the calls and correspondence that follow
• Providing, operating and maintaining our website and services
• Delivering our go-to-market services to clients
• Sending The Signal, our newsletter, if you have opted in
• Understanding how our website is used so that we can improve it
• Keeping our systems secure and preventing fraud and abuse

We do not sell or rent your personal information. We do not make decisions about you by automated means that produce legal effects or similarly significant effects.

Legal basis for processing

If you are in the EU, the EEA or the UK, we process your personal data under the lawful bases set out in Article 6 of the GDPR. Which basis applies depends on what we are doing:

• Steps taken at your request before entering a contract (Article 6(1)(b)). When you ask us for a strategy, a sample sequence, a playbook, a scope or a quote, we process your details to prepare it, send it, and have the conversation that follows. You do not need to consent to this. You asked us for it.
• Performance of a contract (Article 6(1)(b)). When we deliver services to you as a client.
• Legitimate interests (Article 6(1)(f)). Keeping a record of you in our CRM, following up with relevant business communications after you have approached us, identifying business visitors to our website, and protecting our systems. Our interest is in running and growing a business-to-business company. We have weighed that against your rights, and we contact business people only about services relevant to their role. You can object at any time and we will stop.
• Consent (Article 6(1)(a)). For The Signal, our newsletter, and for the analytics and visitor-identification tools described under Cookies below. You can withdraw consent whenever you like, and withdrawing it does not affect anything we did while it was in place.
• Legal obligation (Article 6(1)(c)). To meet our accounting, tax and other legal requirements.

If you would like to see the balancing assessment behind our legitimate interests, ask us at ivan@allreach.co and we will send it to you.

The Signal, our newsletter

The Signal is opt-in only. You join it by subscribing on our website or by ticking the box on a download form. We never add you automatically because you filled in a different form, downloaded something, or became a client.

Every issue carries an unsubscribe link and a link to your preferences, where you can choose which emails you want from us. If you leave, we act on it immediately and keep a suppression record so that we do not email you again by mistake.

Website visitor identification

We use third-party visitor identification services to help us understand who visits our website and to follow up with relevant business communications. Both of them load only if you have accepted them on the cookie banner, and neither runs if you have not:

RB2B (RB2B, Inc.) — identifies business visitors to our website, which may include name, business email address, job title, and LinkedIn profile. RB2B only identifies visitors located in the United States. Learn more in RB2B's privacy policy at rb2b.com.

Leadfeeder (Dealfront Group GmbH) — identifies the companies visiting our website based on IP address, along with pages viewed and visit duration. Leadfeeder identifies companies, not individual people. Learn more in Leadfeeder's privacy policy at leadfeeder.com.

Storing and reading the information these tools need on your device happens on the basis of your consent. Once we hold the resulting business-contact data, we process it under Article 6(1)(f), our legitimate interest in understanding and responding to commercial interest in our services. It is used solely for our own sales and marketing follow-up, and is never sold or rented.

If you would rather not be identified, decline on the cookie banner or reopen it at any time through Cookie settings. You can also opt out directly with each provider — both offer opt-out pages on their websites — use your browser's tracking-prevention settings, or write to us at ivan@allreach.co and we will exclude your data.

Cookies and tracking technologies

Some cookies are strictly necessary: they make the site work and remember the choice you make below. Those are always on, and there is nothing to consent to because the site cannot function without them.

Everything else waits for you. Nothing in the list below loads until you accept it on the banner shown on your first visit, and if you decline, none of it is ever requested:

• Microsoft Clarity (Microsoft Ireland Operations Limited) — analytics, heatmaps and session recordings showing how pages are used. Learn more in Microsoft's privacy statement.
• RB2B — visitor identification, described in the section above.
• Leadfeeder (Dealfront) — company-level visitor identification, described in the section above.

You can change your mind at any time using Cookie settings, which reopens the banner. Choosing "Only necessary" after having accepted will reload the page, because a script that has already started cannot be stopped any other way.

We do not currently run a CRM tracking cookie on this website. An earlier version of this policy said we did; that was wrong, and it is corrected here. If we add one, this section will say so before it goes live.

You can also manage cookies through your browser settings. Blocking non-essential cookies will not stop you using the site.

Who we share your data with

We use a small number of providers to run the business. Each of them processes your data on our instructions, under a written data processing agreement:

• HubSpot — our CRM, website forms, marketing email and meeting scheduling. Our HubSpot account is hosted in the European Union.
• Framer — website hosting, and the delivery of images and other assets on our pages.
• n8n — our own automation server, which passes website form submissions into our CRM and notifies us that you have been in touch.
• Google Workspace — our email.
• Slack — internal notifications when somebody contacts us.
• Microsoft Clarity — website analytics, only where you have accepted it.
• RB2B and Leadfeeder (Dealfront) — website visitor identification, only where you have accepted it.
• Fontshare (Indian Type Foundry) — serves the typeface used across this website. Your browser requests the font files directly, which means your IP address reaches them on every page.

We may also share data with our accountants and professional advisers, and with legal authorities where the law requires it. We require every third party to respect your privacy and to comply with data protection law. We do not share your data with anyone for their own marketing.

International data transfers

We are based in Estonia, and most of our processing happens inside the European Economic Area. Some of the providers listed above are established in the United States or transfer data there.

Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses, by the EU–US Data Privacy Framework where the provider is certified under it, or by another safeguard permitted under Chapter V of the GDPR.

You can ask us which safeguard applies to a particular transfer by writing to ivan@allreach.co.

How long we keep your data

We keep personal data only for as long as we need it:

• Enquiries, downloads and form submissions: up to 24 months from your last interaction with us, after which we delete or anonymise the record — unless you have become a client
• Newsletter subscribers: until you unsubscribe, plus a suppression record so that we do not contact you again by mistake
• Clients: for the length of the engagement, and then for as long as tax and accounting law requires us to keep the records

You can ask us to delete your data sooner at any time. See your rights, below.

How we protect your data

We take security seriously, though no method of transmission or storage online is completely secure. We use:

• Encryption in transit for data moving between you, our website and our systems
• Access controls, so that only people who need your data can reach it
• Regular security monitoring and updates
• Providers who are themselves held to recognised security standards

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted, the right to be forgotten
• Object to processing based on our legitimate interests — and if you object to direct marketing, we stop, without exception
• Ask us to restrict how we process your data
• Receive your data in a portable format
• Withdraw your consent at any time, where we rely on consent

To exercise any of these, write to ivan@allreach.co. We will respond within one month, and there is no charge.

Complaints

If you think we have handled your data badly, please tell us first — we would far rather hear it and fix it.

You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, www.aki.ee. If you are in another EEA country or in the UK, you may complain to your own supervisory authority instead.

Changes to this policy

We may update this Privacy Policy from time to time. Any change will be posted on this page with an updated effective date, and where a change is significant we will tell you by email.