Privacy Notice

Grey acts as controller for account administration, service operations, security, billing administration, support, marketing, and the professional-intelligence data that Grey independently collects or derives. When a Customer directs Grey to process personal data through the Service, the Customer is the controller and Grey acts as its processor. That processing is governed by the Customer's agreement and, where executed, Grey's Data Processing Agreement. Customer administrators also control access to their workspace and may process user information within it.

Account and contact data includes names, work email addresses, telephone numbers, employer, job title, role, organisation membership, account settings, and authentication identifiers. Service and Customer interaction data includes content and instructions submitted through the Service, support messages, feedback, privacy requests, and communications with Grey. Integration data includes the selected provider and connected-account identifiers, OAuth connection credentials, CRM user identifiers and mappings, configured field mappings, company and contact record identifiers and content, synchronisation status, and provider webhook or app-extension events. The exact data depends on the integration features and fields configured by the Customer. Professional-intelligence data includes names, professional contact details, current and previous employers, roles, company affiliations, professional profiles, public appointments, ownership or representative roles, source references, and business-related information. It may also include email addresses and telephone numbers published as company contacts before Grey can determine whether they identify a particular person. Grey applies the same access, correction, restriction, deletion, retention, and suppression controls to those values. Grey may also derive professional and business insights from those sources. Technical and usage data includes IP address, device and browser information, persistent pseudonymous analytics identifiers, page and referring URLs, approximate location, session and authentication events, feature and integration activity, timestamps, diagnostic data, security events, and audit records. For optional website and product analytics, page URLs can include query parameters that reflect navigation or filter state. For signed-in product analytics, Grey may associate limited events with the user's immutable Grey user ID, name, work email address, organisation ID, and role. Billing data includes billing contacts, business and tax details, subscription information, invoices, payment status, and transaction references. Marketing data includes business contact details, company, role, communication history, marketing preferences, and suppression status. Grey does not intentionally collect special-category data, criminal-offence data, national identity numbers, or information about children for these purposes. Customers must not submit such data unless Grey expressly agrees appropriate safeguards in writing.

Grey receives personal data directly from people who create an account, use the Service, communicate with us, submit a privacy request, or interact with our website, product, and marketing. Grey also obtains professional and business information from official Norwegian business and shareholder registers, publicly available professional and company sources, third-party data providers, Customers and their authorised users, customer-selected integrations, identity and billing providers, and other people who communicate with Grey. Publicly available company sources include public company directories. Public availability is a source description, not Grey's legal basis. Grey derives additional information from those sources and from use of the Service.

We process account, authentication, workspace, and service data to provide and administer Grey, manage authorised users, fulfil subscriptions, and communicate about the Service. The legal basis is performance of a contract where the individual is party to it and Grey's legitimate interests in providing the Service to business Customers in other cases. We process technical, usage, security, and audit data to authenticate users, protect Grey and its Customers, prevent fraud and abuse, enforce service limits, diagnose faults, maintain reliability, and establish or defend legal claims. The legal basis is Grey's and its Customers' legitimate interests in a secure and reliable business service and, where applicable, compliance with legal obligations. With browser consent, Grey uses Better Stack to measure visits to its public, sign-in, and sign-up pages. Better Stack receives consented page and interaction events, web performance measurements, browser errors, a persistent pseudonymous device identifier, page URLs and referring URLs, browser and device information, and standard approximate location derived from the connection IP address. Grey separately asks signed-in users whether it may use product analytics to understand feature adoption and improve the Service. When a user agrees, page, interaction, performance, browser-error, and Grey-defined feature events can be associated with the account and organisation fields described above. Website Measurement consent does not automatically enable signed-in product analytics. Page URLs can include query parameters that reflect navigation or filter state. Grey configures analytics to limit collection to the data described in this notice and exclude form input values. The legal basis for both optional analytics purposes is the applicable consent. We process professional-intelligence data, including potentially personal company contact details, to provide business and professional information to Customers for legitimate B2B research and commercial activities. The legal basis is Grey's and its Customers' legitimate interests in accessing relevant business and professional information, not the fact that the information was publicly available. Grey limits this processing to a professional context, minimises the data used, provides correction and objection mechanisms, and considers the individual's reasonable expectations and rights. Grey's collection and provision of this business-intelligence data is not itself direct marketing. We process support, feedback, and privacy-request data to respond, resolve issues, improve the Service, and demonstrate compliance. The legal basis is contract, legal obligation, and Grey's legitimate interests in supporting users and improving its business service, depending on the request. We process billing and transaction data to administer subscriptions, reconcile payments, prevent fraud, keep accounting records, and comply with tax and bookkeeping requirements. The legal basis is contract and legal obligation. We process integration account, connection, and mapping data to authenticate, secure, administer, and support customer-selected integrations. The legal basis is contract and Grey's legitimate interests in operating the requested integration. Where Grey reads, enriches, or synchronises CRM record content on the Customer's instructions, the Customer is the controller and Grey acts as its processor under the applicable Data Processing Agreement. We process business contact and marketing data to communicate about Grey, follow up enquiries, and send relevant B2B product and commercial communications. The legal basis is consent where required and otherwise Grey's legitimate interests in marketing its business service. Marketing recipients may opt out at any time. We use consent for non-essential cookies, analytics storage, or similar technologies where consent is required. Essential technologies are used where necessary to provide, secure, and remember settings for the Service. Website analytics choices are browser-specific, while signed-in product analytics and product-update email choices are managed separately under Privacy & communications in user settings. Grey does not activate non-essential marketing technologies unless required consent has been obtained. Details and available choices are described in Grey's Cookie Policy.

Account and authentication information is required to create and secure a Grey account. Billing and organisation details are required for paid subscriptions. If required information is not provided, Grey may be unable to create an account, complete a purchase, provide a requested feature, or respond to a request. Marketing information is optional.

Grey shares personal data with service providers that host, secure, support, and operate the Service. The current Subprocessor schedule identifies providers that may process Customer Personal Data on Grey's behalf. When a visitor consents to website measurement or a signed-in user separately enables product analytics, Better Stack processes the applicable analytics described in this notice as Grey's service provider. Grey configures telemetry storage in the EEA. Better Stack may perform service operations elsewhere under the transfer safeguards described below. Customer administrators and authorised users receive information associated with their workspace. Grey Customers receive professional-intelligence information through the Service. Customer-selected third-party services and integrations receive data when an authorised user enables or directs a transfer. When a Customer connects HubSpot or Pipedrive, Grey exchanges the connected-account and CRM user identifiers, company and contact record values, and synchronisation events needed for the enabled features and configured field mappings. HubSpot and Pipedrive process that data within the Customer's connected account under their own terms and privacy notices at https://legal.hubspot.com/privacy-policy and https://www.pipedrive.com/en/privacy. For purchases through Stripe Managed Payments, the Stripe entity identified at checkout acts as merchant of record and an independent controller for its billing, payment, tax, fraud-prevention, dispute, and transaction-support processing. Grey sends Stripe the billing email, organisation legal name, internal user and organisation identifiers, selected plan, seat count, and records of legal acceptance. For metered billing, Grey sends only the usage type, aggregated billable quantity, timestamp, Stripe customer identifier, and a technical idempotency key; it does not send the revealed email address, telephone number, or underlying contact record. Stripe collects payer identity, payment-method, and tax details directly through its hosted checkout. Grey receives customer, subscription, invoice, payment-status, and transaction references needed to administer access and accounting. Stripe processes personal data under its privacy notice at https://stripe.com/privacy. Grey may also disclose personal data to professional advisers, auditors, insurers, competent authorities, courts, regulators, or parties to a corporate transaction where necessary and lawful. Grey does not permit service providers to use Customer Personal Data for their own unrelated purposes.

Some providers process personal data outside the EEA. Where personal data is transferred to a country without an applicable adequacy decision, Grey uses an approved transfer mechanism such as the European Commission's Standard Contractual Clauses and applies supplementary safeguards where required. To request information about the safeguards relevant to a transfer, or a copy where available, submit a request through https://greyprivacy.com. Grey may redact information where necessary to protect confidential information, security, or the rights of others.

Account data is retained while the account or Customer relationship is active and afterwards in accordance with Grey's documented retention schedule, unless a longer period is required by law or needed for a legal claim. Customer Data is returned or deleted under the applicable agreement and DPA. Usage and security logs are retained for up to 90 days, unless an event must be retained longer for an active security investigation or legal claim. Optional website and product analytics events are retained only as long as reasonably necessary to measure usage trends, investigate service performance, and improve the Service, then deleted under Grey's documented retention schedule. Support communications are retained while a matter is active and afterwards as reasonably necessary to provide support, demonstrate compliance, and resolve related claims. Billing, tax, and accounting records are retained for the periods required by Norwegian bookkeeping and tax law. Privacy-request records are retained for as long as reasonably necessary to complete the request, demonstrate compliance, and resolve related claims. Professional-intelligence data is retained while it remains reasonably necessary and relevant for Grey's B2B intelligence purposes. Grey corrects, deletes, restricts, or suppresses records where required following a valid request or objection. Inactive B2B prospect data is reviewed and deleted when it is no longer reasonably necessary for Grey's business-development purposes. Grey retains the minimum information needed to honour an opt-out or objection. Deleted data may remain temporarily in protected backups until the applicable retention period ends.

Grey uses automated processes to produce professional-intelligence results. Results may be incomplete, outdated, duplicated, inferred, or incorrect. Individuals may ask Grey to correct inaccurate personal data. Grey does not use its controller processing to make decisions based solely on automated processing that produce legal or similarly significant effects about individuals. Customers are responsible for decisions they make using Grey, including compliance with the rules that apply to their own marketing or outreach, and must independently verify material results and provide meaningful human review where required.

Grey uses appropriate technical and organisational measures to protect personal data, including access controls and encryption. No service can guarantee absolute security.

Depending on the circumstances, you may request access to personal data about you, correction, deletion, restriction, or a portable copy. You may object to processing based on legitimate interests and may withdraw consent without affecting processing that occurred before withdrawal. You have an unconditional right to object to personal data being used for direct marketing. Grey stops that marketing when it receives an objection and may retain the minimum information needed to prevent further messages. Some rights are subject to legal conditions and exceptions. Where Grey processes personal data only on a Customer's instructions, Grey directs the request to the relevant Customer and assists that Customer as required by the DPA. Grey may request information needed to verify identity and protect personal data from unauthorised disclosure. Grey responds without undue delay and within the periods required by applicable law.

Please contact Grey first so we can address your concern. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet) or the competent supervisory authority where you live or work or where an alleged infringement occurred.

Grey updates this Privacy Notice when its processing or legal obligations materially change. The current version and last-updated date appear at the top of the notice. Grey communicates material changes through the Service, the registered account email, or another appropriate channel.

Questions, objections, marketing opt-outs, and privacy requests may be submitted through https://greyprivacy.com.