Last updated: 2 August 2026
This notice explains how I use the personal data of people I contact by email about my web design and search engine optimisation services. It is written for people who did not give me their details directly, so it follows Article 14 of the UK GDPR, which sets out what I must tell you when I obtain your personal data from somewhere other than you.
If you received a marketing email from me and want to know where I got your details, this page answers that question in full.
1. Who I am and how to contact me
I am Aaron Michael, a sole trader in the United Kingdom trading as AFB Digital Solutions. I am not a limited company. I am the data controller for the personal data described in this notice, which means I decide why and how it is used.
You can contact me at:
- Email: hello@afbdigitalsolutions.co.uk
- Post: 14 Broadhurst Avenue, St Helens, Merseyside, WA9 5XX
- Website: https://afbdigitalsolutions.co.uk
I do not have a data protection officer. I am not required to appoint one. Any question about data protection comes straight to me.
2. What personal data I hold about you
I hold a small set of business contact details. For most people on my list that means:
- your name
- your job title
- the name of the organisation you work for
- the website address of that organisation
- your business email address
- the practice area or service area that your organisation advertises publicly
That is the whole record. I do not hold your home address, your personal email address, your date of birth, your financial details or any other information about your private life.
I do not hold, and do not seek, any special category data as defined in Article 9 of the UK GDPR. That includes information about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetics, biometrics, sex life or sexual orientation. I also hold no criminal offence data.
3. Where I obtained your personal data
Article 14(2)(f) of the UK GDPR requires me to tell you the source of your personal data, so here it is in plain terms.
Your name and job title were collected from your public LinkedIn profile. I used a tool called Linked Helper, which is a browser based tool that reads publicly visible profile information and saves it to a spreadsheet. Nothing was taken from a private profile, a private message or any part of LinkedIn that is not visible to an ordinary logged in user.
Your employer’s name, website and advertised practice area were taken from your organisation’s own public website.
Your business email address came from one of two places. In most cases it was published on your organisation’s own website, usually on a team page, a contact page or a staff profile. In some cases it was not published, and I worked it out from the email format used by colleagues at the same organisation. For example, if a colleague’s address is shown publicly as firstname.surname@example.co.uk, I have assumed that yours follows the same pattern. Where that is what happened, the address is an informed guess rather than something I found written down.
I want to be clear about two further points:
- None of your data was bought from a list broker, a data vendor or any third party list. I built the list myself from the sources described above.
- All of the sources above were publicly accessible at the time I collected the information.
If the email format guess was wrong, or if any of the details I hold about you are out of date, please tell me and I will correct or delete the record.
4. What I use your personal data for
I use it for one purpose only: to send you a small number of business to business marketing emails introducing my web design and search engine optimisation services, and to reply to you and follow up if you respond.
That is the whole of it. Specifically, I do not:
- sell, rent, licence or share your details with anyone for their own marketing
- add you to a newsletter, a mailing list or an automated drip sequence that runs indefinitely
- use your details to build a profile of you as an individual
- combine your details with data from other sources to score, rank or predict anything about you personally
- make any decision about you by automated means
If you reply and we go on to discuss a project, I will keep our correspondence and any details you give me at that point, and I will be relying on a different lawful basis for that, normally steps taken at your request before entering into a contract under Article 6(1)(b).
5. My lawful basis for using your personal data
My lawful basis is legitimate interests, under Article 6(1)(f) of the UK GDPR.
The legitimate interests are my own commercial interests in promoting my services to organisations that plausibly need them, and in growing a small independent business by direct contact rather than through paid advertising.
Separately, because these are marketing emails sent electronically, the Privacy and Electronic Communications Regulations 2003 also apply. Where I email a named person at a corporate subscriber, such as a limited company or a limited liability partnership, PECR does not require prior consent, although it does require that I identify myself and give you a working way to opt out. I do that in every email. Where a recipient turns out to be a sole trader or an unincorporated partnership, PECR treats them as an individual subscriber, and I remove them from the list on request without argument. If you believe you are in that group and I have contacted you in error, tell me and I will suppress your details straight away.
6. The legitimate interests assessment, explained honestly
Relying on legitimate interests means I have to be able to show that my interest does not override your rights and interests. Here is my reasoning, so you can judge it for yourself.
The purpose. I am a one person business offering a service that organisations of your type routinely buy. Contacting the person who is likely to be responsible for that decision is a normal and expected part of how business services are sold in the United Kingdom.
Whether it is necessary. I cannot make an introduction without an email address for your organisation. Where a named person is responsible for these decisions and their address is published, I write to them directly, because that is what makes the message relevant rather than generic. Where no individual address is published, I use the general contact address your organisation publishes for enquiries. Either way the data I hold is the minimum needed: no personal contact details, no enrichment, no tracking of your behaviour across the web.
The balance against your rights. I have weighed the following in your favour:
- You did not ask to hear from me, and receiving unsolicited email is an intrusion, however small.
- You did not put your details on LinkedIn in order to be marketed to.
- Where your email address was inferred rather than published, you had even less reason to expect it.
And the following on the other side:
- The data is business contact information about your professional role, not information about your private life. It relates to you in your capacity as an employee or officer of an organisation.
- The information was already publicly available, and the practice area detail is advertised by your organisation precisely so that people know what it does.
- The intrusion is low. This is a small number of short emails to a work inbox, not phone calls, not post to your home, not messages out of hours to a personal device.
- Every email says clearly who I am and includes a link to this notice and a simple way to stop hearing from me. One reply saying no is enough. You do not have to give a reason.
- I keep the volume deliberately low and I stop after a small number of messages whether or not you reply.
- No sensitive data is involved, no children are involved, and no automated decision making is involved.
On that basis I have concluded that the processing is proportionate and that a business person would not be surprised to receive a brief, clearly identified approach of this kind at their work address. That is my honest assessment and not a formality. If you disagree, you do not need to persuade me. Your right to object to direct marketing is absolute and I will act on it immediately. See section 10.
7. Who I share your personal data with
I send my emails using Instantly.ai, an email outreach platform provided by Instantly (Delaware, United States). Instantly acts as my processor, which means it handles the data on my instructions and for no purpose of its own. Your name, business email address and organisation details are stored in that platform so that the emails can be personalised and sent.
I may also use ordinary business tools such as an email mailbox provider and a spreadsheet or a local database on my own machine. Where those involve a third party, that third party acts as a processor on the same terms.
Other than that, I do not share your personal data with anyone. I do not sell it, rent it, trade it, or pass it to other agencies, partners or affiliates.
I may disclose personal data if I am legally required to do so, for example in response to a valid request from a regulator, a court or a law enforcement body.
8. Transfers outside the United Kingdom
Instantly.ai is based in the United States, so using it involves a restricted transfer of your personal data outside the UK.
That transfer is covered by the International Data Transfer Addendum to the European Commission’s standard contractual clauses, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, which forms part of Instantly’s data processing addendum. This is one of the appropriate safeguards recognised by Article 46 of the UK GDPR. I have also assessed the risk of the transfer before making it, as the UK transfer rules require.
You can ask me for further information about that safeguard, and I will provide a copy of the relevant terms or a link to them.
9. How long I keep your personal data
- If you do not reply, I delete your record within twelve months of the last email I send you, and sooner if the campaign is finished.
- If your email address bounces or is shown to be invalid, I delete the record within thirty days.
- If you ask me to stop contacting you, I remove you from the active list and keep only the minimum needed to make sure you are not contacted again, which is your email address on a suppression list. The Information Commissioner’s Office specifically recommends suppression rather than deletion for this purpose, because deleting a record entirely creates a risk that the same details are collected again later and you are emailed a second time. If you would rather I erased everything including the suppression entry, tell me and I will do that, but please understand that I will then have no record telling me not to contact you.
- If you reply and we begin discussing work, our correspondence and any project records are kept for as long as is needed for that purpose and then for six years after the end of the relationship, in line with the usual limitation period and my tax record keeping obligations.
10. Your right to object to direct marketing
You have an absolute right to object to your personal data being used for direct marketing, under Article 21(2) of the UK GDPR.
Absolute means exactly that. There is no balancing test, no exemption and no legitimate interest of mine that can override it. You do not have to explain yourself, and you do not have to use any particular form of words. If you tell me to stop, I must stop, and I will.
The quickest way to object is to reply to any email I have sent you and ask me to stop. If your email provider shows an unsubscribe option at the top of the message, that works too and reaches me the same way. You can also email me at the address in section 1. I action objections manually and normally within one working day, and always within one month.
11. Your other rights
Alongside the right to object, you have the following rights over the personal data I hold about you.
The right to be informed. The right to know how your personal data is being used. This notice is how I meet that obligation.
The right of access. You can ask me for a copy of the personal data I hold about you, together with supporting information. This is often called a subject access request.
The right to rectification. You can ask me to correct personal data that is inaccurate, or to complete data that is incomplete. This matters here, because some email addresses on my list were inferred from a colleague’s address format rather than published.
The right to erasure. You can ask me to delete your personal data. Because I rely on legitimate interests and I am using the data for direct marketing, this right applies in a straightforward way and I will normally comply, subject to the suppression point in section 9.
The right to restrict processing. You can ask me to pause my use of your personal data in certain circumstances, for example while a dispute about accuracy or about my legitimate interests is being resolved.
The right to data portability. This right applies only to processing based on consent or on a contract and carried out by automated means, so it will not usually apply to the marketing data described here. It is listed for completeness.
Rights relating to automated decision making and profiling. You have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. I do not carry out any automated decision making or profiling of that kind.
The right to withdraw consent. I do not rely on consent for this processing, so there is no consent to withdraw. If that ever changes I will tell you, and withdrawing will be as easy as giving it.
12. How to exercise your rights
Email me at hello@afbdigitalsolutions.co.uk, or write to me at the postal address in section 1. Please say which right you want to use and give me enough information to find your record, which is normally just the email address I contacted you on.
There is no charge. I will respond within one month. If a request is particularly complex I may extend that by up to two further months, and if I do I will tell you within the first month and explain why. In rare cases I may ask for proof of identity, but only where I have a genuine doubt about who is making the request.
Requests to stop marketing are dealt with immediately and are not subject to any of the above.
13. Your right to complain
If you are unhappy with how I have handled your personal data, please tell me first and I will try to put it right.
You also have the right to complain to the Information Commissioner’s Office, which is the UK supervisory authority for data protection. You can complain to the ICO whether or not you have raised the matter with me, and doing so does not affect any other legal remedy available to you.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
Textphone: 18001 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/
14. Changes to this notice
If I change how I use business contact data I will update this page and change the date at the top. The version published here is always the current one.