AI PRO contact enrichment
Record of processing: AI PRO contact enrichment
Version 1.1 · 10 November 2026
This section is available in English only. The English text is the binding version.
About this record
This is HeyDrop's record of processing activities under Art. 30(1) GDPR for AI PRO contact enrichment. It covers the enrichment lookup and the storage of results, the privacy notice email to enriched people and the notice log, the handling of objections and other requests from the people whose data is enriched, and the AI PRO subscription data that enrichment depends on.
HeyDrop keeps this record even though it has fewer than 250 employees. The exemption in Art. 30(5) GDPR does not apply, because enrichment is a regular activity and may affect the rights of the people enriched.
Related documents: Legitimate interest assessment, Data protection impact assessment, Data partners, Privacy Policy, Contact enrichment (AI PRO) and the opt-out page.
Controller
| Field | Entry |
|---|---|
| Controller | HeyDrop P.S.A., ul. Cegielniana 4A/15, 30-404 Kraków, Poland. KRS 0001089398, NIP PL6793273746. |
| Contact for privacy requests | privacy@heydrop.app |
| Data protection officer | dpo@heydrop.app |
| Roles | HeyDrop is the controller of the enrichment processing: it chooses the data partners, the fields, retention and safeguards, and handles requests from the people enriched. The AI PRO user controls their own contact list: which contact to enrich and what they do with the result. Where HeyDrop and a user are joint controllers for any step, HeyDrop is the contact point for the people concerned and handles their requests. |
| Territorial scope | HeyDrop is established in Poland, so the GDPR applies to enrichment wherever the person lives (Art. 3(1) GDPR). |
| Lead supervisory authority | Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland. |
Entry 1: Contact enrichment lookups and storage of results
| Field | Entry |
|---|---|
| Purpose | At the request of an AI PRO user, look up one business contact the user saved or scanned in HeyDrop and add business facts about the person and their company to that contact, so the user knows who the contact is and what their company does (professional networking and business-to-business follow-up). |
| Legal basis | Art. 6(1)(f) GDPR, legitimate interests: the user's interest in understanding a business contact and HeyDrop's interest in offering the feature. Consent is not used, because HeyDrop has no direct relationship with the person through which to ask for it. See the Legitimate interest assessment. |
| Data subjects | People whose contact entry an AI PRO user saved or scanned in HeyDrop and then chose to enrich. |
| Data sent to data partners | Name, email address and company name of the one contact being enriched. The partner that supplies only company facts receives only the company name or web domain. |
| Person facts received and stored | Job title, seniority, location, social profile URLs. |
| Company facts received and stored | Industry, size, founded year, headquarters, funding, website. |
| Data never requested or stored | Phone numbers, email addresses of any kind, photos of people, special categories of data (Art. 9 GDPR). |
| Metadata | The data partner that supplied each result and the date of the enrichment, so that HeyDrop can answer access requests (Art. 15(1)(g) GDPR). A wrong-person marker on a contact where the user tapped Wrong person?, so the same lookup is not repeated for that contact. Wrong-person reports are counted without personal data, to monitor the wrong-match rate. |
| Sources | The user's own contact record (name, email address, company name). The data partners listed under Data partners and safeguards, which compile business information from publicly accessible sources, such as public web pages, and from other sources they use under licence. |
| Recipients | The user who owns the contact (only they see the results). The data partners, which receive the inputs to find a match. Amazon Web Services (hosting, processor). Authorised HeyDrop support staff, only to handle requests about enrichment. |
| Transfers outside the EEA | United States: Amazon Web Services; Hunter Web Services, Inc.; People Data Labs once it is in use. Safeguards: the EU-US Data Privacy Framework where the recipient is certified (Art. 45 GDPR), otherwise the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). For UK data: the UK Extension to the Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum. A copy of the safeguards is available at privacy@heydrop.app. |
| Retention of inputs | HeyDrop does not store the inputs beyond the request, and its logs hold no personal data. Each data partner processes what it receives under its own terms and privacy policy. |
| Retention of results | Until the earliest of: the user taps Wrong person? (deleted at once); the user deletes the contact; HeyDrop deletes a wrong result on request (Art. 16, 17 GDPR); the person objects or asks for erasure (deleted within one month); the user's account is deleted (removed within 30 days). When the user's AI PRO plan ends, existing results stay on the contact and no new enrichments are possible. Copies in backups are removed when those backups expire on their regular cycle. |
| Automated decisions | None. Matching is automated, but no decision with legal or similarly significant effects is made about the person (Art. 22 GDPR). |
| Information to data subjects | A privacy notice emailed directly to the person the first time any user enriches them, before their details are sent to a data partner (Art. 14(3)(c) GDPR); see Entry 2. The Privacy Policy, Contact enrichment (AI PRO) section and the Data partners page, which shows the full notice text, provide the same information publicly. The line under the Enrich button tells the user what is sent and links to Data partners. |
| Risk assessment | Data protection impact assessment. |
Limits on the processing
- Enrichment runs only when the user taps Enrich on one contact. There is no bulk and no automatic enrichment.
- Each AI PRO subscriber can enrich up to 50 contacts a month. Scripts, bots and attempts to get around the limit are forbidden, and HeyDrop throttles or suspends enrichment in case of abuse.
- AI PRO is available in the iOS app, in all countries, including the EU.
- AI PRO is not included in Teams seats, and Enrich is not available on contacts that belong to a Teams workspace. Enrichment is therefore not part of the service HeyDrop provides to Teams customers as their processor.
- Enrich requires an email address on the contact.
- Before every call to a data partner, the backend checks the contact's email address against the objection list (see Entry 3). If it is on the list, no notice is sent and no data is sent to any data partner.
- The first time a person is enriched, the privacy notice is sent before any data is sent to a data partner (see Entry 2).
- Under the results, the user can tap Wrong person?. The result is deleted from that contact at once, the enrichment does not count against the monthly limit, and the same lookup is not repeated for that contact (accuracy, Art. 5(1)(d) and 16 GDPR).
- Users may use results only for their own internal business purposes. The Terms of Use forbid resale, building lists or databases, training AI models, enriching people the user has no genuine business interaction with, enriching people known to be under 16, and decisions about employment, credit, insurance, housing or tenancy.
- HeyDrop does not sell enrichment data or use it for advertising. Enrichment data is not passed to any AI model provider.
Entry 2: Privacy notice to enriched people and notice log
| Field | Entry |
|---|---|
| Purpose | Inform each enriched person directly, the first time any HeyDrop user enriches them and before their details are sent to a data partner (Art. 14(3)(c) GDPR), and be able to show that HeyDrop did so and avoid duplicate notices (Art. 5(2) GDPR). |
| Legal basis | Art. 6(1)(c) GDPR, legal obligation, read with Art. 5(2) and 14 GDPR. |
| Data subjects | People enriched by an AI PRO user. |
| Data | The contact's email address, used to send the notice and not stored separately. Notice log: a one-way hash of the normalised email address and the date the notice was sent. Delivery status (sent, bounced, failed). |
| Content of the notice | Sent from privacy@heydrop.app. Not marketing. Does not name the user ("a HeyDrop user who has your contact details"). Says what HeyDrop does, the fields, the sources with a link to Data partners, the legal basis and legitimate interests, retention and the person's rights, with a one-click link to object at /legal/enrichment-opt-out. The full text is on the Data partners page. |
| Frequency | Once per person, whichever user enriches them, keyed on the hash of the email address; again only if the processing changes materially. |
| Source | The user's own contact record (the email address). |
| Recipients | Twilio SendGrid (email delivery, processor). Amazon Web Services (hosting of the notice log, processor). |
| Transfers outside the EEA | United States: Twilio SendGrid and Amazon Web Services. Safeguards as in Entry 1. |
| Retention | Notice log: for as long as HeyDrop needs it to show compliance and avoid duplicate notices (Art. 5(2) GDPR). Delivery records at Twilio SendGrid: under its data processing agreement. |
| Delivery failures | Bounces and delivery failures are logged with the notice log entry and reviewed. The Privacy Policy section and the Data partners page remain available to anyone who did not receive the notice. |
Entry 3: Objections and other requests from people enriched
| Field | Entry |
|---|---|
| Purpose | Handle objections (Art. 21(1) GDPR) and requests for access, rectification, erasure and restriction (Art. 15 to 18 GDPR) from people whose data is or may be enriched. Make sure a person who objected is never enriched again. Delete enrichment results about them from all users' contacts. Keep a record of how each request was handled. |
| Legal basis | Art. 6(1)(c) GDPR, legal obligation, read with Art. 5(2), 12, 17 and 21 GDPR. |
| Data subjects | Anyone who uses the objection link in the notice email or the opt-out page, or writes to privacy@heydrop.app about enrichment, whether or not they were enriched. |
| Data | Request form: email address, optional name, company and message, a confirmation that the requester is the person concerned or acts for them, request date. Support records: the request conversation, confirmation by reply from the same email address, acknowledgement and completion emails, handling notes. Objection list: the person's email address in normalised form and the date it was added. |
| Source | The person directly. |
| Recipients | Intercom (customer support tool, processor). Vercel (website hosting for the opt-out page and form, processor). Amazon Web Services (hosting of the objection list, processor). Authorised HeyDrop support staff. Requests are not forwarded to data partners; the person is told how to opt out with each partner directly. |
| Transfers outside the EEA | United States: Intercom, Vercel and Amazon Web Services. Safeguards as in Entry 1. |
| Retention | Request records in Intercom: for as long as HeyDrop needs to show how it handled the request (Art. 5(2) GDPR). Objection list: for as long as it is needed to honour the objection, because removing an entry would allow the person to be enriched again. |
| Information to data subjects | The notice email, the opt-out page and the Privacy Policy, Contact enrichment (AI PRO) section. |
How an objection is handled
- The person follows the link in the notice email to the opt-out form, sends the form directly, or writes to privacy@heydrop.app. The form creates a support conversation and sends an acknowledgement.
- The person confirms the request by replying from the same email address, so that nobody can make a request in their name (Art. 12(6) GDPR).
- Support adds the normalised email address to the objection list. From then on, the backend refuses every enrichment of that address before any data partner is called, for every user.
- Support deletes all existing enrichment results keyed by that email address from all users' contacts, within one month (Art. 12(3) GDPR).
- Support confirms completion to the person by email.
HeyDrop does not delete the contact entry a user created themselves (the name, email address and company they saved or scanned), because that is the user's own record. If the person also asks for that entry to be removed, HeyDrop handles it as a separate request. Wrong results reported by the person are deleted by support and the person is told when this is done (Art. 16 and 17 GDPR). Access requests are answered with the fields held, the data partner that supplied each field and the categories of recipients. All requests are answered within one month; for complex requests HeyDrop may extend this by two months and tell the person why.
Entry 4: AI PRO subscription and enrichment counter
| Field | Entry |
|---|---|
| Purpose | Provide the AI PRO plan to the subscriber: account, entitlement, billing and the monthly enrichment and AI scan counters. |
| Legal basis | Art. 6(1)(b) GDPR, contract with the subscriber. |
| Data subjects | AI PRO subscribers. |
| Data | Account ID, plan, entitlement status, App Store transaction data received by HeyDrop, number of enrichments and AI scans used each month (enrichments removed with Wrong person? are not counted). |
| Recipients | Apple, which sells AI PRO in the App Store under its own terms and handles refunds. Amazon Web Services (hosting, processor). |
| Transfers outside the EEA | United States. Safeguards as in Entry 1. |
| Retention | Account and plan data: while the account exists. Purchase and payment records: as long as accounting and tax law requires. |
Security measures (Art. 32 GDPR)
- Hosting on Amazon Web Services in the United States, with encryption at rest (AES-256, KMS) and in transit (TLS 1.2 or higher).
- Results are stored only on the enriched contact and are visible only to its owner. They never appear on public cards or in Teams views.
- Calls to data partners are made only from HeyDrop's servers. Partner API keys are kept server-side and are never shipped in the app.
- A field allowlist ensures that phone numbers, email addresses and photos are never requested from data partners or stored.
- The partner that supplies only company facts receives only a company name or web domain.
- The objection list is checked before every notice and every call to a data partner.
- The notice log holds only a one-way hash of the email address and the date sent. Notice emails are sent through Twilio SendGrid on a separate, low-volume transactional stream from an authenticated sending domain, never as a bulk campaign.
- The user can delete a wrong result at once with Wrong person?; wrong-person reports are counted without personal data.
- Logs hold no personal data.
- One contact per tap, at most 50 enrichments per subscriber per month, no bulk or automatic runs, and throttling against abuse.
- Deleting a contact deletes its results. Support can find and delete results by email address across all users' contacts.
- Access to enrichment data by HeyDrop staff is limited to authorised support staff handling requests.
Data partners and safeguards
HeyDrop uses the data partners below for contact enrichment. The current list, with privacy policy and opt-out links for each partner, is on the Data partners page, which HeyDrop updates before a new partner starts receiving data.
| Partner | Role | What it receives | What it returns | Location and transfer safeguard | Contract status |
|---|---|---|---|---|---|
| Hunter (Data Platform; Hunter Web Services, Inc.) | Data partner. Independent controller of its own database; processes HeyDrop's lookups under its terms and data processing agreement. | Name, email address and company name of the one contact being enriched. | Person facts (job title, seniority, location, social profile URLs) and company facts. Never email addresses. | United States, with servers in Belgium. Standard Contractual Clauses; UK International Data Transfer Agreement for UK data. | In use. Hunter's terms of service include a data processing agreement. The roles for lookup inputs and results are confirmed in writing with Hunter. |
| The Companies API | Data partner for company facts. | Company name or web domain only. Never a person's name or email address. | Company facts (industry, size, founded year, headquarters, funding, website). | France (EEA). No transfer outside the EEA. | In use. Contracting entity and hosting location confirmed; a data processing agreement applies where personal data is involved. |
| People Data Labs | Data partner. Independent controller of its own database. | Name, email address and company name of the one contact being enriched. | Person facts and company facts. Never phone numbers, email addresses or photos. | United States. People Data Labs states in its privacy policy that it is certified under the EU-US Data Privacy Framework and the UK Extension; HeyDrop checks the Data Privacy Framework list before use, otherwise Standard Contractual Clauses apply. | Not in use. It receives no data until it confirms in writing that HeyDrop may display its data to the requesting user and store it on that contact, and until a data processing agreement is signed. |
| Amazon Web Services | Processor (hosting). | All enrichment data: inputs during the lookup, stored results, the notice log, the objection list. | Nothing. | United States (us-east-1, us-west-2). Data Privacy Framework where certified, otherwise Standard Contractual Clauses. | AWS data processing addendum. |
| Intercom | Processor (customer support). | Opt-out and other requests, with the requester's details and messages. | Nothing. | United States. Data Privacy Framework where certified, otherwise Standard Contractual Clauses. | Intercom data processing agreement. |
| Twilio SendGrid (Twilio Inc.) | Processor (email delivery). | The person's email address and the notice text, to send the privacy notice; delivery status. | Delivery status (sent, bounced, failed). | United States. EU-US Data Privacy Framework where certified, otherwise Standard Contractual Clauses. | Twilio data processing addendum. |
| Vercel | Processor (website hosting). | Opt-out form submissions in transit to Intercom. | Nothing. | United States. Data Privacy Framework where certified, otherwise Standard Contractual Clauses. | Vercel data processing addendum. |
What data partners must not do and what they keep
- Data partners receive only the inputs listed above, one lookup at a time. HeyDrop keeps no copy of the inputs beyond the request.
- Each data partner processes what it receives under its own terms and privacy policy. According to Hunter's privacy policy, Hunter keeps a customer's enrichment requests until the customer closes its Hunter account.
- HeyDrop asks each data partner to commit in writing to use the inputs only to answer HeyDrop's lookup, not to add them to its database and not to use them for training.
- Data partners run their own databases. An objection to HeyDrop does not remove a person from a partner's database; people can opt out with each partner directly, using the links on the Data partners page. Hunter's opt-out is at hunter.io/claim; The Companies API takes requests at contact@thecompaniesapi.com.
- Hunter has an EU representative in Ireland and a UK representative.