Data Protection

1. Our commitment

Uncapped Acquisition helps business owners build predictable client acquisition. Doing that well means handling information about clients, prospects, partners, contractors and team members. This page sets out the standards our whole team follows when we handle that information, so it stays lawful, secure and respectful of the people it belongs to.

For what we collect from you specifically and your rights, see our Privacy Policy. Where we process data on a client's behalf, our Data Protection Addendum applies.

2. Scope

This policy covers all personal data Uncapped Acquisition handles, in any format (digital or paper), and applies to everyone working for or with us: employees, freelancers, setters, closers, coaches and contractors.

We follow the EU General Data Protection Regulation (GDPR) and the national implementing laws of the Netherlands.

3. Key terms

• Personal data: any information that identifies a living person directly or indirectly, such as a name, email address, phone number, IP address or call recording.
• Processing: anything done with personal data, including collecting, storing, using, sharing and deleting it.
• Special category data: health, ethnicity, religion, political opinions, sexual orientation, biometrics and similar. We do not seek this data and handle it only if strictly necessary, with extra safeguards.
• Controller / processor: the controller decides why and how data is used; a processor acts on the controller's instructions.

4. Our principles

Every person handling personal data at Uncapped Acquisition makes sure it is:

1. Lawful, fair and transparent: we have a legal basis and tell people what we do.
2. Purpose-limited: used only for the purpose we collected it for, or a compatible one.
3. Minimal: we collect only what we need.
4. Accurate: kept up to date, and corrected or deleted when wrong.
5. Not kept too long: deleted or anonymised once no longer needed.
6. Secure: protected against loss, misuse and unauthorised access.
7. Accountable: we document our decisions and can show we comply.

5. Lawful basis

We process personal data only when at least one of these applies: the person consented; it is needed for a contract with them; we have a legal obligation; or it serves our legitimate interests without overriding their rights. Our Privacy Policy maps each activity to its basis.

6. Prospecting and outreach

When we, or our clients using our methods, contact businesses by email, LinkedIn or phone:

• we use business contact details only, collected from public or lawfully licensed sources;
• we target people in their professional role, with a message relevant to that role;
• every message identifies the sender and offers an easy opt-out;
• opt-outs are honoured promptly and suppressed across all tools;
• we respect national e-privacy and anti-spam rules, which may require prior consent for some channels or recipients.

7. Telling people what we do

When we collect data from someone, we tell them who we are, why we need it, our legal basis, who we share it with, how long we keep it, any transfers outside the EEA, and their rights. If we receive data from another source, we provide this information within one month at the latest, or at first contact.

8. Security measures

• Company accounts only, with unique logins and two-factor authentication.
• Access granted on a need-to-know basis and removed when someone leaves.
• Data stored in approved cloud systems, not on personal devices or local drives.
• Encryption in transit and at rest where our providers support it.
• Screens locked when unattended; no client data in public places or on shared screens.
• No downloading client lists or exports unless required for the task, and deleted afterwards.
• Secure deletion of data and devices at end of use.
• Contractors sign confidentiality and data processing terms before access.

9. Sharing and processors

We only use processors that give sufficient guarantees, and we sign a data processing agreement with each. We keep a list of our sub-processors and review it at least once a year.

10. International transfers

We transfer personal data outside the EEA only where the destination has an adequacy decision, or we have Standard Contractual Clauses or another valid GDPR mechanism in place.

11. Retention

We follow the retention periods in our Privacy Policy. Data no longer needed is deleted or anonymised.

12. Rights requests

Anyone receiving a request to access, correct, delete or move personal data passes it to help@uncappedacquisition.com the same day. We verify the requester's identity before releasing anything, never share data by phone with unverified callers, and respond within one month.

13. Data breaches

Anyone who suspects a breach (a lost laptop, a misdirected email, a compromised account) reports it immediately to help@uncappedacquisition.com or the managing director. We assess the risk, contain it, and notify the Autoriteit Persoonsgegevens within 72 hours where required, and affected people without undue delay when the risk is high. All breaches are logged.

14. Responsibility

The managing director of Uncapped Acquisition B.V. is responsible for data protection. We are not legally required to appoint a Data Protection Officer, but we review this annually. Questions or concerns go to help@uncappedacquisition.com.

15. Changes

We review this policy at least yearly and update it when our processes or the law change.