legal
Privacy Policy
Last updated: 29 May 2026
This privacy policy describes how ENROW collects, uses, stores, protects and shares personal data in connection with the operation of its B2B professional data enrichment service. It is addressed to all persons interacting with ENROW: website visitors, clients and users of the Service, and individuals whose professional data is held in ENROW's enrichment database.
We invite you to read this policy carefully. Should you have any questions, you may contact our Data Protection Officer at dpo@enrow.io.
1. Who Are We?
The website https://enrow.io and the ENROW service (hereinafter the "Service") are operated by:
SCHRUTE FARMS, a French limited liability company (SARL) with a share capital of €500, having its registered office at 123 Rue De Rome, 75017 Paris, France, registered with the Paris Trade and Companies Register (RCS Paris) under number 981 316 300, intra-community VAT number FR76981316300.
Joint Managers: Thomas LUCY and Louis CONGARD.
Data Protection Officer (DPO): Louis CONGARD — dpo@enrow.io.
ENROW is a professional data enrichment service intended exclusively for business-to-business (B2B) commercial prospecting. The Service enables its clients to search for professional email addresses, telephone numbers, LinkedIn profiles and company information.
2. What Data Do We Collect?
We collect different categories of data depending on your relationship with ENROW.
2.1 — Visitors to the enrow.io Website
When you browse our website, we may collect the following data, subject to your consent for non-essential cookies:
- Browsing data: pages visited, visit duration, navigation path, traffic source (referral URL), browser type and version, operating system, screen resolution, device type;
- IP address;
- Form data: if you complete a contact or demonstration form (name, email, company, message);
- Cookies and similar technologies: see our Cookie Policy for further details.
This data is collected via Google Tag Manager (tag management), Cookiebot (consent management), HubSpot (forms and chat), and advertising pixels (Google Ads, Meta, LinkedIn) subject to your consent. Typefaces are loaded from Google Fonts and videos may be embedded via YouTube.
2.2 — Clients and Users of the Service
When you create an Account, subscribe to a Plan or use the Service:
- Registration data: name, first name, professional email address, company name, password (stored as an irreversible hash via bcrypt with individual salting — ENROW does not know your password);
- Billing data: bank card data is processed exclusively by Stripe (PCI-DSS certified payment provider). ENROW does not collect, store or have access to any bank card data;
- Service usage data: enrichment search history, Credits consumed, features used (web application, API, Chrome Extension), Account settings;
- Connection data: login dates and times, IP address, session identifier;
- Support data: content of exchanges with our team via Intercom (live chat, tickets), including any screenshots shared.
2.3 — Data Transmitted by the Client for Enrichment
When you use the Service, you may transmit data to ENROW for enrichment ("Client Data"), typically: name, first name, company name, email address, LinkedIn profile of a professional contact. In this context, the Client acts as Data Controller and ENROW as Data Processor within the meaning of Article 28 of the GDPR. The detailed conditions are set out in our Data Processing Agreement (DPA).
Client Data shall be retained for a maximum period of ninety (90) days and shall thereafter be automatically and permanently deleted. The Client may request early deletion at any time.
2.4 — Individuals Whose Data Is Held in ENROW's Enrichment Database
In the course of its B2B enrichment activity, ENROW collects and maintains a database containing professional information relating to B2B contacts. If you are a professional whose data is held in this database, this section is of particular relevance to you.
Categories of data collected:
- Surname and first name;
- Professional email address;
- Professional telephone number;
- Personal telephone number (where applicable, when associated with a professional profile);
- Job title and role;
- Company name and firmographic information (sector, size, location, website);
- LinkedIn profile URL.
ENROW does not collect any sensitive data within the meaning of Article 9 of the GDPR (ethnic origin, political opinions, religious beliefs, health data, sexual orientation, etc.).
3. Where Does the Enrichment Data Come From?
The data held in ENROW's enrichment database originates from the following sources:
- Publicly available sources on the Internet: company websites ("Team", "Contact", "About" pages), online professional directories, press releases, business press articles, publications on professional social networks;
- Professional social networks: information made publicly available by users on their professional profiles (LinkedIn and other equivalent platforms);
- Official public registers: trade registers (Infogreffe, Companies House, etc.), legal and regulatory databases;
- Search engines: information indexed by public search engines;
- Third-party professional data providers: ENROW engages specialist providers of professional contact data, firmographic data and business signals. Such providers are contractually bound to ENROW by GDPR compliance obligations;
- ENROW's proprietary technologies: search, inference and verification algorithms developed internally by ENROW.
ENROW does not collect data from data breaches, stolen databases or any unlawful source.
4. Information Provided to Data Subjects (Article 14 GDPR)
The data held in ENROW's enrichment database has not been collected directly from the data subjects. Article 14 of the GDPR requires the data controller to provide certain information to individuals whose data is processed without having been collected directly from them.
4.1 — Exemption from Individual Notification
In accordance with Article 14(5)(b) of the GDPR, ENROW benefits from the exemption from individual notification on the grounds that the provision of such information to each data subject proves impossible or would involve a disproportionate effort, having regard to:
- The volume of data processed (several million professional contacts);
- The absence of a reliable, verified contact email address for all data subjects at the time of collection;
- The exclusively professional and B2B nature of the processing;
- The public availability of the information processed.
4.2 — Compensatory Measures
By way of compensation for this exemption, ENROW implements the following measures:
- Publication of this privacy policy: freely and openly accessible on the website https://enrow.io, this policy provides all information required by Articles 13 and 14 of the GDPR;
- Rights exercise form: a dedicated "Exercise of Rights over My Personal Data" form is directly accessible on the ENROW website, enabling any person to verify whether their data is held in the database and to request its deletion;
- Dedicated email address: any person may contact the DPO at dpo@enrow.io to exercise their rights;
- Guaranteed processing time: ENROW undertakes to process any request within twenty-four (24) business hours;
- Permanent exclusion list: any person who has exercised their right of objection shall be placed on a permanent exclusion list (blocklist) ensuring that their data will not be collected or processed in the future.
4.3 — Information via ENROW's Clients
ENROW contractually requires its clients (via the Terms and the DPA) to inform data subjects in accordance with Articles 13 and 14 of the GDPR when they use Enriched Data to contact them. ENROW's clients undertake in particular to indicate the origin of the data, the purposes of processing and the means of exercising rights.
5. Why and on What Legal Basis Do We Process Your Data?
| Purpose | Legal basis | Details |
|---|---|---|
| B2B data enrichment (own enrichment database) | Legitimate interest (Art. 6(1)(f)) | Collection and maintenance of a B2B professional database for business prospecting purposes. Documented LIA, reviewed annually, available upon request. |
| Processing of Client Data for enrichment | Performance of a contract (Art. 6(1)(b)) | Enrichment of data transmitted by the Client. ENROW acts as Data Processor. |
| Account creation and management | Performance of a contract (Art. 6(1)(b)) | Registration, authentication, management of Subscriptions and Credits. |
| Billing and payment | Performance of a contract + legal obligation (Art. 6(1)(b) and (c)) | Payment processing via Stripe. Retention of invoices for 10 years (statutory accounting obligation). |
| Marketing communications (newsletters, announcements) | Legitimate interest (B2B clients) or consent | Sending of commercial communications via Brevo. Unsubscribe at any time via the link at the bottom of each email. |
| Client support | Performance of a contract (Art. 6(1)(b)) | Responding to support requests via Intercom. |
| Advertising and performance measurement | Consent (Art. 6(1)(a)) | Google Ads, Meta Pixel, LinkedIn Insight Tag. Subject to consent via Cookiebot. Retargeting and conversion measurement. |
| Technical tag management | Strictly necessary | Google Tag Manager. Technical container which does not place cookies of its own. Triggered tags are subject to consent. |
| Security and logging | Legitimate interest (Art. 6(1)(f)) | Activity logs and monitoring via SigNoz. Anomaly detection, intrusion protection. |
| Affiliate programme management | Performance of a contract (Art. 6(1)(b)) | Referral and commission tracking via Partnero. |
| Exercise of data subject rights | Legal obligation (Art. 6(1)(c)) | Processing of access, deletion, objection requests, etc. |
| Algorithm improvement (anonymised data) | Legitimate interest (Art. 6(1)(f)) | Use of anonymised and aggregated data which no longer permits identification. |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) | Responding to judicial, tax or administrative orders. |
5.1 — Legitimate Interest Assessment
Where processing is based on legitimate interest, ENROW has carried out a balancing exercise between its legitimate interests and the rights and freedoms of data subjects. This analysis is formalised in a Legitimate Interest Assessment (LIA), reviewed no fewer than once per annum and upon any significant change affecting the processing.
The factors taken into account include: the exclusively professional and B2B nature of the data, the public availability of the information processed, the ease of exercising the right of objection (24 business hours), and placement on a permanent exclusion list. The LIA is available upon request from the DPO.
6. With Whom Do We Share Your Data?
Your personal data may be disclosed to the following categories of recipients, in strict compliance with the principle of data minimisation:
6.1 — ENROW's Clients
Enrichment data (emails, telephone numbers, LinkedIn profiles, company information) is returned to ENROW's clients in connection with their use of the Service. Clients are contractually required (via the Terms and the DPA) to use such data exclusively for B2B prospecting, to have a valid legal basis and to inform data subjects.
6.2 — Technical Sub-Processors
ENROW engages the following sub-processors to ensure the operation of the Service:
| Sub-Processor | Purpose | Location | Transfer outside EEA |
|---|---|---|---|
| AWS | Hosting, databases, storage | EU (Paris, eu-west-3) | No |
| Stripe | Payment and billing | EU (Ireland) | No |
| Brevo | Marketing and transactional emails | France | No |
| HubSpot | CRM, forms, chat | EU (France/Germany) | No |
| Intercom | Client support | EU (Ireland) | No |
| SigNoz | Monitoring and logging | EU | No |
| Cookiebot | Cookie consent management | EU (Denmark) | No |
| Google Workspace | Internal communication | EU (France) | No |
| Slack | Internal communication | EU | No |
| Partnero | Affiliate programme | EU (Estonia) | No |
| Anthropic (Claude.ai) | AI assistance (no persistence) | USA | EU-US DPF + SCCs. No training. |
6.3 — Third-Party Enrichment Providers
ENROW engages specialist providers to supplement enrichment: SERP data providers, professional contact data providers, firmographic data providers and business signals providers. The identity of these providers constitutes a trade secret within the meaning of Directive (EU) 2016/943. The nominative list is available upon request from the DPO subject to a non-disclosure agreement (NDA). ENROW contractually imposes on each provider data protection obligations compliant with the GDPR.
6.4 — Advertising Partners
Subject to your consent expressed via the Cookiebot banner:
- Google Ads: conversion tracking and retargeting (Google LLC, USA — EU-US Data Privacy Framework);
- Meta Pixel: Facebook/Instagram conversion tracking and lookalike audiences (Meta Platforms, USA — EU-US DPF);
- LinkedIn Insight Tag: LinkedIn conversion tracking and demographic analysis (LinkedIn Corp., USA — EU-US DPF).
6.5 — Third-Party Content
Subject to your consent:
- Google Fonts: loading of typefaces from Google servers. Transmits the visitor's IP address (Google LLC, USA — EU-US DPF);
- YouTube: video embedding. May place tracking cookies (Google LLC, USA — EU-US DPF).
6.6 — Authorities and Legal Obligations
ENROW may be required to disclose personal data to the competent authorities in the following cases:
- Judicial order (Article 77-1-1 of the French Code of Criminal Procedure);
- Request from a supervisory authority (CNIL or equivalent);
- Tax or accounting obligation;
- Legal proceedings in defence of ENROW's rights.
7. Transfers Outside the European Economic Area
All Service data is hosted within the European Union (AWS Paris, eu-west-3). The vast majority of our sub-processors operate exclusively within the EEA.
Certain processing operations may involve a transfer to the United States, governed by the following mechanisms:
- EU-US Data Privacy Framework (DPF) adequacy decision: European Commission decision of 10 July 2023 recognising an adequate level of protection for certified companies in the United States;
- Standard Contractual Clauses (SCCs): adopted by the European Commission (Implementing Decision 2021/914), supplemented where necessary by additional technical measures.
Services involving a transfer outside the EEA:
- Anthropic (Claude.ai): DPF + SCCs. No data used for model training. Ad hoc processing without persistence;
- Google Ads, Meta, LinkedIn, Google Fonts, YouTube: DPF. Subject to your prior consent (cookies).
Full details of the transfer mechanisms for each sub-processor are set out in Annex 3 of the DPA, available upon request.
8. How Long Do We Retain Your Data?
ENROW applies the principle of storage limitation (Article 5(1)(e) GDPR) and retains your data only for the period strictly necessary for the purposes described above.
| Data category | Retention period | Justification |
|---|---|---|
| Registration data (Account) | Duration of contract + 3 years | Civil limitation period |
| Client Data for enrichment | 90 days max then auto-deletion | Data minimisation |
| Technical cache | 48 hours | Performance + verification |
| Billing data | 10 years | Statutory accounting obligation |
| Support data (Intercom) | 3 years after last exchange | Quality monitoring + limitation period |
| Browsing data / cookies | 13 months max (CNIL recommendation) | CNIL compliance |
| Security logs | 12 months | Information system security |
| B2B enrichment database | Duration of activity. Deletion within 24h upon objection request. | Ongoing purpose + right of objection |
| Rights exercise requests | 3 years from processing | Proof of compliance |
| Exclusion list (blocklist) | Unlimited | Guarantee against re-collection |
Upon expiry of the periods indicated, data shall be automatically and permanently deleted or, where technically feasible, irreversibly anonymised.
9. What Are Your Rights?
In accordance with the GDPR (Articles 15 to 22) and the Loi Informatique et Libertés, you have the following rights:
- Right of access (Article 15): you may obtain confirmation as to whether or not personal data concerning you is being processed by ENROW, and obtain a copy thereof. You may also obtain information on the purposes of processing, the categories of data, the recipients, the retention period and the origin of the data.
- Right to rectification (Article 16): you may request the correction of inaccurate data or the completion of incomplete data. If you have changed job, telephone number or company, please contact us to update your information.
- Right to erasure (Article 17): you may request the deletion of your data. ENROW shall carry out the deletion and place you on the permanent exclusion list within 24 business hours. This right is limited where processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
- Right to object (Article 21): you may object at any time to the processing of your data based on ENROW's legitimate interest, including for commercial prospecting purposes. Upon objection, ENROW shall cease processing and place the data subject on its permanent exclusion list.
- Right to restriction of processing (Article 18): you may request the temporary suspension of the processing of your data, in particular during verification of the accuracy of the data or examination of your objection.
- Right to data portability (Article 20): this right applies where processing is based on consent or the performance of a contract. As ENROW's processing is primarily based on legitimate interest, the right to portability does not apply as of right. Notwithstanding, ENROW shall use reasonable endeavours to comply with any reasonable request in a structured, machine-readable format.
- Right to withdraw consent: for processing based on consent (cookies, marketing), you may withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
- Right not to be subject to automated decision-making (Article 22): ENROW does not take any decision based solely on automated processing producing legal effects or significantly affecting data subjects. ENROW's algorithms are used exclusively for the search and verification of professional data.
- Right to issue post-mortem instructions (Article 85 Loi Informatique et Libertés): you may issue instructions regarding the retention, deletion and communication of your data after your death.
10. How to Exercise Your Rights
10.1 — Contact Channels
- Online form: the "Exercise of Rights over My Personal Data" form is directly accessible on the website https://enrow.io;
- Email: dpo@enrow.io;
- Post: SCHRUTE FARMS / ENROW — DPO — 123 Rue De Rome, 75017 Paris, France.
10.2 — Processing Procedure
Upon receipt of a rights exercise request, ENROW shall apply the following procedure:
- Step 1 — Receipt and verification: ENROW shall acknowledge receipt of the request and verify the identity of the requester (name, first name, professional email). ENROW may request additional proof of identity where necessary;
- Step 2 — Search: ENROW shall search for the requester's data across all of its systems (enrichment database, cache, Client Data, logs);
- Step 3 — Execution: depending on the nature of the request: provision of a copy of the data (access), correction (rectification), permanent deletion of all data including cache (erasure/objection), or suspension of processing (restriction);
- Step 4 — Placement on the exclusion list: in the event of a deletion or objection request, the individual shall be placed on the permanent exclusion list (blocklist). This ensures that their data will not be collected or processed by ENROW in the future, even if it reappears in public sources;
- Step 5 — Confirmation: ENROW shall confirm execution of the request by email to the data subject.
Timeframe: twenty-four (24) business hours from receipt of the complete request. This timeframe is shorter than the statutory one-month period provided for in Article 12(3) of the GDPR.
11. How Do We Protect Your Data?
ENROW implements technical and organisational measures in accordance with Article 32 of the GDPR, appropriate to the nature, scope and risks of the processing:
- Encryption: data at rest encrypted using AES-256. Data in transit protected by TLS 1.2 or higher. Passwords hashed via bcrypt with individual salting;
- Access control: multi-factor authentication (MFA) on all critical access. Production access limited to the two joint managers. RBAC (Role-Based Access Control) model for Service users;
- Network isolation: databases and internal services isolated within an AWS VPC with no public access. Only the application may access them;
- Monitoring: comprehensive action logging (encrypted logs, via SigNoz). Automated alerts in the event of anomalies;
- Backups: automatic daily backups, encrypted, tested and validated;
- Penetration testing: annual penetration test by an independent third-party provider;
- Secure development: systematic code review (pull requests), automated vulnerability detection in dependencies (Dependabot);
- Hosting: exclusively within the European Union (AWS Paris, eu-west-3). AWS holds ISO 27001, SOC 1/2/3 certifications.
Full details of our technical and organisational measures are set out in the DPA (Annex 2). The Information Systems Security Policy and Business Continuity Plan are maintained up to date and available upon request under NDA.
12. What Happens in the Event of a Data Breach?
In the event of a personal data breach likely to result in a risk to your rights and freedoms, ENROW undertakes to:
- Notify the CNIL within seventy-two (72) hours (Article 33 GDPR);
- Inform affected Clients within seventy-two (72) hours;
- Inform you directly where the breach presents a high risk to your rights and freedoms (Article 34 GDPR);
- Document the breach in an internal register and take the necessary corrective measures.
13. Automated Decision-Making and Profiling
ENROW uses proprietary algorithms to search for, infer and verify professional data. These algorithms are used exclusively for the provision of the enrichment Service (finding an email, verifying a telephone number, etc.).
ENROW does not take any decision based solely on automated processing which would produce legal effects or significantly affect data subjects within the meaning of Article 22 of the GDPR. Enrichment data is not used for scoring, profiling for discriminatory purposes, credit scoring, hiring decisions or any other decision having a legal or significant impact on individuals.
14. Minors
The Service is restricted to natural persons aged eighteen (18) years or over acting for professional purposes. ENROW does not knowingly collect data concerning minors. The enrichment database contains only B2B professional data and does not target minors. Should we become aware that data of a minor has been collected, we shall delete it forthwith.
15. Cookies
ENROW uses cookies and similar technologies on its website and within the Service. Full details of the cookies used, their purposes, durations and the means of managing them are set out in our Cookie Policy, accessible on the website https://enrow.io. Your consent is collected via the Cookiebot banner on your first visit and may be changed at any time.
16. Information for California Residents (CCPA/CPRA)
This section provides supplementary information for residents of the State of California (USA), in accordance with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).
16.1 — Categories of Personal Information Collected
During the preceding twelve (12) months, ENROW has collected the following categories of personal information within the meaning of the CCPA:
- Identifiers: name, first name, email address, telephone number, account identifier;
- Professional information: job title, company name, sector;
- Internet or online activity data: website browsing history, IP address, session data;
- Commercial information: subscription history, Credits used.
16.2 — Sale and Sharing
ENROW does not "sell" or "share" the personal information of California residents within the meaning of the CCPA/CPRA. ENROW does not disclose personal information to third parties in exchange for monetary consideration, nor does it share personal information for cross-site behavioural advertising purposes without consent.
16.3 — ENROW's Qualification
ENROW acts as a "service provider" within the meaning of the CCPA/CPRA in respect of processing carried out on behalf of its clients. ENROW shall retain, use and disclose personal information only within the strict scope of providing the Service.
16.4 — Rights of California Residents
California residents have the following rights:
- Right to Know: obtain the categories and specific elements of personal information collected, the sources, purposes and categories of third parties with whom it has been shared;
- Right to Delete: request the deletion of personal information collected;
- Right to Correct: request the correction of inaccurate personal information;
- Right to Opt-Out: object to the sale or sharing of personal information (not applicable as ENROW does not sell or share data);
- Right to Non-Discrimination: ENROW does not discriminate against individuals exercising their rights under the CCPA/CPRA.
To exercise these rights: "Exercise of Rights over My Personal Data" form on the ENROW website or email to dpo@enrow.io.
17. International Compliance
This policy applies within the framework of the following regulations, depending on your location:
- European Union: Regulation (EU) 2016/679 (GDPR) and Loi n°78-17 of 6 January 1978, as amended (Loi Informatique et Libertés);
- United Kingdom: UK GDPR (European Union (Withdrawal) Act 2018) and Data Protection Act 2018;
- Switzerland: the new Swiss Federal Act on Data Protection (nFADP), in force since 1 September 2023;
- California (USA): CCPA as amended by the CPRA (see section 16 above).
References to the GDPR in this policy shall be deemed to include the equivalent provisions of the above regulations, to the extent that they are applicable.
18. Amendments to This Policy
ENROW reserves the right to amend this policy at any time to reflect changes in its practices or applicable regulations. The date of last update is indicated at the top of this document.
In the event of a material amendment affecting the manner in which your data is processed, ENROW shall notify you by email or via the Service no fewer than thirty (30) days prior to the new version coming into effect. Continued use of the Service after notification shall constitute acceptance. For individuals whose data is held in the enrichment database, the updated policy shall be published on the website.
19. Contact
For any enquiry relating to this policy, the protection of your data, or to exercise your rights:
- Data Protection Officer: Louis CONGARD
- Email: dpo@enrow.io
- Postal address: SCHRUTE FARMS / ENROW — DPO — 123 Rue De Rome, 75017 Paris, France