Last updated 23 October 2026
Summary
Outrun is a trading name of PRWN LTD (company number 16554885). Outrun sends business-to-business sales teams a short weekday list of companies that show a public buying signal, such as a funding round, a hiring push or a public post, together with a suggested business contact at that company. This assessment covers that processing of people’s business contact data. It follows the three-part test the ICO recommends: purpose, necessity and balancing.
Conclusion: the processing can rely on legitimate interests (Article 6(1)(f) UK GDPR), provided the safeguards below stay in place. We review this assessment at least once a year and whenever we add a new data source or a new use.
What we process and where it comes from
- Company signals: public funding news (publisher RSS feeds), SEC Form D filings (EDGAR), public job posts from Greenhouse, Lever and Ashby job boards, job and company data from TheirStack and PredictLeads, public Reddit threads, public posts on X, and our own manual research of public sources. Some sources (Companies House and UK public tender notices) are switched off at the moment but records gathered earlier remain.
- Contact data: name, job title, employer, work email address, and where available a work phone number and a LinkedIn profile URL, supplied by a licensed business contact data provider (Prospeo). Email addresses are checked with an email verification service (MillionVerifier) before they are shown.
- Drafting: the public signal and the contact’s role are sent to an AI model provider (Anthropic) to draft a short suggested opening line. The model provider processes it on our behalf and, under its commercial terms, does not use it to train its models.
- Delivery: digests reach customers by email (SendGrid), Slack, Telegram, Gmail or Outlook, or inside the Outrun app. Data is stored in Supabase (London region) and the website and app are hosted by Vercel.
- We do not collect special category data, personal email addresses or home addresses, and we do not scrape LinkedIn.
1. Purpose test
- Our interest: running a lawful commercial service that helps businesses find other businesses that may need what they sell, at a moment when the need is visible from public information.
- Our customers’ interest: reaching the right person at a relevant business with a relevant message, instead of sending untargeted mass outreach.
- Wider benefit: better-targeted business outreach means fewer irrelevant messages for everyone else. Recital 47 UK GDPR recognises that direct marketing may be carried out for a legitimate interest.
- The interest is specific, real and current, and it is lawful.
2. Necessity test
- A company-level signal alone is not enough for a sales team to act: they need to know which role is responsible. A named business contact with a work email is the minimum that makes the service useful.
- We use the least data that works: a small number of contacts per company, business fields only, and the public source link so the customer can check the context.
- Less intrusive options were considered. Company-only alerts were considered, but they leave customers to find the right person themselves, which tends to produce less accurate and less targeted outreach. Asking every contact for consent first is not practical, because we have no prior contact with them and the request would itself be unsolicited outreach.
- We limit volume: each customer gets a small daily list matched to their ideal customer profile, not bulk exports of contact databases.
3. Balancing test
Nature of the data. Business contact details and public professional information only. This is low-sensitivity data that people in these roles generally expect to be used to contact them about their work.
Reasonable expectations. The contacts work in business roles (often founders, heads of department or buyers) at companies that have just made a public announcement, posted jobs or posted publicly. People in such roles can reasonably expect business approaches relevant to their role. They would not expect personal data to be used outside a business context, and we do not do that.
Possible impact. The main impact is receiving an unsolicited business email or call from one of our customers. The risk of serious harm is low. People may still find unwanted outreach annoying, and they may not know Outrun holds their details. Those are the points the safeguards address.
Vulnerable people and children. Not targeted. Outrun covers working adults in business roles only.
Safeguards
- Easy objection: anyone can ask to be removed at outrun.so/remove or by email to hello@outrun.so. Removal deletes their contact record and adds a one-way hash of their address to a suppression list so they are not included again.
- Transparency: our privacy notice explains the processing to people who appear in digests, lists our subprocessors, and publishes this assessment.
- Minimisation: business fields only, a small number of contacts per company, no special category data and no personal email addresses.
- Accuracy: addresses are verified before display, every lead links to its public source, and out-of-date records are reviewed and deleted.
- Customer obligations: our terms require customers to use leads lawfully, including PECR rules on electronic marketing, to identify themselves, and to honour opt-outs. Customers become independent controllers of any data they use to contact people.
- Security: encrypted connections, access controls and least-privilege access to production systems, with processors under written contracts.
- Retention: digest contact data is kept only as long as needed to provide digests. Objections are actioned immediately.
Conclusion and review
Taking the purpose, the necessity of the data and the safeguards together, we consider that our legitimate interests, and those of our customers, are not overridden by the interests or rights of the people concerned. We will review this assessment by October 2027, or sooner if we add a new data source, a new kind of personal data or a new use.
Questions about this assessment: hello@outrun.so.