Privacy Policy

Last Updated: [April, 1, 2026] | Version: 3.0

MediumAxis LLC. (“we,” “us,” or “our”) operates https://mediumaxis.com and provides B2B intelligence, lead generation, and SaaS services. This Privacy Policy explains how we collect, use, and protect information about website visitors, customers, and the business contacts included in our data products.

💡 Quick Navigation:
Website Visitors •
Our Data Products •
B2B Services (DPA) •
Your Rights •
Contact

1. Information We Collect from Website Visitors

When you visit our Site, we collect limited information to operate, secure, and improve your experience:

1.1 Automatically Collected Information

• Technical Data: IP address, browser type, device information, pages viewed, time spent on Site
• Usage Data: Click patterns, navigation paths, feature interactions (via analytics tools)
• Cookies & Similar Technologies: See Section 4 for details

1.2 Information You Voluntarily Provide

• Contact Forms: Name, email, company, message content when you reach out
• Account Registration: Business email, password, company details when you sign up for services
• Support Requests: Additional details you share when contacting our team

1.3 Lawful Basis for Processing (GDPR)

For website visitor data, we rely on:

• Legitimate Interest: To operate, secure, and improve our Site and services
• Consent: For non-essential cookies and marketing communications (where required)
• Contract: To fulfill requests when you contact us or sign up for services

2. Our B2B Data Products: What We Provide & How We Source It

⚠️ Important Distinction: The business contact data we sell or license as part of our products is not collected from our website visitors. It is compiled from public, licensed, and verified sources as described below.

2.1 Types of Data in Our Products

Our B2B intelligence datasets may include:

• Business email addresses (e.g., [email protected])
• First and last names of business professionals
• Job titles, departments, and seniority levels
• Company names, industries, sizes, and locations
• Business phone numbers and professional social profiles
• Firmographic and technographic signals (e.g., company tech stack)

2.2 How We Source & Verify This Data

We use a multi-layered approach to ensure accuracy and compliance:

🔗 Transparency: View our current list of authorized subprocessors and data sources at /data-processing-agreement/#subprocessors.

2.3 Lawful Basis for Processing B2B Contact Data (GDPR)

For the business contact data we provide as part of our products, we rely on Legitimate Interest under Article 6(1)(f) GDPR, balanced against individuals’ rights and freedoms. Our legitimate interests include:

• Enabling B2B companies to identify and connect with relevant business professionals
• Supporting sales, marketing, and partnership development in a business context
• Maintaining accurate, up-to-date business intelligence databases

We conduct Legitimate Interest Assessments (LIAs) for our processing activities and provide clear opt-out mechanisms for individuals.

3. When We Act as Your Data Processor (B2B Services)

When you use MediumAxis platform services to upload, manage, enrich, or export your own contact data, we act as your Data Processor under applicable data protection laws.

3.1 What This Means

• You (the Customer) determine the purposes and means of processing this data
• We process it only on your documented instructions to deliver our Services
• We do not use your uploaded data to improve our proprietary datasets unless explicitly agreed

3.2 Governing Document: Data Processing Agreement (DPA)

All Processor-role processing is governed by our Data Processing Agreement, which includes:

• Security measures and technical/organizational safeguards
• Subprocessor authorizations and notification process
• International transfer safeguards (SCCs, UK Addendum)
• Data subject rights assistance and breach notification procedures

📋 Review or Download: MediumAxis Data Processing Agreement & Compliance Framework

4. Automated Processing & AI Disclosure

We use automation, machine learning, and AI-powered tools to enhance data quality, verification, and platform functionality. Here’s how:

4.1 What We Do With AI/Automation

• Data Enrichment: Infer job seniority, company size, or tech stack from public signals
• Verification Engines: Validate email formats, detect role-based addresses, flag outdated contacts
• Analytics & Optimization: Improve Site UX and platform performance using anonymized usage patterns
• Script Generation: Create reporting logic or integration code snippets using internal AI tools

4.2 What We Do NOT Do

• ❌ Feed your raw contact lists into public LLM APIs (OpenAI, Anthropic, etc.)
• ❌ Use Customer-uploaded data to train foundational AI models
• ❌ Store verified contacts in shared training datasets
• ❌ Make solely automated decisions that produce legal or similarly significant effects for individuals

🔐 Your Control: You can opt out of non-essential web-site analytics by rejecting cookies or contact us to discuss custom AI processing constraints for enterprise agreements.

5. Cookies & Tracking Technologies

5.1 Types of Cookies We Use

5.2 Managing Cookies

• Cookie Banner: On first visit, you can accept/reject non-essential cookies
• Browser Settings: Block or delete cookies via your browser preferences
• Industry Opt-Outs:
  AboutAds.info (US) •
  YourOnlineChoices (EU)

⚠️ Disabling cookies may limit Site functionality (e.g., staying logged in, personalized content).

6. Your Data Protection Rights

Your rights depend on your location and the context of our processing. Find your region below:

6.1 All Individuals: Core Rights

Regardless of location, you may contact us to:

• Request access to personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data (subject to legal exceptions)
• Object to processing based on legitimate interest
• Request restriction of processing in certain circumstances
• Request data portability (where technically feasible)

6.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights:

• Right to Know: Request categories/sources of personal information we collect
• Right to Delete: Request deletion of personal information (with exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit Sensitive Data Use: Opt out of certain uses of sensitive personal information
• Right to Non-Discrimination: Not be discriminated against for exercising rights

🚫 “Do Not Sell or Share”: MediumAxis contracts as a “Service Provider” under CCPA/CPRA, meaning we do not “sell” or “share” personal information for cross-context behavioral advertising and process data only per customer instructions. Learn more about our CCPA framework.

6.3 EU/UK Residents (GDPR/UK GDPR)

If you are in the European Economic Area or United Kingdom:

• Right to Withdraw Consent: Where processing is based on consent
• Right to Object to Automated Decision-Making: Request human review of significant automated decisions
• Right to Lodge a Complaint: With your local supervisory authority (e.g., ICO, CNIL, BfDI)

🌍 International Transfers: Where your data is transferred outside the EU/UK, we rely on Standard Contractual Clauses or other approved safeguards. View SCCs resources.

6.4 Canadian Residents (PIPEDA)

If you are in Canada:

• Right to Access: Request confirmation of whether we hold your personal information and access to it
• Right to Challenge Accuracy: Request correction of personal information
• Right to Withdraw Consent: Where processing is based on consent (subject to legal/contractual restrictions)

6.5 Thailand Residents (PDPA)

If you are in Thailand:

• Right to Access: Request confirmation of whether we hold your personal information and access to it
• Right to Correction: Request correction of inaccurate or incomplete personal information
• Right to Deletion: Request deletion of personal information where no longer necessary or where consent is withdrawn
• Right to Object: Object to processing based on legitimate interest
• Right to Data Portability: Request transfer of your data in a structured, commonly used format

📬 PDPA Requests: Contact our Data Protection Officer at [email protected]. We respond within 30 days as required by PDPA Section 34.

6.6 How to Exercise Your Rights

1. Submit a Request: Email [email protected] with:
   • Your name and contact information
   • The right(s) you wish to exercise
   • Any relevant details to help us locate your data (e.g., email address in our datasets)
2. Verification: We may request additional information to confirm your identity and authority (to protect against fraudulent requests)
3. Timeline: We respond to verifiable requests within:
   • GDPR/UK GDPR: 30 days (extendable to 60 for complex requests)
   • CCPA/CPRA: 45 days (extendable to 90 with notice)
   • PIPEDA: 30 days (with possible extension)
4. No Fee: We do not charge for exercising rights, unless requests are manifestly unfounded or excessive
5. Appeals: If we deny a request, we will explain why and provide information on how to appeal or contact a supervisory authority

✉️ Start a Request: [email protected]

7. Data Retention & Deletion

7.1 How Long We Keep Data

7.2 How to Request Deletion

To request deletion of your personal

1. Email [email protected] with “Deletion Request” in the subject
2. Specify which data you want deleted (e.g., “my website account,” “my contact record in your B2B database”)
3. We will verify your identity and confirm whether deletion is feasible under applicable law
4. If approved, we will delete or anonymize your data within the timelines noted in Section 6.5

⚠️ Exceptions: We may retain certain data where required by law (e.g., tax records), for legitimate business interests (e.g., fraud prevention), or to establish/defend legal claims.

8. Data Sharing & Disclosure

8.1 Who We Share Data With

• Subprocessors: Trusted vendors who help us deliver services (hosting, email, analytics, verification). View current list
• Customers: When you purchase our data products, we provide business contact data to you under commercial terms (you become the Controller for that data)
• Legal & Safety: If required by law, regulation, legal process, or to protect rights/safety of MediumAxis, users, or the public
• Business Transfers: In connection with a merger, acquisition, or sale of assets (users will be notified of any change in control)

8.2 We Do Not Sell Personal Data (CCPA Clarification)

MediumAxis does not “sell” or “share” personal information as defined by CCPA/CPRA for cross-context behavioral advertising. When we license B2B contact data to customers, it is for legitimate business purposes (sales, marketing, partnership development) under commercial agreements—not for ad targeting. We certify as a Service Provider under CCPA regulations.

9. International Data Transfers

MediumAxis operates globally. Your information may be transferred to and processed in countries other than your own, including the United States, Germany, France, Canada, Singapore, and New Zealand.

Where required by law (e.g., GDPR, UK GDPR), we ensure transfers are protected by appropriate safeguards:

• EU → Non-EU: Standard Contractual Clauses (SCCs) approved by the European Commission
• UK → Non-UK: UK International Data Transfer Addendum or IDTA
• Other Jurisdictions: Adequacy decisions, binding corporate rules, or other approved mechanisms

🌍 Learn More: EU/UK SCCs Resources & Annex

10. Security Measures

We implement technical and organizational measures appropriate to the risk, including:

• Encryption: TLS 1.3 in transit; AES-256 at rest for stored data
• Access Control: Role-based access, MFA for staff, principle of least privilege
• Infrastructure Security: Our infrastructure providers (Hetzner, OVH, Cloudflare) maintain ISO 27001 certification; we implement complementary controls including firewalls and intrusion detection
• Incident Response: Documented playbook; notification to affected parties within 72 hours of confirmed breach
• Employee Training: Annual privacy/security training; confidentiality agreements

🔐 Full Details: Request our complete Technical & Organizational Measures (TOMs) document at [email protected].

11. Children’s Privacy

Our Site and services are not directed to individuals under 16 (or 13 in some jurisdictions). We do not knowingly collect personal information from children. If you believe we have inadvertently collected such data, please contact us immediately for deletion.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or legal requirements.

• Material Changes: We will notify users via email or prominent notice on our Site at least 14 days before effectiveness
• Continued Use: Using our Site or services after changes constitutes acceptance of the updated policy
• Archive: Previous versions are available upon request at [email protected]

13. Contact Us

For questions about this Privacy Policy, to exercise your data rights, or to request compliance documents:

Mailing Address:
MediumAxis LLC.
Mu Ban Siriporn 2, 199/61
Chiang Mai, 50210
Thailand

This Privacy Policy is designed to be clear and accessible. If you need this document in an alternative format (e.g., large print, screen-reader optimized), please contact us.