FAQ
Where is my data stored?
All data is hosted in the European Economic Area, on Amazon Web Services servers in Paris (eu-west-3). See the subprocessors page for the services that may process data on our behalf.
Do you sign a Data Processing Agreement?
Yes. Our DPA applies to every customer and covers GDPR Article 28, our security measures and international transfers.
How do I report a security vulnerability?
Email security@enrow.io with a description and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it publicly.
Will I be told when you change subprocessors?
Yes. Customers are notified at least 15 days before a change, and the subprocessors page is kept up to date.
Can we audit Enrow?
Customers can request one audit per year with 30 days' written notice. We can often answer with recent documents instead, such as an independent penetration test report or a completed security questionnaire.
How are data subject requests handled?
Contact our DPO at dpo@enrow.io. When a request concerns data we process for a customer, we inform that customer without undue delay and act on their instructions.
I found my data in Enrow. How do I get it removed?
Use the opt-out form ("Exercise of Rights over My Personal Data"), or email dpo@enrow.io. Once your identity is checked, Enrow deletes your data, including from its cache, within 24 business hours and confirms by email. You are also added to a permanent exclusion list, so your data is not collected again even if it reappears in public sources. Details in the privacy policy.
What is the legal basis for processing professional data?
Enrow's own enrichment database relies on legitimate interest (GDPR Article 6(1)(f)): processing publicly available professional data for B2B prospecting. The balance with people's rights is documented in a Legitimate Interest Assessment (LIA), reviewed at least once a year, which you can request from dpo@enrow.io. For data that customers send for enrichment, Enrow acts as their processor under the DPA.
Where does Enrow's data come from?
From publicly available sources (company websites, professional directories, press), professional social networks, official registers such as trade registers, search engines, specialist data providers bound by GDPR obligations, and Enrow's own search, inference and verification algorithms. Enrow never collects data from data breaches, stolen databases or any other unlawful source. See the privacy policy.
What happens to our data if we cancel?
You keep access until the end of the current billing period. You then have 30 days to export your data in CSV or JSON, from the app, through the API or by asking support@enrow.io. After that, all your client data, including copies and backups, is permanently deleted within a further 30 days, and you can request a written certificate of deletion. Enriched data already exported to your own systems can still be used for B2B prospecting, under your responsibility. See the terms and the DPA.