Privacy notice — Huara Ltd

01 Who we are

Huara Ltd is the controller of the personal data described here. We are registered in England and Wales (company no. 17451672), registered office 7 Middlesex Road, Stockport SK5 8HT. We are registered with the Information Commission, the UK data protection regulator, under registration reference ZC281499. The Information Commission replaced the Information Commissioner’s Office (ICO) on 30 September 2026. Contact: hello@huara.co.uk, or write to us at our registered office.

02 What we do

We contact people at businesses in the UK, Ireland and the US by email, about our own services and about the services of businesses we work for (“clients”). We only email people in their work role, at their work email address. At UK businesses we email only limited companies, PLCs and LLPs: before we email anyone there, we check on the Companies House register that their employer is an active limited company, PLC or LLP. In Ireland we email only incorporated companies. We do not email sole traders or partnerships, and we do not email addresses at common personal email providers such as Gmail or Hotmail.

When we email you for a client, the email names that client and says that Huara sent it on the client’s behalf.

One of our co-founders also comments on public LinkedIn posts by people who run businesses, and sends a small number of one-off LinkedIn messages (no more than 5 a week). An AI tool drafts them, and each one is read, edited and sent by hand. We do not use automated tools on LinkedIn.

03 What data we hold

• Your name, job title and work email address
• Your employer’s name, website, size, industry, location and business phone number
• If you are an officer of your company (for example a director): your name and role as shown on the Companies House register
• Public details from your employer’s website that we use to make our email relevant
• A record of the emails we send you, whether they were delivered or bounced, and any reply you send. We do not use open tracking or link-click tracking
• If we comment on your LinkedIn post or message you on LinkedIn: your name, job title and company as shown on your public LinkedIn profile, the text of your public post and a link to it, what we wrote and when, and any reply. We do not take email addresses or phone numbers from LinkedIn
• If you ask us to stop, or an email to you bounces: your email address, on our suppression list
• If you send us a message through our website form: the details you give us in it, such as your name, email address and message
• If you complain to us: your complaint, our reply and the messages between us

We do not collect special category data (such as health or political views), and we do not knowingly contact anyone under 18.

04 Where we got it

Depending on how we found you, your details come from one or more of these sources:

• Apollo.io (ZenLeads, Inc.), a business contact database: names, job titles, work email addresses and company details. We use it for our own outreach only, not for client campaigns.
• Hunter.io (Hunter Web Services, Inc.), an email-finding service: work email addresses, which Hunter.io finds on public web pages or works out from the address pattern your employer uses.
• Companies House, the UK public register of companies: your employer’s legal form and status, and the names and roles of its officers. This is a publicly accessible source.
• The Financial Conduct Authority’s Financial Services Register: whether your employer is authorised or registered by the FCA. This is a publicly accessible source.
• Your employer’s own public website, read by automated tools. This is a publicly accessible source.
• Google search results, obtained through Serper: used to find your employer’s website and public information about your employer. This is a publicly accessible source.
• LinkedIn: your public profile and public posts, viewed by hand. This is a publicly accessible source.
• You: anything you tell us in a reply, a LinkedIn message, a complaint or our website form.

For client campaigns we use public registers such as Companies House, your employer’s website and Hunter.io. We do not use Apollo.io for client campaigns.

05 Why we use it, and our lawful basis

We use your details to contact you about services that may be relevant to your business: our own lead generation service, or the services of the client we are contacting you for. We also use them to check that your employer is the kind of business we, or our client, want to reach, and to make our message relevant to it.

Our lawful basis is legitimate interests. The legitimate interests we pursue are:

• our interest in finding and winning business customers for Huara; and
• when we contact you for a client, that client’s interest in finding and winning business customers, and our interest in providing that service to it.

We have weighed these interests against your interests in a Legitimate Interests Assessment, available on request. To keep the impact on you low, we contact you only in your work role, send only a short sequence of messages, give you a way to stop in every one, and never contact you again once you ask us to stop.

If you send us a message through our website form, we use your details only to reply to you. Our lawful basis is legitimate interests: our interest in answering people who get in touch.

We keep our suppression list and our complaint records because the law requires us to stop marketing to anyone who objects and to handle complaints. Our lawful basis for those records is legal obligation.

06 Use of AI

We use AI tools to research your employer’s public website, check whether your employer fits the kind of business we or our client want to reach, draft emails and LinkedIn messages, and sort replies. On our own campaigns, AI may also draft and send some answers to replies (for example, to a question about our prices). On client campaigns, nothing is sent in reply to you unless the client has approved the exact text. Every LinkedIn comment and message is read and sent by a person. We do not make any decision about you by automated means that has a legal or similarly significant effect on you.

07 Who we share it with

• Service providers that process data for us: Firecrawl (website research), Anthropic (AI research, drafting and reply sorting), Instantly.ai (email sending), Google Workspace (mailboxes), Notion (CRM), Make.com (automation), Netlify (hosts our website and our clients’ private dashboards, and handles messages sent through our website form), Resend (sends our clients an email when someone replies with interest), Serper (runs our web searches) and Cloudflare (manages our domain names).
• Data sources: Apollo.io and Hunter.io supply business contact details from their own databases, which they control. Apollo.io acts as our service provider only for data we upload to it. To find a work email address, we send Hunter.io a person’s name and their employer’s web address; Hunter.io’s own privacy notice explains how it uses what its users search for.
• Clients: when we contact you for a client, that client can see on a private dashboard your name, job title and employer, the emails we sent you and the status of our outreach (for example, whether you replied), from the time our first email is sent. It never sees your email address or phone number there, and it may use what it sees only to check its campaign. If you opt out, object or ask us to delete your data, we remove you from that view.
• Clients: if you reply to an email sent for a client to ask for a call, to ask for what was offered, to ask a question, or to point us to a colleague, we pass your reply and contact details to that client, including any colleague’s name or email address you give us. The client then uses them under its own privacy notice.
• Complaints: if you complain about an email we sent for a client, we may share your complaint with that client so that each of us can deal with the parts we are responsible for.
• Advisers and authorities: our professional advisers (such as lawyers and accountants), and regulators or others where the law requires it.

We do not sell your data.

08 Transfers outside the UK

Some of our providers are based in the US, and two (Anthropic and Google) contract with us through companies in Ireland. UK law treats EEA countries, including Ireland, as providing adequate protection. Where a provider is certified under the UK Extension to the EU–US Data Privacy Framework, we rely on the UK’s adequacy regulations for the US. For other US providers that receive personal data we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as included in that provider’s terms. You can ask for a copy of the clauses we rely on by writing to hello@huara.co.uk.

09 How long we keep it

• If you don’t reply: deleted 12 months after our last email to you, or 30 days after the client we contacted you for stops working with us, if that is sooner.
• If you reply: kept while we are in touch with you, then deleted 12 months after our last contact with you, or 30 days after the client we contacted you for stops working with us, if that is sooner.
• If we comment on your LinkedIn post or message you on LinkedIn: deleted 12 months after our comment or message if no conversation follows. If we do talk, deleted 12 months after our last contact with you.
• If you message us through our website form: deleted 12 months after our last contact with you.
• If your business becomes our customer: we keep invoices and contract records, which can include your name and work contact details, for 6 years after the end of the financial year they relate to, because company and tax law requires it.
• If you complain to us: we keep your complaint and our handling of it for 6 years after we close it, so we can show how it was dealt with if a legal claim is made in that time.
• If you ask us to stop, or an email to you cannot be delivered: we keep only your email address on our suppression list, indefinitely, so we do not email it again, for ourselves or for any client.

10 Your right to object

You have the right to object to direct marketing at any time. This right is absolute: you do not need to give a reason, it costs nothing, and we must stop.

To object, do any of these:

• click the “Unsubscribe” link at the bottom of any email we send;
• reply “stop” or “no thanks” to any email or LinkedIn message from us; or
• write to hello@huara.co.uk.

When you object, we stop all marketing to you, for ourselves and for every client, and add your email address to our suppression list so we do not contact you again. If you also want us to delete your other details, say so (see section 11).

11 Your other rights

You can ask us for a copy of your data, to correct it, to delete it, or to restrict how we use it. You can also object to any other use we make of your data on the basis of legitimate interests; we will then stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to make or defend a legal claim. To use any of these rights, write to hello@huara.co.uk. We respond within one month.

12 Security

We limit access to your data to the people who need it, use multi-factor authentication on our provider accounts, and use providers that encrypt data in transit and at rest.

13 Complaints

If you are unhappy with how we have used your personal data, please complain to us first. You can:

• email hello@huara.co.uk with the subject “Data complaint”;
• use our online complaint form at https://tally.so/r/perA4P; or
• write to Huara Ltd, 7 Middlesex Road, Stockport, SK5 8HT.

We will acknowledge your complaint within 30 days of receiving it. We will look into it, keep you informed of progress, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commission, the UK data protection regulator (it replaced the Information Commissioner’s Office on 30 September 2026). Its website is ico.org.uk and its helpline is 0303 123 1113. If you are in Ireland, you can also complain to the Data Protection Commission (dataprotection.ie).

14 Changes to this notice

We will update this page if what we do changes, and change the date at the top.

Huara Ltd · Registered in England and Wales, company no. 17451672 · Registered office: 7 Middlesex Road, Stockport, SK5 8HT · Information Commission registration reference ZC281499 · hello@huara.co.uk