Legal
Privacy Policy
We write to B2B decision-makers, so we know that asking “where did you get my contact details?” is a fair question. Here you’ll find the answer to it, and to every other question about your data, in plain language.
Last updated: October 6, 2026
The essentials in 30 seconds
Who
MagicDust sp. z o.o., the owner of the Cold Unicorn brand. In campaigns we run for clients, the client is the data controller. For anything about your data, write to call@coldunicorn.com.
Where we get data
From you (form, email, conversation) or from public B2B sources such as LinkedIn and company websites.
Why
To respond to your inquiry, to suggest a conversation about working together, and to carry out that work once we start it.
How long
Prospecting data: 60 days at most. Form inquiries: up to 12 months. Contract documents: as long as the law requires.
Want us to stop?
Reply “stop” to our message. We won’t write again, and we’ll delete your data, keeping only your address on a suppression list so we don’t contact you again.
Your rights
Access, rectification, erasure, restriction, objection, and a complaint to the President of the Polish Personal Data Protection Office (UODO).
Got a message from us and don’t want any more?
Reply with one word: stop. You can also write to call@coldunicorn.com. A human reads every reply, so you don’t have to click anything or log in.
Contents
01
Who is responsible for your data
The data controller is MagicDust sp. z o.o., Malownicza 9, 42-261 Łysiec, NIP 5732968488, KRS 0001212370, the owner of the Cold Unicorn brand. In this policy, we refer to ourselves as “we.”
We have not appointed a data protection officer. For all matters relating to your data, write to call@coldunicorn.com.
In campaigns we run on behalf of clients, the client is the controller of your data, and we act as a data processor. See section 06 for details.
02
Who this policy applies to
- people who visit coldunicorn.com,
- people who leave their contact details in a form, write to us, or call us,
- decision-makers we contact ourselves by cold email or on LinkedIn to suggest a conversation about working together,
- contact persons at our clients and partners,
- recipients of campaigns we run on behalf of clients (details in section 6).
03
Why we process data, on what legal basis, and for how long
| Purpose and data | Legal basis | How long |
|---|---|---|
| Responding to an inquiry sent by form, email, or phone, and preparing the consultationbusiness email, phone number, sales team size, description of your goal | legitimate interest, namely responding to your inquiry (Art. 6(1)(f) GDPR); when you ask us to prepare for working together, steps taken at your request before entering into a contract (Art. 6(1)(b)) | up to 12 months from the last contact, if we don’t start working together |
| Our own B2B prospecting: a first message by cold email or on LinkedIn and at most two follow-up messagesfull name, job title, company, business email, LinkedIn profile URL, public information about the company | legitimate interest, namely establishing a business relationship (Art. 6(1)(f) GDPR) | 60 days at most from the first message; if you reply and want to talk, from then on the same as for an inquiry |
| Suppression list after an objection, so we don’t write to you againonly your email address or LinkedIn profile URL | legitimate interest, namely respecting your objection (Art. 6(1)(f) GDPR) | for as long as we send outreach messages |
| Signing and performing client contractsclient contact persons’ data: full name, job title, email, phone number | contract (Art. 6(1)(b) GDPR), and for the client’s employees, legitimate interest, namely smooth cooperation (Art. 6(1)(f)) | for the term of the contract, then until claims become time-barred |
| Accounting and taxesdata from invoices and accounting records | legal obligation (Art. 6(1)(c) GDPR) | 5 years from the end of the year in which the tax payment deadline passed |
| Establishing, exercising, or defending legal claimsdata needed for the specific matter | legitimate interest (Art. 6(1)(f) GDPR) | until claims become time-barred |
| Website operation and securityIP address, browser data, server logs, strictly necessary cookies | legitimate interest, namely a secure, working website (Art. 6(1)(f) GDPR) | logs up to 60 days, cookies according to their settings |
We process the data of people we write to in client campaigns on the client’s instructions. In that case, the client sets the purpose, legal basis, and retention period (more in section 06).
When these periods end, we delete the data or permanently anonymize it.
04
Where we get your data
If we wrote to you first, your data comes from one of these sources:
- from you: via a form, email, phone call, or conversation,
- from publicly available sources: LinkedIn, company websites, and the Polish business registers KRS and CEIDG,
- from B2B contact search tools such as Apollo, Clay, and LinkedIn Sales Navigator. We run a technical check on your email address before we write to you.
We are only interested in business data, meaning your role in the company and your work contact details. We do not collect information about your private life or special categories of data, such as health or beliefs.
05
How we contact you when we write first
We follow a few rules that we prepared together with our law firm:
- the first message is about a challenge in your work and is not a sales offer,
- it is signed by a real person you can look up on LinkedIn,
- right in the first message, we tell you who we are, where we got your contact details, and how to object,
- we send at most two follow-up messages, and we don’t treat no reply as consent to anything more,
- once you reply “stop,” we end contact and delete your data. We keep only your email address or LinkedIn profile URL on a suppression list, so we don’t write to you again.
We send commercial information only after you agree, in a conversation, to receive it, in line with Art. 398 of the Polish Electronic Communications Law (PKE).
We send LinkedIn messages within that platform. LinkedIn Ireland Unlimited Company is responsible for data on the platform itself, under its own privacy policy.
06
Campaigns we run for clients
We run cold email and cold LinkedIn campaigns on behalf of B2B companies. In these campaigns, the client is the controller of your data, meaning the company we write on behalf of, even if we are the ones sending the message. We process the data as a data processor, under a data processing agreement (DPA) and on the client’s documented instructions (Art. 28 GDPR). The tools we use act as sub-processors (list in section 07).
On the client’s behalf, we include a privacy notice in our messages and answer questions about the source of your data and how it is processed. The same rules apply as in our own prospecting: information right in the first message and at most two follow-up messages. We delete the data after 60 days at the latest, and when our work for the client ends, we delete it or return it to the client, as the client decides.
Your objection is addressed to that company, but simply replying “stop” to the message is enough. We will immediately stop sending to you and pass your objection on to the company we wrote on behalf of.
We pass to the client only the data of people who have agreed to it, for example by replying that they want to talk. From then on, the client contacts you directly, based on your consent.
Some clients run their outreach themselves, using our systems. In that case, the client decides whom to write to and what to say, so the client is the controller of the recipients’ data. We provide the client with the tools and process data only to the extent needed for those tools to work, as a data processor (Art. 28 GDPR). In that case, your objection is addressed to that company, but simply replying “stop” to the message is enough. If you write to us instead, we will pass it on to that company too.
07
Who we share data with
We don’t sell data. We share it only with companies that help us operate, and only to the extent needed. In client campaigns, the same tools act as sub-processors approved by the client.
| Tool | Used for | Based in | Transfer basis |
|---|---|---|---|
| EmailBison | sending and handling email messages | Toronto, Canada | European Commission adequacy decision (Canada) |
| Aimfox (SocialGrowth LLC FZ) | LinkedIn campaigns | Dubai, United Arab Emirates; servers in the USA and Serbia | Standard Contractual Clauses (SCCs) |
| LinkedIn Ireland Unlimited Company | LinkedIn platform and Sales Navigator | Dublin, Ireland | no transfer outside the EEA |
| Apollo (ZenLeads Inc.) | B2B contact search and verification | California, USA | EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) |
| Clay (Clay Labs Inc.) | search and enrichment of company and contact data | New York, USA | Standard Contractual Clauses (SCCs) |
| Calendly (Calendly, LLC) | scheduling calls with us | Georgia, USA | EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) |
Data may also go to:
- email and website hosting providers: Cyberfolks and Seohost,
- our accounting firm and law firm,
- public authorities, when the law requires it.
In client campaigns, the data of people who agree to be contacted goes to the client, because the client is the controller of that data.
08
Transfers of data outside the European Economic Area
Some of the tools have their headquarters or servers outside the European Economic Area (EEA). We give the transfer basis for each of them in the table in section 07. It is either a European Commission adequacy decision (Canada, and US companies certified under the EU-US Data Privacy Framework) or Standard Contractual Clauses (SCCs) approved by the Commission (Art. 46 GDPR).
In client campaigns, we transfer data outside the EEA only as instructed by the client as the controller. At your request, we will provide information about the safeguards in place.
09
Your rights
Access
you can find out what data we hold about you and what we do with it (Art. 15 GDPR).
Rectification
we will correct data that is outdated or wrong (Art. 16).
Erasure
we will delete data when there is no longer a basis to keep it (Art. 17).
Restriction
we will pause processing while the matter is being clarified (Art. 18).
Portability
we will hand over the data you gave us when we process it based on a contract or consent (Art. 20).
Objection
to marketing contact is unconditional: once you object, we simply stop (Art. 21).
Consent withdrawal
if we do something based on your consent, you can withdraw it at any time, without affecting what happened before.
Complaint
to the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
We respond without undue delay, and within a week at the latest (Art. 12(3) GDPR). Just email call@coldunicorn.com.
10
Is your data required?
Providing your email and phone number in the form is voluntary, but without them we can’t call you back or schedule a call. To enter into a contract, we need the data required by law, for example for an invoice.
11
Automated decisions and profiling
We select companies and contact persons based on business criteria such as industry, company size, and job title. We do not make decisions about you based solely on automated processing that would produce legal effects (Art. 22 GDPR).
13
How we protect data
Only members of our team who need the data for their work have access to it. Each of them is authorized to process data and bound by confidentiality. The website runs over an encrypted connection, and the domains we send outreach from are separate from our clients’ main domains. If a personal data breach occurs in a client campaign, we notify the client within 48 hours.
14
Changes to this policy
When we change how we process data, we will update this page and the date at the top.