Prospect Privacy Notice (Indirect Collection)

Last updated: July 2026

0. How to read this notice / Como ler este aviso / Cómo leer este aviso

This notice explains how 8x handles the personal data of business prospects — people we contact by phone or email about our products and services, who did not sign up with us. You are receiving or reading this notice because we obtained your business contact details from a third-party or public source (see Section 3) and contacted you, or because a call disclosure or outreach email pointed you here.

Languages:

• A Brazilian Portuguese (PT-BR) version governs for prospects in Brazil.
• A Mexican Spanish (ES-MX) aviso de privacidad governs for prospects in Mexico.
• For prospects in India, an India-specific DPDP itemized notice applies (see Section 12). Important: in India a notice is not a substitute for consent; 8x is aligning its India (+91) outreach to a consent-first approach (see the India note in Section 12).
• For all other prospects, the English / applicable-locale version applies.

This notice is published at https://8x.sale/legal/privacy-prospects, the URL referenced in our call disclosures and in every outreach email.

1. Who we are (controller identity and role)

The data controller is 8x Social, Inc., a Delaware corporation ("8x", "we", "us"), with registered address at 1111B S Governors Ave STE 47647, Dover, DE 19904, United States.

Our role. For both the contact data and the call data described in this notice, 8x acts as the data controller (in LGPD terms, the controlador; in Mexican terms, the responsable; in DPDP terms, the Data Fiduciary). We decide why and how your personal data is processed. We are not processing your data on behalf of any customer.

Where we operate. 8x is a US (Delaware) company. The United States is our home jurisdiction. Brazil, Mexico, and India are markets we serve. The European Union / United Kingdom ARE in scope — see Section 11. GDPR and the ePrivacy Directive apply, and the additional EU/UK terms in Section 11 (including the appointment of an Article 27 EU representative, and a UK representative if the UK is in scope) apply.

Governing law. Delaware, United States, without prejudice to the mandatory data-protection laws of the jurisdiction where you are located (Brazil — LGPD; Mexico — the Federal Law on Protection of Personal Data Held by Private Parties; India — DPDP Act 2023; and, if applicable, EU/UK GDPR).

2. How to contact us about your data

To stop hearing from us immediately, use the opt-out / suppression routes in Section 9.

3. Where we got your data and the category of source (indirect collection)

We did not collect your personal data directly from you. We obtained it indirectly. This section is provided to satisfy LGPD Art. 9, GDPR Art. 14 (where applicable), and the DPDP notice requirements.

• Categories of source: publicly available business sources (company websites, public business directories), professional networking profiles (e.g., public LinkedIn profiles), and third-party B2B lead/data providers. See sub-processors.md and any data-provider list for the specific suppliers.
• What we got from the source: typically your business name, the company you work for, a business phone number and/or business email address, your country, a link to a professional profile, and basic firmographic information about your company.
• We do not knowingly source or process special-category / sensitive data about you for prospecting (see Section 4).

We record the source of each prospect record and will disclose the specific source on request, as part of your access right (Section 8).

4. Categories of personal data we hold

Depending on the interaction, we may hold the following categories of personal data about you:

Contact and firmographic data (obtained indirectly per Section 3):

• Name
• Company / employer
• Business phone number
• Business email address
• Professional profile link (e.g., LinkedIn)
• Country
• Firmographic information about your company (e.g., industry, category, company website, size indicators)

Data we generate when our sales representatives contact you:

• Free-text notes written by our representatives about the interaction
• Voice recordings of cold calls (where we have provided the recording disclosure — see Section 6 and the in-call disclosure)
• AI-generated transcripts of those calls (machine transcription)
• AI-generated evaluations / scores of the call (an automated assessment of the sales interaction — see Section 7)

A bare voice recording is treated as ordinary (non-sensitive) personal data. 8x does not create biometric voice-identification ("voiceprint") data, and does not process your voice as sensitive/special-category data.

5. Why we use your data (purposes)

We process your personal data for the following purposes:

1. Business-to-business (B2B) prospecting and outreach — to contact you by phone and/or email to introduce, and assess your potential interest in, products and services, and to schedule meetings.
2. Operating and recording calls — to place calls, and to record them where disclosed, for the purposes below.
3. AI transcription and AI evaluation of calls — we use automated speech-to-text to transcribe calls and an AI model to evaluate the sales interaction. This AI evaluation determines whether an outreach resulted in a qualified meeting and is used to calculate what our sales representatives are paid. This is an automated decision affecting our representatives; for how it may concern you and your rights, see Section 7.
4. Scheduling — if you agree to a meeting, to book and manage that meeting.
5. Record-keeping, quality, training, and compliance — to maintain records of outreach, train and supervise our representatives, demonstrate compliance (including consent/opt-out records), and handle disputes, complaints, and legal obligations.
6. Security and abuse prevention — to protect our systems and prevent misuse.

We will not use your data for purposes incompatible with the above without providing a further notice or, where required, obtaining your consent.

6. Legal basis for processing (by region)

Our legal basis depends on where you are located.

Brazil (LGPD)

• B2B prospecting: legitimate interest (legítimo interesse), LGPD Art. 7, IX and Art. 10. We maintain a documented Legitimate Interest Assessment (LIA) balancing our interest in B2B outreach against your rights. See the LIA in internal-compliance-artifacts.md.
• Voice recording / AI evaluation: processed under the same legitimate-interest basis as ordinary data, subject to the recording disclosure and your unconditional right to object to direct marketing (Section 9). Sensitive data is not processed on this basis (and we do not create biometric voice-ID; see Section 4).
• Consumer-protection overlay (CDC): our outreach identifies the sender, and we honor opt-out requests.
• Do-not-call: we honor applicable state Procon "Não Me Ligue" do-not-call registries (e.g., São Paulo Law 13.226/2008, as amended).

Mexico

• We provide this notice as our aviso de privacidad under the Federal Law on Protection of Personal Data Held by Private Parties (published 20-Mar-2025, in force 21-Mar-2025). For ordinary data, consent is, by default, tacit (opt-out) — you may object at any time using Section 9.
• Transfers disclosed: under Art. 35, we disclose that your data is transferred to third parties (sub-processors) located in the United States. See Sections 8 and 10.
• Do-not-call: we honor the Registro Público para Evitar Publicidad (REPEP) under the Federal Consumer Protection Law (LFPC), Art. 18 Bis; we scrub against REPEP and apply suppression.

India (DPDP Act 2023)

• See Section 12. In India we cannot rely on a "legitimate interest" basis for cold outreach, and a notice is not a substitute for consent. 8x is aligning its India (+91) outreach to a consent-first approach and honors all opt-out and do-not-contact requests; India activity is subject to Indian-counsel review before scaling.

United States

• We rely on our legitimate business interest in B2B prospecting, consistent with applicable US law. We do not sell or share your personal data for cross-context behavioral advertising. A direct CCPA notice-at-collection to prospects is excused under 11 CCR 7012(h) because we neither sell nor share, but this public notice covers our handling of prospect data. See Section 8 for your US rights.
• Call recording: we adopt all-party consent as our baseline (the conservative posture across US states, including California Penal Code §§ 632 and 632.7), implemented via the in-call recording disclosure.

European Union / United Kingdom

• See Section 11. EU/UK IS in scope — GDPR and the ePrivacy Directive apply. Electronic/automated direct marketing requires prior consent under the ePrivacy Directive Art. 13 (a legitimate-interest assessment does not clear marketing email or automated calls).

7. Automated processing and AI evaluation — your rights

We use AI to transcribe calls and to evaluate the sales interaction. The AI evaluation scores the call against a defined seven-dimension rubric (discovery, objection handling, pricing discipline, proof specificity, next-step clarity, authenticity & listening, and tone & professionalism), together with conduct/compliance flags.

What it decides. This evaluation drives whether an outreach is treated as a qualified meeting and is used to determine our representatives' pay. It is a solely or significantly automated decision affecting our representatives.

As a prospect, you can:

• Object to this automated processing where it evaluates aspects relating to you (e.g., your behavior or responses on the call), particularly where it could produce undesired effects, and
• request human review of, and information about, the automated processing as it concerns you.

We provide a human-review / contest route for any pay-affecting evaluation (this is primarily a representative-facing right but is extended to prospects who object). To exercise these rights, contact us per Section 2.

Mexico specifically recognizes a right to object to solely-automated processing producing undesired effects that evaluates behavior/performance — this is engaged by our evaluation. In the EU/UK (in scope), Art. 22 GDPR grants rights to human intervention, to contest, and to meaningful information (see Section 11).

8. Who receives your data (recipients / sub-processors)

We share your personal data with service providers ("sub-processors") who help us operate. The full, current list — including each provider's role and processing region — is maintained in sub-processors.md. As of this draft they include:

We may also disclose data where required by law, to enforce our rights, or in connection with a corporate transaction, subject to applicable law.

9. Your right to object to marketing and to opt out / be suppressed

You have an unconditional right to object to direct marketing. If you tell us to stop, we will stop contacting you for marketing purposes and add you to our suppression list. You can do this:

1. By email: send a request to privacy@8x.social (subject: "Opt out / suppression"); or
2. During a call: tell the representative you do not wish to be contacted — your objection is recorded and honored; or
3. By the unsubscribe link / instructions in any outreach email.

What happens when you opt out: we suppress your contact details from further outreach. We honor opt-outs everywhere as a matter of policy (including in jurisdictions without a B2B carve-out), and we apply applicable do-not-call registries (Brazil state Procon "Não Me Ligue"; Mexico REPEP with a 30-day suppression cycle; US internal do-not-call). For email, we honor opt-outs consistent with CAN-SPAM (within 10 business days; we aim to act faster).

For outreach email, this promise is fulfilled technically by a suppression list: every outreach email carries a one-click unsubscribe link (and List-Unsubscribe header), and clicking it adds your email address to our suppression list immediately. Before any outreach email is sent, we check that list and will not email an address on it. This suppression record is retained for as long as needed to keep honoring your request — including if we otherwise delete your data on request, your suppression entry is kept (with your address no longer linked to any other record) so we do not accidentally contact you again.

We retain a minimal record that you opted out, solely to ensure we continue to honor your request.

10. International transfers

8x is based in the United States, and several of our sub-processors are in the United States (see Section 8). This means your personal data is transferred to, and processed in, the United States and potentially other countries.

We rely on the following transfer mechanisms:

• Brazil → US: the ANPD Standard Contractual Clauses (Resolution CD/ANPD 19/2024), which 8x is putting in place with its US recipients.
• EU/UK → US (EU/UK is in scope — see Section 11): the EU Standard Contractual Clauses (Module 2) plus a documented Transfer Impact Assessment (TIA). We default to SCCs + TIA; the EU-US Data Privacy Framework is treated as unstable pending the Latombe appeal and is not relied on alone.
• Mexico → US: transfers to US sub-processors are disclosed in this aviso under Art. 35.
• India → US: transfers are subject to DPDP transfer requirements. The lawful-basis position for India cold outreach is addressed separately in Section 12.

You may request information about the safeguards applicable to transfers of your data by contacting us per Section 2.

11. EU / UK prospects

EU/UK IS in scope — GDPR and the ePrivacy Directive apply. 8x accepts the extraterritorial reach of GDPR Art. 3(2); there is no EU-exclusion gate. The following obligations are in force:

• Marketing basis: electronic and automated direct marketing requires prior consent under ePrivacy Directive Art. 13 (lex specialis); a legitimate-interest assessment does not clear marketing email or automated/recorded calls.
• Representative: where required, 8x will make an Art. 27 EU representative (and a UK representative if the UK is in scope) available; you can reach our privacy contact at privacy@8x.social.
• Transfers: SCCs Module 2 + a documented TIA (see Section 10); the EU-US Data Privacy Framework is treated as unstable pending the Latombe appeal, so 8x defaults to SCCs + TIA.
• DPIA: a Data Protection Impact Assessment is required (multiple high-risk criteria stack: cold outreach, voice recording, AI evaluation, profiling).
• Automated decisions: Art. 22 grants you rights to human intervention, to contest the decision, and to meaningful information about the logic involved (see Section 7).

12. India prospects (DPDP Act 2023 + DPDP Rules 2025) — itemized notice

⚠️ INDIA NOTICE. Under the DPDP Act 2023 and the DPDP Rules 2025 (notified 13 Nov 2025; substantive obligations phasing to approximately 13 May 2027), there is no "legitimate interest" basis for cold outreach in India, and consent is generally required. This notice is not a substitute for consent. 8x is aligning its India (+91) outreach to a consent-first approach, honors all opt-out and do-not-contact requests, and treats India activity as subject to Indian-counsel review before scaling. The itemized notice below is provided for transparency.

Itemized DPDP notice:

• Data Fiduciary: 8x Social, Inc., a Delaware corporation (Section 1).
• Personal data processed: the categories in Section 4.
• Purposes: the purposes in Section 5.
• How to exercise your rights: access, correction, completion, updating, erasure, grievance redressal, and nomination — contact our Privacy Team / privacy@8x.social (Section 2).
• How to withdraw consent: you can withdraw consent at any time — as easily as it was given — by contacting privacy@8x.social or using the opt-out routes in Section 9.
• How to complain: to the Data Protection Board of India (Section 13), in addition to our grievance contact.
• Telemarketing: any telephone outreach is also subject to TRAI TCCCPR Second Amendment Regulations 2025 (140-series promotional / 1600-series transactional numbering).

13. Your rights and how to complain

Subject to your local law, you have rights to:

• Access the personal data we hold about you (and information about its source — Section 3);
• Correct / complete / update inaccurate or incomplete data;
• Delete / erase your data;
• Object to processing, including the unconditional right to object to direct marketing (Section 9);
• Object to / request human review of automated decisions (Section 7);
• Data portability, where applicable;
• Withdraw consent, where processing is based on consent (e.g., India);
• Information about international transfers (Section 10);
• (Brazil/LGPD) other rights under Art. 18.

How to exercise: contact us per Section 2. Response times: Brazil — within 15 days (LGPD Art. 19); other jurisdictions — within the statutory period, and otherwise without undue delay.

Supervisory authorities / regulators — you may complain to:

• Brazil: Autoridade Nacional de Proteção de Dados (ANPD).
• Mexico: the Secretaría Anticorrupción y Buen Gobierno (data-protection enforcement following the abolition of INAI); and PROFECO for consumer/telemarketing (REPEP) matters.
• India: the Data Protection Board of India.
• EU/UK (in scope): your national data protection authority / the UK ICO.
• United States: the relevant state Attorney General and/or the California Privacy Protection Agency, as applicable.

14. Data retention

We keep personal data only as long as needed for the purposes above, then delete or anonymize it. Our retention windows:

15. Cookies and tracking (website)

Our website uses first-party essential and functional cookies (e.g., authentication session, display-locale preference, and limited internal-tooling cookies), and — only if you accept through our cookie banner — analytics (PostHog product analytics and Google Analytics). We do not use advertising or cross-site marketing trackers. For full detail, see cookie-notice.md.

16. Changes to this notice

We may update this notice. The current version and its date appear at the top. Material changes will be reflected at the published URL (Section 0).

Cross-references: see sub-processors.md (recipients and regions), internal-compliance-artifacts.md (Brazil/EU LI basis + roles & contacts roster), cookie-notice.md (cookies), and call-recording-disclosures.md (the call-disclosure scripts that link to this notice).