Privacy Policy

Marwin (“Marwin”, “we”, “us”) is an invite-only, multi-tenant business platform operated from the United Kingdom. It provides website building, business-lead research, customer relationship management, content and billing tools to its agency partners (“Partners”). For the personal data described in this policy, Marwin acts as a data controller unless stated otherwise.

Questions, requests or complaints about personal data can be sent to gregbizops@gmail.com.

We process three broad categories of personal data:

• Partner account data, name, email address, sign-in credentials, billing records and support correspondence for the Partners who use the platform.
• Partner-supplied client data, contact and business details Partners store about their own clients in the platform’s CRM tools. For this data the Partner is the controller and Marwin is a processor acting on their instructions.
• Business-lead data, information about businesses and the people who run them, compiled to help Partners contact those businesses in a professional capacity: business name, address, website, phone number, publicly listed email addresses, and the name, role and business contact details of directors, owners or other decision-makers.

• Public registers, including the Companies House public register (company details, officers and persons with significant control), which is made public under the Companies Act 2006 and used here to identify the registered owner or director of a specific business in their business capacity.
• Publicly available sources, business websites, public business listings and public social-media business pages.
• Licensed business-data providers, third-party B2B data services that supply and verify professional contact details.

We only compile lead data about businesses; we look up the people behind a business solely so a Partner can contact them about that business, at business contact details.

• Running the platform (accounts, billing, support), performance of a contract, and legal obligation for tax and accounting records.
• Business-lead research, our and our Partners’ legitimate interests in enabling relevant business-to-business contact. We limit this to business-capacity information, exclude anything a business has clearly asked not to be used, and honour objections (see section 8).
• Service improvement and security, legitimate interests in keeping the platform reliable, accurate and safe.

We share personal data only with service providers that help us run the platform, under contract:

• hosting and infrastructure providers (application hosting, database, background processing);
• payment processing (Stripe) for Partner billing;
• licensed business-data and email-verification providers, when validating a business contact;
• AI model providers, which process text content to power platform features and are not permitted to use it to train their models.

Some providers process data outside the UK. Where they do, transfers rely on adequacy regulations or standard contractual clauses. We do not sell personal data.

• Partner account data, for the life of the account and as required afterwards for legal and accounting purposes.
• Business-lead data, while it remains relevant and accurate; cached third-party lookups are kept for up to 30 days.
• Partner-supplied client data, until the Partner deletes it or their account closes.

Data is encrypted in transit, access is restricted by role and by tenant, API credentials are stored outside source code, and we apply rate limits and monitoring to all automated processing. No system is perfectly secure, but we design for least access and fail-safe behaviour.

Under UK GDPR you can ask us for access to, correction or erasure of your personal data, ask us to restrict processing, and object at any time to processing for direct marketing purposes, if you object, we suppress your details from future lead results. To exercise any right, email gregbizops@gmail.com; we respond within one month.

You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

Our public pages use only essential cookies. The signed-in application uses cookies strictly for authentication and session security.

We will update this page when our processing changes and revise the date at the top. Material changes affecting Partners are notified in-platform.