Privacy Policy
Sendtrail Oy · Last updated 1 November 2026
1.1Sendtrail Oy (“Sendtrail”, “we”) provides investor outreach software for M&A advisors. This policy explains how we process personal data when we act as the controller.
| Controller | Sendtrail Oy, business ID 3666251-6 |
|---|---|
| Privacy contact | support@sendtrail.io |
2.1This policy covers personal data of:
- visitors to our website;
- prospective customers and other business contacts;
- contact persons and users of our customers;
- job applicants;
- representatives of our partners and suppliers.
2.2Our customers use Sendtrail to manage their own M&A processes. When we process data on a customer’s behalf, such as investor contact lists and emails a customer sends through Sendtrail, the customer is the controller and we act as its processor. Emails that our customers send with Sendtrail leave from the sender’s own mailbox and do not mention Sendtrail. If you have received such an email, the advisor who sent it is responsible for your personal data, so please contact them directly. We will help them respond to your request.
| Category | Examples | Source |
|---|---|---|
| Contact details | Name, title, employer, work email, phone number, professional profile URL | You, your employer, public sources such as company websites and professional networks, and business data providers |
| Customer account data | User account, login details, role, settings, support requests | You or your employer |
| Mailbox connection data | Email address, account name, access tokens (see section 5) | Microsoft, when you connect your mailbox |
| Commercial data | Contracts, orders, invoices, payment details, communications | You and your employer |
| Marketing interaction data | Emails opened, replies, meetings booked, opt-outs, website forms | You and our marketing tools |
| Technical data | IP address, browser and device data, pages visited, cookie identifiers, security logs | Your device and our systems |
| Applicant data | CV, application, references, interview notes | You and referees you name |
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Providing the service and managing customer accounts | Contract, Art. 6(1)(b), or our legitimate interest in serving our customers, Art. 6(1)(f) | For the contract term and, after it ends, for as long as needed to close accounts and handle possible claims |
| Customer support and service communications | Legitimate interest, Art. 6(1)(f) | For the contract term and a reasonable period after it |
| Invoicing and accounting | Legal obligation, Art. 6(1)(c) | For the periods required by accounting legislation |
| B2B marketing and sales prospecting, including outreach sent with Sendtrail itself | Legitimate interest, Art. 6(1)(f) | For as long as you are relevant to our business, or until you opt out. If you opt out, we keep only your email address on a do-not-contact list. |
| Website analytics and non-essential cookies | Consent, Art. 6(1)(a) | As shown in the cookie settings |
| Security, fraud prevention and service logs | Legitimate interest, Art. 6(1)(f) | For as long as needed to protect the service and investigate incidents |
| Recruitment | Steps before a contract, Art. 6(1)(b), and consent for keeping applications for future roles | Until the recruitment ends and the period for possible claims has passed, or longer with your consent |
| Legal claims and compliance | Legal obligation or legitimate interest, Art. 6(1)(c) and (f) | For as long as the matter requires |
4.1We send marketing emails to business contacts only where our offering relates to their professional role. Our messages are sent by named members of our team, and you can opt out at any time simply by replying to the message or contacting us. You can ask for our balancing test for legitimate interest at any time.
5.1When a customer user connects a Microsoft 365 account to Sendtrail, we receive only the permissions the user approves. Depending on the customer’s configuration, these permissions allow us to send emails from the user’s mailbox and, in read mode, to read replies to emails sent through Sendtrail and to display the related email threads. We use this access only to provide these features to the user.
5.2We use data from connected Microsoft 365 accounts only to provide these features. We do not use it for advertising, do not sell it and do not use it to train generalised artificial intelligence models.
5.3Access tokens are stored encrypted. Users can revoke access at any time in their Microsoft account settings or through their organisation’s Microsoft 365 administrator, or by disconnecting the mailbox in Sendtrail. We delete tokens when a mailbox is disconnected or after the customer contract ends.
5.4The content of emails sent through Sendtrail belongs to our customer, and we process it as the customer’s processor (see section 2.2).
6.1We share personal data only as needed for the purposes above, with:
- service providers that process data on our behalf, such as our cloud hosting provider (Google Cloud, EU region), office and email software, marketing and AI tools, website analytics, our accounting firm and payment services;
- authorities, when required by law;
- professional advisers, such as lawyers and auditors, who are bound by confidentiality;
- an acquirer or successor if Sendtrail or its business is merged, acquired or reorganised. Personal data is transferred only when the transaction is completed.
6.2We do not sell personal data.
7.1We primarily store data in the European Union. Some of our service providers may process data outside the European Economic Area, for example in the United States. In those cases we rely on an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework, or on the Commission’s standard contractual clauses together with any necessary supplementary measures. You can request a copy of the relevant safeguards from us.
8.1You have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected;
- have your data erased or its processing restricted, where the law allows;
- receive data you provided to us in a machine-readable format and transfer it to another controller (data portability);
- object to processing based on our legitimate interest. You can object to direct marketing at any time, and we will then stop it;
- withdraw your consent at any time, without affecting processing carried out before the withdrawal.
8.2To exercise your rights, contact us at support@sendtrail.io. We respond within one month. We may need to verify your identity before responding.
8.3You also have the right to lodge a complaint with a supervisory authority. In Finland, this is the Office of the Data Protection Ombudsman (tietosuoja.fi). You may also contact the authority in the EU country where you live or work.
9.1We protect personal data with appropriate technical and organisational measures. These include encryption in transit and at rest, access controls with multi-factor authentication, logging and regular backups.
10.1Our website uses strictly necessary cookies to function. We use analytics and marketing cookies only with your consent, which you can give or withdraw at any time in the cookie settings on our website.
11.1We may update this policy. We publish the current version on our website with its date. Where the law requires, or where a change materially affects how we use data from connected Microsoft 365 accounts, we will notify affected users in advance.