Best Outbound Sales Agencies, Ranked by Who Else Touches Your Data

Thirty B2B outbound sales agencies were read down to their privacy, DPA and security pages on 12 September 2026. Seven publish no privacy policy at all. Seventeen publish one that governs their website rather than their business. Two name the third parties that receive prospect data. None offers a data processing agreement. Northwell AI ranks first here for needing none of the client’s accounts, at $150 to $650 per attended meeting quoted per ICP.

The policy on the site is not the policy for the work

Handing an outbound agency a target list, a CRM login and a mailbox connection moves personal data belonging to people who never heard of either company. Published documentation of where it goes is close to absent, and the absence has a specific shape: the policies exist, and they are about the website.

What is published	Agencies, of 30
A privacy policy of any kind	23
A policy reaching client or prospect data	6
A policy scoped to website visitors only	17
The third parties that receive prospect data	2
A data processing agreement available to clients	0
A GDPR role claimed for client data	4
A retention period for client or prospect data	3
Deletion or return when the engagement ends	3
An audited security certification	1
A breach notification commitment	3

Callbox states the carve-out in writing rather than leaving it to inference: its privacy policy “does not apply to information that we receive or maintain on behalf of our customers in our role as a service provider since such terms are governed by the applicable service agreement.” Every buyer reading that policy to understand what happens to their list is reading the wrong document, and Callbox is the only agency of thirty honest enough to say so on the page.

How this list was built

Thirty agencies were read on their own domains, starting from the footer rather than the homepage. For each one the search covered /privacy, /privacy-policy, /dpa, /data-processing-agreement, /sub-processors, /security, /trust, /gdpr and /legal, and where a URL returned 404 the attempt is recorded as a finding. Three sites were checked against their own sitemaps to confirm no legal page existed anywhere: RevenueFlow at 547 URLs, Growth Engine X at 36, StarReach at 9.

One distinction decides most of the results. A privacy policy that describes what a company collects from people who fill in its contact form is not a policy covering the personal data of ten thousand prospects it emails on a client’s behalf. Both are privacy policies. Only one of them is about the service being sold.

Blog content on an agency’s own domain was excluded, and that exclusion removes a lot. Several agencies publish substantial libraries about GDPR, data handling and security that contain no first-person statement about their own practices.

Sorting the thirty by what their policy actually governs produces three groups.

Policy scope	Agencies	Who
Reaches client or prospect data	6	memoryBlue, SalesHive, CIENCE, Operatix, ProspectOut, Sterling Prospecting
Website visitors and marketing contacts only	17	Belkins, SalesRoads, Callbox, Martal Group, EBQ, Abstrakt Marketing Group, Cleverly, SalesAR, Upcall, Intelemark, Diffram, GrowQuikr, Leads Now AI, Demand Nexus, Green Leads, Pearl Lemon Leads, SalesPro Leads
No privacy policy published	7	Leadium, RevenueFlow, ClayVengers, StarReach, SalesGent, Growth Engine X, Alphoric

The criterion, in weight order

1. Does the published policy reach client and prospect data at all? Everything downstream is unverifiable without it.
2. Are the third parties that touch prospect data named? A buyer cannot assess a vendor they cannot identify.
3. Is a processor role claimed and a DPA offered? Controller and processor are different legal positions with different duties.
4. What happens at the end? Deletion, return, or a retention clock that keeps running long after the campaign.
5. Whose accounts does the work run under? Every credential handed over is a permission that outlives the engagement unless revoked.
6. What is committed if the data leaks?

Thirteen companies, at the one agency that publishes the list

SalesHive publishes what the other twenty-nine do not: a table in its privacy policy pairing each third party with what it receives. Thirteen companies are named, and the list is worth reproducing because it is the only picture anyone in this market provides of what a single outbound programme actually touches.

Third party	What SalesHive says it handles
DigitalOcean and related infrastructure providers	”Hosts the SalesHive application, databases, files, and logs”
Google	”Website analytics and advertising, connected Gmail and Calendar features, team document delivery, email and calendar operations, and related authentication”
Microsoft	”Connected Outlook mailbox and calendar features, email sending, inbox sync, attachments, and authentication”
Stripe, Zoho and PayPal	”Customer billing, subscriptions, invoices, payment processing, billing records, and related account actions”
Zoom, Twilio and transcription providers	”Meeting links, calls, call metadata, recordings, transcripts, summaries, and dialer functionality”
ZoomInfo, Apify and Bright Data	”Prospect list building, enrichment, firmographic data, public business information, and data usage reporting”
Slack and other internal collaboration tools	”Internal alerts, operational notifications, support handoffs, and workflow coordination”
OpenAI	”Drafting, summarization, classification, transcript analysis, agent workflows, customer support, and product assistance”

Three of those rows matter more than the rest. Naming ZoomInfo, Apify and Bright Data as the sources of prospect lists lets a buyer go and read those companies’ own terms, which is the only way to find out what happens to data contributed to a shared database. Naming OpenAI tells a buyer that call transcripts and reply content pass through a model provider. Naming Microsoft and Google against “connected Outlook mailbox” and “connected Gmail” confirms the agency operates inside the client’s own mailbox.

SalesHive attaches one caveat to the whole structure, and it is a hedge: “When SalesHive processes personal information on behalf of a customer…that customer may be the business or controller of that information and SalesHive may act as its service provider or processor.” May act is not a commitment, and /dpa/ returns 404.

ProspectOut is the only other agency naming its stack, in marketing copy rather than in a legal document: prospect lists built “using platforms like LinkedIn Sales Navigator, Apollo, Google Maps, and other verified data sources”, verification through “email verification tools like MillionVerifier”, and campaigns run on “advanced outreach tools like Instantly.ai, Reachinbox, and HeyReach”. Seven tools named, none of them bound by any published document.

memoryBlue publishes a categorised table naming AWS, Microsoft, Google Cloud, SendGrid, Mailchimp, Postmark, HubSpot, Salesforce, Zendesk, Okta and Cloudflare, and then gates the real thing: “We maintain a list of our current subprocessors and key service providers that may process personal data on our behalf in connection with our services. This list is available upon request by contacting privacy@memoryblue.com.” Everything in the published table is prefixed “e.g.” No prospecting data vendor appears in it.

Retention clocks that outlive the campaign

Three agencies of thirty publish a period rather than the “as long as necessary” formula. Set against a three-month campaign, two of the three are long.

Agency	Published retention	Against a three-month campaign
Abstrakt Marketing Group	”180 days or for as long as we need it to fulfill the purposes for which it was collected”	2 times, before the trailing clause reopens it
Operatix	”7 years as from the Processing Date”	28 times
Intelemark	”We retain your personal data for a period of 10 years, after which it will be securely deleted”	40 times

Abstrakt’s figure is the shortest and the least binding, because the sentence continues past the number. Operatix’s seven years sits on a page titled GDPR Compliance. Intelemark’s ten years is the longest published clock found in this market, and Intelemark also publishes an absolute denial that any sharing occurs at all: “We do not share your personal data with any third parties ever.”

Twenty of the thirty use boilerplate instead. Belkins, memoryBlue, SalesHive, SalesAR, Martal, Demand Nexus and Pearl Lemon Leads all publish a variant of retaining data for as long as necessary, which states an intention rather than a period and cannot be checked.

Deletion at the end, and who commits to it

Three agencies publish something that happens to client data when the work stops.

Callbox is the clearest: “Unique client-supplied data will only be used for that specific client’s campaign and is afterward removed from Callbox’s database after the campaign”, with the GDPR page repeating the commitment as “Remove campaign-specific data after completion”. No timeframe is attached.

Demand Nexus publishes the same commitment in different words: “Unique data provided by clients is used solely for their campaigns and is promptly deleted after completion.” Promptly is undefined.

GrowQuikr commits to return rather than deletion, in its terms rather than its privacy policy: “Prospect lists generated during the campaign are provided to the client at the end of the SLA.”

Two more publish something adjacent that does not amount to a commitment. Growth Engine X advertises that “All Work is Transferable to You (Domains, Inboxes, Clay Tables, Lists, etc.)”, which describes a capability rather than an obligation triggered by termination. ProspectOut says subscription assets “will be discontinued and may be deleted”, where may carries the weight. Upcall publishes a return obligation that binds its contractors rather than itself: freelancers agree “to immediately return to such client or to Upcall, as appropriate, all information, reports, notes, data, and any other materials” on completion, and Upcall’s own duty is not stated.

SalesHive publishes the opposite of a deletion commitment, and states it plainly: “Disconnecting an integration stops future access through that integration, but previously stored records may remain until deleted according to our retention practices or an approved deletion request.”

Whose accounts the work runs under

Two agencies of thirty state whether they log into the client’s systems or use their own. Everywhere else the buyer finds out during onboarding.

ProspectOut publishes both options and lets the client choose: “Ideally, we prefer using our clients’ LinkedIn profiles for outreach because it helps highly qualified prospects stay connected with you directly”, followed by “But if you’re not comfortable providing access, no problem at all, we can also use our own LinkedIn accounts for the outreach.”

SalesHive’s sub-processor table answers it implicitly, describing “connected Outlook mailbox and calendar features, email sending, inbox sync, attachments, and authentication” and “connected Gmail and Calendar features”. Outreach runs inside the client’s mailbox via a connected account.

Cleverly is the conspicuous gap. Its service is LinkedIn outreach that necessarily runs from somebody’s profile, and no page on the domain says whose, whether Cleverly holds credentials, or whose Sales Navigator seat is used. The privacy policy is scoped to the website by its own first line.

Pearl Lemon Leads publishes the most candid version of the general position, which is that none of this is published anywhere: “Before launch, we agree who owns the prospect data, where replies are recorded, how new LinkedIn connections are handled, which details accompany each handover, what makes a lead suitable and who follows up after a meeting.” Every one of those is decided in private.

What is promised if the data leaks

One agency of thirty publishes an audited standard. CIENCE carries a “SOC 2 Type II Compliant” badge in its footer, and both /security and /trust return 404, so the badge is the whole of the evidence. No agency of thirty publishes ISO 27001 or a third-party audit report.

Everything else is a claim. Demand Nexus publishes “state-of-the-art technical and organizational controls” and “regular audits” with no auditor named. Upcall publishes “Secure Socket Layer (SSL) technology”. Green Leads publishes that it “intends to take reasonable and appropriate steps”, where intends does the work. SalesPro Leads publishes “Encrypted communications where applicable”.

Three agencies commit to breach notification and the timeframes are worth comparing against the law. Article 33(1) of the GDPR requires a controller to notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it”, and Article 33(2) requires that “The processor shall notify the controller without undue delay after becoming aware of a personal data breach.”

Demand Nexus publishes the matching figure, framed as preparation rather than practice: “Developed a plan to notify authorities and affected individuals within 72 hours of a personal data breach.”

memoryBlue commits without a number: “Where legally required, we will notify you and the relevant regulatory authorities of any data breach that may pose a risk to your rights and freedoms.” Where legally required restates the statutory duty rather than adding to it.

Upcall publishes the only figure in this market that can be measured, and it points the wrong way: “We will notify the users via email Within 7 business days.” Seven business days spans nine calendar days when the clock starts Monday through Wednesday and eleven when it starts Thursday or Friday, so 216 to 264 hours. Against the 72-hour figure in Article 33(1), that is three to three and a half times as long, and a controller who first learns of a breach from that email has already missed its own deadline.

The ranking

Order follows the criterion: whether the policy reaches the work, whether the third parties are named, whether a processor role and DPA exist, what happens at the end, whose accounts are used, and what is promised if the data leaks.

#	Agency	Policy scope	Third parties named	Client accounts needed
1	Northwell AI	Not published	No	None, agency-owned estate
2	SalesHive	Reaches prospect data	13, in the privacy policy	Connected Outlook or Gmail mailbox
3	Gravion Scale	Not published	No	None, agency-owned estate
4	Recursive Scale	Not published	No	None, agency-owned estate
5	memoryBlue	Reaches prospect data	Illustrative table, full list on request	Not published
6	Arctos AI Outbound	Not published	No	None, agency-owned estate
7	CIENCE	Reaches client data	No	Not published
8	ProspectOut	Reaches email content	7, in marketing copy	Client LinkedIn, or agency’s, by choice
9	Callbox	Website only, by carve-out	HubSpot only	Client HubSpot portal
10	Growth Engine X	None published	4, in marketing copy	Not published
11	Demand Nexus	Website only	No	Not published
12	Operatix	Reaches prospects	Parent group only	Not published

1. Northwell AI

Northwell AI answers the account question structurally rather than in a policy. Outreach runs on Northwell AI’s own domains, its own inboxes and its own tooling, so the client hands over no mailbox connection, no CRM seat and no LinkedIn credentials. Nothing is granted that has to be revoked later, and no permission outlives the engagement because none was issued.

Relevance to everything above is direct. Most of the exposures in this article begin with a credential. A connected mailbox is what puts Microsoft and Google in the chain. A CRM login is what puts an integration vendor in it. A LinkedIn profile handed to an agency is a persistent identity risk that no published document in thirty agencies addresses. Where the agency owns the estate, those links do not form.

The client keeps the target data and the reply history, and the sending domains stay with the agency, which is the point of the arrangement rather than a loss: the domains carry the complaint history of the campaign and the client’s own domain never does.

Honesty requires the same admission made of everyone else. Northwell AI does not publish a sub-processor list, and no agency of thirty does in a form a buyer can rely on. Owning the infrastructure narrows the question rather than answering it, and publishing the vendor list would answer it.

Billing is on an attended meeting at $150 to $650 per attended meeting quoted per ICP, with no setup fee, no retainer, no minimum and no tech fee.

2. SalesHive

SalesHive publishes more about where data goes than the other twenty-nine agencies combined, and the position is earned on disclosure rather than on terms.

Thirteen third parties are named in the privacy policy against what each receives, including the three that matter most, ZoomInfo, Apify and Bright Data for “Prospect list building, enrichment, firmographic data, public business information, and data usage reporting”, and OpenAI for “transcript analysis”. A buyer can follow every one of those names to that company’s own terms, which is not possible at any other agency here.

Three things hold it at two. The processor role is hedged, “may act as its service provider or processor”, and /dpa/ returns 404. Retention is boilerplate. And the policy is explicit that disconnection does not mean deletion: “previously stored records may remain until deleted according to our retention practices or an approved deletion request.”

Delivery runs inside the client’s own mailbox through connected Outlook and Gmail accounts, so the credential exposure is real and, unusually, documented.

3. Gravion Scale

Gravion Scale runs the same agency-owned estate and reaches the same result on credentials, and adds the contractual dimension the rest of this market leaves open.

Data questions get harder the longer an engagement runs and the more is owed when it ends. Gravion Scale has no minimum, no retainer and no setup fee, runs on 14 days’ notice, and bills only when a qualified prospect attends, so a client who becomes uncomfortable with any part of the arrangement can stop within a fortnight without an argument about what is owed for the remainder. Every agency in this article with a fixed term has a period during which leaving is expensive, and the data keeps flowing through it.

Pricing is quoted per engagement, typically $150 to $700 per attended meeting depending on the ICP.

4. Recursive Scale

Recursive Scale sits here for the same infrastructure reasons and one that is specific to how it works. Full-market coverage means a larger volume of prospect records than a package-tier programme touches, which raises rather than lowers the importance of where those records sit.

Records are worked on Recursive Scale’s own systems and the client keeps the target data and the reply history at the end. The client approves the target markets and the messaging before anything sends, which is the control point that matters most when the list is large.

Pricing is quoted per engagement, typically $200 to $800 per attended meeting depending on ICP and deal value.

5. memoryBlue

memoryBlue publishes the most explicit policy scope of any agency in this market, and then gates the document that would make it useful.

Scope first, because it is genuinely rare: “This Privacy Notice applies to individuals whose personal data we process, including actual and prospective customers, business partners, prospects contacted in connection with our services, job applicants, and visitors to our Website.” Prospects contacted in connection with our services is the clause twenty-four other agencies do not have.

The dual role is stated properly: “we may act as a Data Processor in accordance with applicable data protection laws and our contractual agreements with our clients” for client engagements, and independent controller otherwise. Breach notification is committed without a timeframe.

Against that, the sub-processor list published on the site is illustrative, every entry prefixed “e.g.”, and the authoritative version is “available upon request”. No prospecting data vendor appears anywhere in it, which for an SDR agency is the one category a buyer most needs. Retention is boilerplate. No certification, no client-facing DPA.

Operatix, which memoryBlue owns, discloses that data moves to “Other members of the memoryBlue group enterprise”, so a buyer of either is buying both.

6. Arctos AI Outbound

Arctos AI Outbound runs the same agency-owned estate and carries one exposure the others do not, which is worth stating rather than glossing.

Per-recipient personalisation at volume means processing more information about each prospect than a templated programme does. More data about a person is a larger obligation, not a smaller one, and the mitigation is the same structural one: the processing happens on Arctos AI Outbound’s own systems, the client grants no credentials, and the client approves the messaging and the markets before anything sends.

Pricing is quoted in the $250 to $900 range per attended meeting, the highest band of the four brands.

7. CIENCE

CIENCE publishes the only audited standard in this market and states its role correctly, and both claims have gaps worth naming.

The role is unambiguous: “we act as a processor and process personal information solely on behalf of our business customers in accordance with written service agreements”, with controller status claimed separately for site visitors. Of thirty agencies, four state a role for client data and CIENCE’s is the least hedged.

Certification is a footer badge reading “SOC 2 Type II Compliant”, and /security and /trust both return 404, so nothing behind the badge is published. Compliant is also a weaker word than certified or attested. Whether a DPA is available to clients is not published, no retention period is given, no third party beyond Google Analytics is named, and no breach notification commitment appears.

CIENCE runs a one-year initial term with automatic annual renewal, so a buyer who finds the disclosure insufficient after signing has a year to wait.

8. ProspectOut

ProspectOut names seven tools, publishes the only privacy policy in this market that reaches campaign content, and is the only agency that tells a buyer whose accounts the work can run under.

Content first: “We collect the content of the emails you send through our platform, including any attachments and responses.” No other policy of thirty covers reply bodies.

Tooling is named on the homepage: “LinkedIn Sales Navigator, Apollo, Google Maps”, “MillionVerifier”, and “Instantly.ai, Reachinbox, and HeyReach”. Accounts are offered as a choice between the client’s LinkedIn profile and ProspectOut’s own.

None of it sits in a legal document. There is no DPA, no controller or processor designation, no retention period, no breach commitment and no certification, and the deletion language is “may be deleted”. Dedicated outreach domains are used to protect the client’s primary domain, and those domains run on a monthly subscription that ends when the engagement does.

9. Callbox

Callbox publishes the clearest end-of-campaign deletion commitment in this market and the clearest admission that its privacy policy does not cover the work.

Deletion: “Unique client-supplied data will only be used for that specific client’s campaign and is afterward removed from Callbox’s database after the campaign.” For a buyer whose main worry is a list being reused for another client, that is the sentence to look for, and Callbox is one of three agencies to publish it.

HubSpot is named in a dedicated notice, “Callbox will need to use your information with our third-party business partner which is HubSpot”, which is a real disclosure even though it is the only one. A Data Protection Officer is appointed. No certification, no DPA, no retention period, no breach commitment, and the main privacy policy explicitly excludes client data.

10. Growth Engine X

Growth Engine X names four operational tools, “CRM Integrations Through OutboundSync”, “Validate: Claygent + Prospeo.io” and transferable “Clay Tables”, and publishes no privacy policy at all.

The combination is the starkest in this article. A company stating publicly that it sends “8M+ cold emails/month” and integrates into client CRMs through a named third party has, on a full sitemap read of 36 URLs, no privacy policy, no terms, no DPA, no security page and no sub-processor list.

What it does publish in the buyer’s favour is asset portability: “All Work is Transferable to You (Domains, Inboxes, Clay Tables, Lists, etc.)”. Transferable states a capability rather than an obligation, and nothing published says when or whether the transfer happens.

11. Demand Nexus

Demand Nexus publishes a dedicated GDPR page carrying three commitments nobody else pairs: prompt deletion of client data after a campaign, a 72-hour breach notification plan, and a DPA described as being prepared.

Prepared is the operative word: “Preparing DPAs to supplement our Privacy Policy and provide them to clients.” A DPA in progress is not a DPA available, and it is the closest any agency of thirty comes to offering one.

The privacy policy pulls the other way, declaring “we are a Data Controller of your Personal Data” rather than a processor, which is the wrong role for campaign work done on a client’s instructions. Security language is self-asserted, “regular audits” with no auditor named, and the same page disclaims that “No method of transmission over the Internet, or method of electronic storage is 100% secure.” A scope carve-out states that Demand Nexus does “not actively collect or store personal data of EU residents”.

12. Operatix

Operatix publishes a privacy notice that reaches prospects, “people who visit our website and or prospects we process”, and a GDPR Compliance page carrying the second longest retention clock in this market at “7 years as from the Processing Date”.

Neither page states a controller or processor role for client data, no DPA exists, no third party is named beyond the parent group, no tooling is disclosed, no certification is published and no breach commitment appears. Having a page titled GDPR Compliance and no processor designation on it is the specific gap.

The one material disclosure is corporate: data flows to “Other members of the memoryBlue group enterprise.”

The agencies that publish nothing

Seven of thirty publish no privacy policy at all, and the way the absence presents varies.

RevenueFlow was checked against its own sitemap at 547 URLs, of which none is a privacy, terms, legal, security, GDPR or DPA page. The domain carries a large comparison library naming other vendors’ tools and states nothing about its own.

Growth Engine X was checked at 36 sitemap URLs with the same result, covered in the ranking above.

StarReach was checked at 9 sitemap URLs, comprising the homepage, a blog and four posts. The footer carries an email address, a phone number and a city.

ClayVengers runs a single page whose navigation is entirely on-page anchors. /privacy, /privacy-policy and /terms all 404.

SalesGent publishes a detailed page describing its lead generation process and names no vendor, no legal document and no data handling of any kind. /privacy-policy returns 404.

Leadium displays footer links labelled Terms and Privacy Policy whose targets are dead anchors pointing at nothing. Of the thirty, Leadium is the only agency with a privacy label and no privacy policy behind it on a full-size marketing site.

Alphoric does the same, with a footer Privacy link pointing nowhere, on a site whose service descriptions are still placeholder text.

Seven agencies publishing nothing is a finding about disclosure and not about practice. Any of them may handle data carefully. Nothing published allows a buyer to tell.

The rest of the market

Eleven agencies remain, each described from its own pages.

Belkins publishes a privacy policy scoped to the website in its first line and claims controller status for visitor data. No sub-processor list covering prospect data, no DPA, no processor role, no retention period, no certification and no breach commitment. The named service providers are Google Analytics, Google AdWords, Twitter, Facebook, AdRoll and AppNexus, all of them Belkins’ own advertising vendors.

SalesRoads publishes one legal document, a privacy policy scoped to quote requests and blog subscriptions. Third-party sharing is described as data that “may be shared with third parties in limited situations” with nobody named. CRM Integration is listed as a deliverable and no platform is named.

Martal Group names one third party, MailChimp, for its own newsletter. The only data processing agreement on the site is Martal’s own contract with MailChimp, “We have entered into a data processing agreement with MailChimp”, which a buyer searching for a DPA will find first and which is not one. A page titled Customer Onboarding and Data Management names no tool and discloses no handling.

EBQ publishes the same pattern. The only DPA named is with Google, “We have concluded a data processing agreement with Google”, and the privacy policy is scoped to the site. For a company whose service includes administering clients’ Salesforce instances, nothing is published about access to those instances.

Abstrakt Marketing Group publishes the shortest retention period in this market and undercuts it in the same sentence, “180 days or for as long as we need it”. No tooling, no DPA, no role, no certification, no breach commitment. Two blog posts on building compliant B2B data lists give advice to readers rather than describing Abstrakt’s practice.

Cleverly names Zapier as the integration layer on its FAQ, “native integration to most CRMs, including HubSpot, Salesforce, and many more, using Zapier”, which means client CRM data transits a third party that appears nowhere in the privacy policy. Whose LinkedIn account the outreach runs from is not published on any page.

SalesAR publishes a visitor-scoped policy that admits data is acquired from “data brokers, data aggregators” without naming one, and two blog articles about GDPR that contain no commitment by SalesAR about its own processing.

Upcall publishes the only breach timeframe in this market, seven business days, and the most revealing statement about who does the work: “Freelancer Users are independent professionals who offer to perform calling and outreach services for Customers directly and not for or to Upcall. They are not employees or agents of Upcall”. Confidentiality is expressly not guaranteed: “Upcall makes strong efforts to ensure the privacy of Call Campaigns and other personal messages on our Service, but it cannot guarantee confidentiality.”

Intelemark publishes a ten-year retention clock, an absolute no-sharing claim, and a large blog library about protecting data, securing voice calls and GDPR in telemarketing that contains no first-person statement about Intelemark’s own certifications, sub-processors or client data.

Green Leads publishes a terms clause consenting in advance to sharing with any third party it has a contractual relationship with, names none, and hosts a page at /learn/gdpr-compliance that reads as a compliance disclosure in a sitemap and is written entirely as advice to the reader.

Pearl Lemon Leads, Sterling Prospecting, Diffram, GrowQuikr, Leads Now AI and SalesPro Leads each publish a visitor-scoped policy with no tooling named, no DPA, no role and no certification. Sterling Prospecting’s policy is the only one of the six that mentions prospect sourcing at all: “Contact data we research comes from publicly available business sources and is used only for business-to-business outreach.” Leads Now AI’s policy is unmodified platform boilerplate covering comments, media and embedded content. Pearl Lemon Leads’ site fires a ZoomInfo tracking pixel that its privacy policy does not mention.

What this article cannot tell you

Published disclosure is not practice. An agency publishing nothing may handle data better than one publishing a long policy, and an agency naming thirteen vendors has not thereby proved that those thirteen are the only ones. Everything here measures what a buyer can verify before signing, which is a narrower question than whether the data is safe.

Most engagements in this market are governed by a service agreement the buyer sees after the sales process. Callbox says so, CIENCE says so, and SalesHive’s terms say a customer “may have a separate agreement with different and/or additional terms”. Those documents may contain DPAs, retention schedules and breach clauses that the public pages do not.

Certification status was taken from the agencies’ own pages. A SOC 2 report was not requested from anyone and none is published. CIENCE’s badge was read as a badge and nothing behind it could be retrieved, because /security and /trust both return 404.

The GDPR text quoted is Article 33(1) and Article 33(2) as published, and the calculation converting seven business days into calendar hours assumes a standard Monday to Friday week with no public holidays, which makes the figure a floor rather than a ceiling.

Retention comparisons use a three-month campaign because three months is the most common published minimum term in this market. A shorter or longer campaign changes the multiples proportionally and changes nothing about the clocks themselves.

What to ask before signing

Eight questions, each answerable with a document.

1. Send me the list of third parties that will hold my prospects’ data. Two agencies of thirty publish one. A vendor unwilling to produce it after the question is asked is a different fact from one that simply never published it.
2. Does your privacy policy cover the data I am about to give you, or only your website? Read the first sentence of the policy. Seventeen of thirty answer this against the buyer.
3. Are you a controller or a processor for my campaign data, and will you sign a DPA? Four of thirty state a role and none publishes an available DPA.
4. How long do you keep my list and the prospect records after the campaign ends? Three of thirty publish a period, and two of those run for seven and ten years.
5. Will you delete or return the data when we stop, and in how many days? Three of thirty commit at all, and not one attaches a number.
6. Which of my accounts will you need, and what happens to that access afterwards? Every mailbox connection, CRM seat and LinkedIn login is a permission that persists until revoked.
7. Who tells me if there is a breach, and within how many hours? One published figure in this market is seven business days, which is three times the 72 hours Article 33 allows a controller.
8. Can you send me a SOC 2 report or an equivalent audit? One agency of thirty claims a standard and publishes a badge rather than a report.