Legal
Privacy notice
This notice explains how Fullbound (“we”, “us”) collects and uses personal data: when you visit fullbound.com, book a call, email us, apply for a job, or when we contact you about our services. It also explains your rights and how to use them.
We’re headquartered in the UK, so the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR) apply to everything we do. Where we contact or work with people in other countries, we also follow the rules that apply there, such as the EU General Data Protection Regulation (EU GDPR), CAN-SPAM in the United States and Canada’s Anti-Spam Legislation (CASL).
We’ve kept it as plain as we can. If anything is unclear, email hello@fullbound.com and we’ll explain.
Who we are
Fullbound is run by Tyler Woonton, who is the controller of the personal data described in this notice, except where we say we act for a client (see Work we do for clients).
- Tyler Woonton, trading as Fullbound
- Address: 2-4 Loom Street, Manchester, England, M4 6AN
- Email: hello@fullbound.com
At a glance
| What we do | Data we use | Lawful basis |
|---|---|---|
| Run and secure our website | Technical data such as IP address and browser | Legitimate interests |
| Arrange and hold calls you book | Name, work email, booking notes | Steps before a contract, legitimate interests |
| Reply to enquiries | Contact details and what you tell us | Legitimate interests |
| Consider job applications | Application answers, work samples, interview notes | Steps before a contract, legitimate interests |
| Contact businesses about our services | Business contact details and public company information | Legitimate interests, or consent where the law requires it (you can object at any time) |
| Work with clients and suppliers | Work contact details and correspondence | Contract, legitimate interests, legal obligation |
The sections below give the detail.
What we collect, why, and our lawful basis
When you visit our website
Our hosting provider records technical information when any page is requested: your IP address, browser type, the page you asked for and the time. We use it to run the site, keep it secure and fix faults.
Lawful basis: our legitimate interests in running a secure, working website.
When you book a call
Bookings are taken through Cal.com. We collect your name, work email, the time you choose and anything you add in the notes, such as your company and what you’d like to discuss. We use it to arrange and hold the call, prepare for it, and follow up afterwards.
We may use an AI note-taker to transcribe the call so our notes are accurate.
Lawful basis: taking steps at your request before entering into a contract, and our legitimate interests in responding to business enquiries.
When you email or message us
We collect your name, contact details and whatever you choose to tell us, and use it to reply and keep a record of the conversation.
Lawful basis: our legitimate interests in responding to enquiries and running our business.
When you apply for a job
Our application asks for your name, email address, your answers to our questions, a link to work you’ve done, and optionally a LinkedIn profile or CV link. If you go further in our process, we’ll also keep notes from interviews and any work you share with us.
We use it to assess your application, contact you and make a hiring decision. We don’t ask for special category data (such as health or ethnicity). Please don’t include it unless you need to tell us about adjustments for interview.
Lawful basis: taking steps at your request before entering into a contract, and our legitimate interests in recruiting the right people. If you need adjustments, we process that information to meet our obligations under the Equality Act 2010.
When we contact you about our services
We sell to businesses, so we sometimes contact people in their work role who we think may be interested in what we do. For this we use business contact details: name, job title, employer, work email, work phone number and professional profile links.
We get these from public sources such as company websites, Companies House and other public registers, professional networks, and from business data providers. We may also note publicly available information about your company, such as hiring activity or news, so our message is relevant.
Lawful basis: our legitimate interests in promoting our services to businesses, or your consent where the law requires it. We contact corporate addresses, with prior consent or legitimate interests in place as the rules where you are require. Every message includes a way to opt out, and we keep a suppression list so you aren’t contacted again once you’ve said no.
When you’re a client, or work for one
We hold the names and contact details of the people we work with at client and supplier businesses, plus our correspondence, to deliver our services, invoice and manage the relationship.
Lawful basis: performing our contract with your organisation, and our legitimate interests in managing that relationship. We keep financial records to meet our legal obligations.
Things we don’t collect
We don’t collect special category data, such as information about health, ethnicity or religious beliefs, except where you choose to tell us about adjustments you need for an interview.
If you don’t give us information
Where we need information to do something you’ve asked for, such as arranging a call or considering your application, and you don’t provide it, we may not be able to do it. We’ll tell you if that’s the case.
Your right to object
You can object at any time to us using your personal data for direct marketing, and we will stop. Reply to any of our messages or email hello@fullbound.com. We’ll add you to our suppression list so we don’t contact you again.
You can also object where we rely on legitimate interests for anything else. We’ll stop unless we have compelling grounds to continue, which we’ll explain.
Work we do for clients
When we run pipeline for a client, such as researching their target market, sending outreach on their behalf or handling their inbound enquiries, we usually act as a processor for that client. The client decides why your data is used, and their privacy notice applies. We act only on their written instructions, under a data processing agreement.
If you’ve been contacted as part of a client campaign and want to object or exercise your rights, contact that client. You can also email us and we’ll pass your request on and add you to the client’s suppression list.
Who we share it with
We share it with the service providers below, who help us run our business. Where they act for us, our contracts require them to protect it and use it only on our instructions.
| Provider | What for |
|---|---|
| Cal.com, Inc. | Call bookings |
| Google Cloud EMEA Limited, t/a Google Workspace and Google Meet | Email, files and calls |
| Microsoft Ireland Operations Limited, t/a Microsoft 365 | |
| Granola, Inc. | Call notes |
| Attio Limited | Managing enquiries and relationships |
| 521 Products Pty Ltd, t/a Smartlead | Sending business outreach emails |
| LinkedIn Ireland Unlimited Company, t/a LinkedIn Sales Navigator | Finding and contacting businesses on LinkedIn |
| HeyReach Inc OÜ, t/a HeyReach | Sending business outreach on LinkedIn |
| Business data and enrichment providers | Finding and checking business contact details |
| Anthropic Ireland, Limited, t/a Claude | AI tools for research, drafting and summarising |
| OpenAI OpCo, LLC, t/a ChatGPT | AI tools for research, drafting and summarising |
| SpaceXAI LLC, t/a Grok | AI tools for research, drafting and summarising |
| Slack Technologies Limited, t/a Slack | Internal messaging |
| Linear Orbit, Inc., t/a Linear | Project tracking |
| Cloudflare, Inc. | Hosting, delivering and protecting this site |
| DigitalOcean, LLC | Hosting our servers |
| GoDaddy.com, LLC, t/a GoDaddy | Registering and managing our domain names |
| Namecheap, Inc. | Registering and managing our domain names |
| Porkbun LLC | Registering and managing our domain names |
| Xero (UK) Limited | Accounting and invoicing |
| Stripe Payments Europe, Limited, t/a Stripe | Card payments |
| GoCardless Ltd | Direct Debit payments |
| Our accountants and professional advisers | Accounting, legal and tax advice, where needed |
We may also disclose data where the law requires it, to protect our rights, or to a buyer if our business is sold.
If you give us details of someone else, for example a colleague you’d like to join a call, please make sure they’re happy for you to share them.
International transfers
Many of our providers are based in, or store data in, the United States, the European Union or elsewhere outside the UK, such as Australia. Where personal data leaves the UK, we make sure it’s protected by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or by the ICO’s International Data Transfer Agreement or Addendum. Where the EU GDPR applies, we rely on the European Commission’s adequacy decisions or standard contractual clauses in the same way.
Keeping it secure
We use appropriate technical and organisational measures to stop personal data being lost, used or accessed without permission, and only people who need it for their work can see it. Our providers must protect it to the same standard. No transmission over the internet is completely secure, so we can’t guarantee the security of data while it’s on its way to us.
How long we keep it
- Call bookings and enquiries: up to two years after our last contact, unless you become a client.
- Job applications: six months after the role is filled or your application ends, as you agree when you apply. If we hire you, your application moves to your employee record.
- Marketing contacts: up to two years after we last contacted you without a reply. If you object, we keep only what we need to make sure we don’t contact you again.
- Client records: for the length of the relationship and six years after it ends, for legal and tax purposes.
- Server logs: normally 30 days, and never more than 90 days.
- Browser storage: as long as shown in our cookie policy.
Sometimes we anonymise data so it can no longer be linked to you. We may then use it for reporting and analysis without further notice.
Cookies
Our site uses a little browser storage to work, and no analytics, advertising or tracking cookies. Our cookie policy lists each item, what it does and how long it lasts.
Your rights
Depending on where you are, data protection law gives you the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased in some circumstances
- restrict how we use it in some circumstances
- object to how we use it (see Your right to object)
- data portability: receive data you gave us in a reusable format, where we rely on contract or consent
- withdraw consent at any time, where we rely on it
To use any of these, email hello@fullbound.com. It’s normally free. We may charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive, and we’ll explain why. We may need to confirm your identity first. We’ll respond as the law requires, within the legal timeframe.
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us first so we can put it right. Email hello@fullbound.com (the link starts the email for you, with a few questions to answer), or write to us at 2-4 Loom Street, Manchester, England, M4 6AN. We’ll respond as the law requires, within the legal timeframe, keep you updated, and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator:
- Online: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
If you’re outside the UK, you may also be able to complain to the data protection regulator where you live or work.
Other websites
Our site links to other websites, such as Cal.com, our clients’ sites and our social media pages. They have their own privacy policies and we aren’t responsible for them, so please check those policies before you give them any personal data.
Changes to this notice
We’ll update this notice when how we use personal data changes. The date at the top shows when it last changed. If a change affects you significantly, we’ll tell you directly where we can.
Contacting us
For any question about this notice or how we handle personal data, email hello@fullbound.com or write to Fullbound at 2-4 Loom Street, Manchester, England, M4 6AN.
Version history
| Version | Date | What changed |
|---|---|---|
| 1.0 | 26 October 2026 | First version. |