Template, not legal advice. This is a working draft written for PodcastGTM's model: B2B programs that research and invite guests on behalf of clients. Values in [brackets] are fill-ins. Before this page goes live, check it against the laws where you and your guests are, and against the vendors you actually use.
1. Who we are and what this covers
PodcastGTM is operated by [Legal entity name], [registered address] ("PodcastGTM", "we", "us"). We run podcast-led outbound for B2B companies: we produce a founder-hosted interview show, research and invite the client's ideal buyers as guests, run the production, and hand the conversations to the client's team.
This policy covers four groups of people:
- Visitors and applicants who use this website, its forms and its calculators.
- People we research and invite to appear on shows we produce.
- Guests who record a pre-interview or an episode.
- Clients, sponsors and partners, and the staff we deal with there.
Our role
For this website, our own marketing and our client relationships, we decide how data is used, so we are the controller. For guest research, invitations, pre-interviews and recordings run for a client's show, the client decides who is invited and why. The client is normally the controller and we act as its processor under a data processing agreement. Where we set the purpose ourselves (the cross-show suppression list in section 4 is the main example), we are a controller for that processing.
If you were invited to a client's show, that client's own privacy notice applies too. Every invitation names the host and the company behind the show.
2. What we collect on this website
- Application form. Name, work email, company, website, what you sell, stage, closest market, average contract value, guest titles you want, who would host and their weekly hours, monthly budget band, start timing, channels you've tried and how you heard about us.
- Playbook, workshop, events, field notes, Pipeline Live, partner, VC and sponsorship forms. Name, work email, company, role and the answers you give.
- Referrals and nominations. When a partner or VC firm names a company or founder, or someone nominates a guest for a show, we hold the details you give us about that person (such as name or profile link, company, role or website) to judge fit and make contact, and we tell that person who referred them.
- Calculators. The numbers you enter are processed in your browser. They are not sent to us or stored.
- Technical data. IP address, browser and device type, pages viewed, referring page and timestamps, from server logs and [analytics tool, if one is added].
Preview build. While this site is in preview, its forms are demonstrations. They check your answers in the browser and send nothing.
We use form data to reply to you, to judge whether a program fits, to prepare a guest forecast or proposal, and to send what you asked for, such as the playbook or a workshop seat. If you ask to hear from us, we send occasional field notes, and every email carries an unsubscribe link.
3. Guest research: sources and lawful basis
A guest list starts from the client's ideal-customer profile: role, seniority, company stage, funding, niche and recent trigger events such as a new round, a product launch or a senior hire. We then look for people who match it.
Where the data comes from
- Public professional profiles and company websites.
- Press releases, funding announcements and trade coverage.
- Conference speaker pages, published interviews and podcast appearances.
- Licensed B2B contact-data providers: [provider names].
- Account lists the client supplies. The client confirms it may share them for this purpose.
- Introductions from past guests who suggest a peer.
What we record
Name, job title, employer, work email address, country or region, professional bio and public links, the public trigger that made you a fit, and the show you were considered for.
What we don't collect
Personal (non-work) email addresses, home addresses, personal phone numbers, or special-category data such as health, religion, political views, ethnicity, sexual orientation or union membership. We don't buy consumer lists, and we don't infer sensitive traits.
Lawful basis
Legitimate interests of the client, as controller, in inviting relevant professionals to speak on its show. For the cross-show suppression list, where we are the controller, our own legitimate interest in keeping opt-outs working. Those interests have been weighed against yours. The data is limited to work details, the request is an invitation to speak rather than a sales pitch, the sequence is short, and opting out takes one reply. Where local law requires prior consent for business email, we don't invite people there without it: [list jurisdictions, e.g. under PECR, CASL or national ePrivacy rules].
Because this data isn't collected from you directly, we give this notice on the client's behalf, as required by [GDPR Art. 14 / UK GDPR Art. 14]. Every invitation links to this page.
4. How invitation outreach is handled
If you received an invitation from a show we produce, this is what happens to your details, step by step.
- Sent as the host. Invitations go out under the host's name from domains and mailboxes set up for the show, never from the client's main domain. The client owns those domains and mailboxes.
- Clear about who and why. Each invitation names the host and the show, says why you were invited, and tells you how to stop hearing from us.
- A short sequence. An invitation and a small number of follow-ups. It stops the moment you reply, decline or opt out.
- One opt-out covers every show. Reply "remove" or use the opt-out link. Your work email goes on a suppression list that we honour across every show we run, for every client, and we tell the client. The list holds only what we need to recognise you: [hashed email address].
- Slow, warmed sending. Mailboxes warm up before the first invitation. Daily volume starts low and ramps. That protects deliverability and keeps inboxes from being flooded.
- Pre-interview. If you accept, a producer runs a 15-minute pre-interview. Before it starts, you're told that notes from it and from the recording go to the host's company. The producer scores fit for the show. No automated system makes decisions about you.
- Recording. Thirty minutes with the host, recorded only after you sign a guest release. The release says how the episode, clips, your name, title, voice and likeness will be used.
- Review before anything airs. Episodes are reviewed before publishing, you approve your clips, and nothing airs without sign-off. Withdraw before publication and the episode doesn't air.
- Handoff. After the recording, the client's team receives your contact details, the conversation notes and any follow-up you agreed to. From then on, the client also handles your data under its own privacy notice.
5. How we use data, and on what basis
| purpose | data | lawful basis |
|---|---|---|
| Reply to applications, judge fit, send proposals | contact details, application answers | steps before a contract; legitimate interests |
| Deliver programs, report, invoice | client contacts, contract and billing records | contract; legal obligation (tax records) |
| Research and invite guests for a client's show | work contact and profile data | legitimate interests (client as controller) |
| Record, edit and publish episodes and clips | recording, voice, likeness, name, title | consent via the guest release |
| Hand the conversation to the client's CRM | contact details, conversation notes | legitimate interests, disclosed before the pre-interview |
| Keep opt-outs working across shows | suppression entry | legitimate interests; legal obligation where it applies |
| Send the playbook, workshop reminders and field notes | name, work email | consent; unsubscribe any time |
| Run and secure this website | technical data | legitimate interests |
We don't sell personal data, and we don't share it for cross-context behavioural advertising. Recordings may be transcribed and edited with automated tools from the vendors in section 7, which act only on our instructions [confirm each vendor's terms exclude training on customer data].
6. Who sees it
- The client whose show it is: the guest list for that show, invitation replies, pre-interview notes, recordings and handoff notes.
- Our subprocessors (section 7), under written contracts that limit them to our instructions.
- The public: only what appears in an approved episode or clip.
- Advisers, auditors and insurers, under confidentiality.
- Authorities, where the law requires it.
- A buyer or successor, if the business is sold or merged, bound by this policy.
Nothing moves between clients. One client never sees another client's guest list, notes or recordings. The only record used across clients is the suppression list, and it exists to keep opted-out people opted out.
7. Subprocessors
Vendors that process personal data for us. Vendor names and regions are placeholders until the stack is confirmed. Placeholder list
| category | vendor | used for | region |
|---|---|---|---|
| Mailbox hosting | [Vendor] | invitation mailboxes on the show's domains | [Region] |
| Sending & warm-up | [Vendor] | scheduling invitations, mailbox warm-up | [Region] |
| Scheduling | [Vendor] | booking pre-interviews and recordings | [Region] |
| Remote recording | [Vendor] | capturing audio and video | [Region] |
| Transcription & editing | [Vendor] | transcripts, edits, clips | [Region] |
| File storage | [Vendor] | episodes, clips, notes | [Region] |
| CRM & reporting | [Vendor] | guest status from invite to handoff | [Region] |
| Web hosting & analytics | [Vendor] | serving and measuring this site | [Region] |
| Billing | [Vendor] | client invoices and payments | [Region] |
Clients get [30 days] notice before we add or replace a subprocessor that touches their program data, and can object on reasonable data-protection grounds.
8. International transfers
Our team and vendors work from [countries]. When personal data leaves the UK or the EEA, we rely on an adequacy decision or on Standard Contractual Clauses [and the UK International Data Transfer Addendum], with extra safeguards where a transfer assessment calls for them. Ask and we'll send a copy of the relevant safeguards.
9. Cookies, analytics and fonts
- Cookies. The current build of this site sets no cookies and stores nothing in your browser. [If analytics or a scheduling widget is added, list each cookie with its purpose and duration here, and add a consent banner where the law requires one.]
- Fonts. Typefaces load from Google Fonts, which receives your IP address and browser details when a page loads. [Self-host the fonts to remove this transfer.]
- No advertising trackers. No retargeting pixels and no ad cookies.
10. How long we keep it
We keep data only as long as the purpose it was collected for needs it, then delete or anonymise it.
| record | kept for |
|---|---|
| Applications that don't become programs | [12 months] from last contact |
| Researched guests never contacted | [90 days], then deleted |
| Invited guests who didn't reply | [12 months] after the last message |
| Suppression entries | for as long as we run outreach, so the opt-out keeps working |
| Pre-interview notes and recordings | for the client's program; returned or deleted within [30 days] of its end, on the client's instructions |
| Published episodes and clips | while the client publishes them; see takedown in section 11 |
| Contracts and invoices | [7 years], for tax and accounting law |
| Field notes and playbook subscribers | until you unsubscribe |
| Server logs | [30 days] |
11. Your rights, and how to use them
Depending on where you live, for example under the GDPR, the UK GDPR or US state privacy laws such as the CCPA, you can:
- Access the data we hold about you and get a copy.
- Correct it if it's wrong.
- Delete it.
- Object to processing based on legitimate interests, and to direct marketing at any time, with no reason needed.
- Restrict processing while a complaint is looked at.
- Port data you gave us to another provider.
- Withdraw consent. For a recording: before publication, it doesn't air. After publication, we take the episode and clips down from channels we control and ask the client to do the same.
- Complain to a regulator: [e.g. the ICO in the UK, or your local data protection authority].
How to make a request
- Email privacy@[your-domain] with the subject "Data request". Send it from the address in question if you can.
- We confirm receipt within [5 business days] and may ask for proof of identity.
- We answer within [30 days], or tell you why we need longer where the law allows it. There is no fee.
- If the request is about a client's show, we forward it to that client within [3 business days] and help them answer.
The fastest opt-out from invitations: reply "remove" to any invitation. It applies to every show we run.
US residents: we don't sell or share personal information as the CCPA defines those terms. You can act through an authorised agent, and we'll verify their authority first.
12. Security
- Access by role. Producers see the shows they work on, not the whole client list.
- Multi-factor authentication on every system that holds guest or client data.
- Encryption in transit, and at rest where the vendor supports it [confirm per vendor].
- Domain and mailbox credentials held in a password manager and handed over when a program ends.
- A written incident process. Clients are told without undue delay, and within [48 hours] of us confirming a breach that affects their data.
13. Children
Our services are for businesses. This site and our programs aren't directed at anyone under [16], and we don't knowingly collect their data. If you think we have, write to us and we'll delete it.
14. Changes to this policy
When this policy changes, the date at the top of the page changes with it. Material changes are emailed to clients [30 days] before they take effect. Earlier versions are available on request.
15. Contact
- Controller: [Legal entity name], [registered address]
- Privacy requests: privacy@[your-domain]
- Data protection officer: [name or role, if appointed]
- EU / UK representative: [if required]
Related: Terms of service · FAQ: guests and outreach