Privacy Center
One place to see your data, delete it, stop email sent through SDRclose, or make a formal privacy request.
Which of these describes you
SDRclose is operated by BiopharmaWatch LLC. The right route depends on your relationship with us, so start with the description that fits.
You hold an SDRclose account
Export or delete your data yourself from Settings > Privacy & Data. The controls are described below; anything the app does not handle goes through a rights request.
You received an email sent through SDRclose
The organization named in the message chose to contact you and is responsible for your data. See below for how to stop the messages permanently.
You visited our website
We set no advertising cookies and run no analytics trackers, so there is nothing to opt out of. The Cookie Policy lists the browser storage the site and app use.
You are evaluating SDRclose for your organization
The Data Processing Addendum sets out how we process prospect data on your behalf, our sub-processor commitments and how we assist with requests from your prospects.
Account holders: controls in the app
Download my data. Settings > Privacy & Data provides Download my data, a one-click JSON export of your profile, leads, drafts, sent mail, sequences and activity. The export excludes the stored password hash and shows mailbox credentials and access tokens as redacted. It is the fastest way to exercise your rights of access and portability.
Delete my account. The same page provides Delete my account. Deletion requires your password, because it cannot be reversed. Your data is removed from the live service when you confirm; residual copies in routine backups fall out of retention within 30 days. Opt-out records created by your recipients are retained so their choice continues to be respected, as the Privacy Policy describes.
Data retention. An optional data retention setting, off by default, purges the bodies and subjects of replies, sent mail and finished drafts older than a period you choose, from 7 to 730 days, plus old notifications and activity logs. It runs daily while switched on. Leads, meetings, statistics and the suppression list are kept.
Open and click tracking. The account-level default is off, and you can enable tracking for individual sequences. When it is off, your messages carry no tracking pixel and no rewritten links.
Marketing email from SDRclose. You may opt out at any time using the unsubscribe link in any such message or through the contact form; opting out does not affect service messages needed to operate the account.
Recipients of email sent through SDRclose
Who sent the message. Email sent through SDRclose comes from the sender's own mailbox and domain, not from ours. The organization named in the message selected you, approved the message and decides how long to keep your details. It is the controller of your information; SDRclose acts only as its processor.
How to stop the messages. Use the unsubscribe option your mail client shows for the message, or the opt-out link in the message body. Either records a permanent opt-out that applies across every sequence and every mailbox belonging to that sender. A reply asking not to be contacted normally stops the sequence too, but the link is the reliable route.
How to identify the sender. Check the From address, the domain after the @ sign and the signature block. Requests to access, correct or delete your details go to that organization first, because it holds the record. Its own privacy notice describes how.
Where you cannot reach the sender. If the sender does not respond, or you cannot work out how to reach them, use the contact form and attach a copy of the message. We will identify the sending account, pass your request to that customer and require them to act. We will also suppress your address so that no further message reaches you from that sender through the platform.
Where your details came from. Contact details processed through the platform are either uploaded by the sender or obtained from a third-party business-contact data provider. The sender can tell you which applies to your record, and we assist it in establishing that.
Our own outreach. Where the sender of a message is SDRclose itself, we are the controller of that outreach; the same unsubscribe and request routes apply, and we rely on legitimate interests in reaching businesses that may benefit from our service.
Rights requests
Rights you can exercise. Depending on the law that applies to you, you may ask for access to your personal information, correction, deletion, restriction of processing, objection to processing (including an absolute right to object to direct marketing), and a portable copy of information you provided. You will not be treated differently for making a request.
How to submit a request. Submit it through the contact form, stating the right you are exercising and the email address the request concerns. Account holders can satisfy access, portability and deletion instantly with the controls in the app described above, which need no separate verification.
Verification. Before acting, we confirm that the request comes from the person entitled to make it, by sending a confirmation code to the email address the request concerns or by asking you to make the request from a signed-in session. We ask for identity documents only where no other method works.
Data held by a customer. Where the information is held only by a customer, such as a prospect record in that customer's workspace, the request must be made to that customer, because only it can decide how to respond. We will say so, point you to the customer where we can, and assist the customer as our processor obligations require.
Limits. We may decline part of a request where the law permits or requires it: for example where a retention obligation applies, where deletion would defeat an opt-out record, or where identity cannot be verified. We explain the reason in every case. Requests are free unless one is manifestly unfounded or excessive, and we will say so before charging anything.
Response timelines
These are the minimum standards we apply. Where the law gives you more, the law prevails. Every request receives a written response, whether we act on it or decline it.
| Region | First response | Extension | Appeal |
|---|---|---|---|
| European Economic Area, United Kingdom and Switzerland | Within one month of receipt | Up to two further months for complex or numerous requests, with notice inside the first month | Through the contact form; you may also complain to your supervisory authority |
| California | Acknowledgment within 10 business days; response within 45 calendar days | Once, by a further 45 days, with notice | Through the contact form; you may also contact the California Privacy Protection Agency or the Attorney General |
| Other US states with comprehensive privacy laws | Within 45 calendar days | Once, by a further 45 days, with notice | Decided within 45 days, or the period the state law allows |
| Everywhere else | Without undue delay and within 45 days | Only where the applicable law allows, with notice | Through the contact form |
Authorized agents
Where the law allows, you may authorize another person or organization to make a request for you. The agent submits it through the contact form with either your signed written permission naming the agent and the right being exercised, or evidence of a power of attorney or equivalent authority.
We may still verify the request with you directly, using the methods described under rights requests, and we may decline a request from an agent who cannot show authority. Opt-outs by recipients are tied to the address they protect and are not accepted in bulk on behalf of many recipients.
Appeals and complaints
Appeals. If you disagree with how we handled a request, reply through the contact form, quote the original request and tell us what you believe we got wrong. Someone not involved in the original decision reviews the appeal, and we respond in writing within the response timelines above, with the outcome and the reasons.
European Economic Area and United Kingdom. You may lodge a complaint with the supervisory authority of the country where you live or work, or where you believe an infringement occurred. In the United Kingdom, that authority is the Information Commissioner's Office. We ask for the chance to resolve the matter first, but that right does not depend on it.
California and other US states. California residents may contact the California Privacy Protection Agency or the California Attorney General. Residents of other states with comprehensive privacy laws may contact their state Attorney General; our response to an appeal explains how.
Everything else. Questions about this page are answered by the SDRclose team through the contact form. The Privacy Policy and the GDPR page carry the full detail behind each route described here.
Ready to make a request?
Contact us