Legal
Privacy Policy
Last updated: 2 November 2026
This policy explains how Olicana Outbound Limited (“Olicana”, “we”, “us”) collects and uses personal data — on this website, with our clients, and in the B2B email campaigns we run. We have tried to keep it plain and specific.
1. Who we are
Olicana Outbound Limited is a B2B outbound email agency, registered in England and Wales under company number 17528524. Our registered office is 3 Northcroft Grove, Ilkley, LS29 9BB.
For anything in this policy — including opting out or exercising your rights — email max@olicana.co or write to us at the address above.
ICO registration number: [add once registered]
2. Who this policy covers
•
Website visitors to olicana.co
•
Enquirers and prospective clients — people who book a call, email us or fill in our onboarding form
•
Clients and their staff
•
Business contacts we email — decision-makers at companies we contact about our own services, or on behalf of our clients
3. The data we collect and where it comes from
Data you give us: your name, job title, company, business email, phone number, and anything you tell us on a call, by email or in our onboarding form. Clients also give us billing details and information about their business, offer and target market.
Business contact data from other sources: for our outreach we collect professional details only — name, job title, employer, business email address, company size, industry, location and public company information. We obtain this from:
•
B2B data providers, including Apollo
•
LinkedIn (including LinkedIn Sales Navigator)
•
Data enrichment tools, including Clay and the providers it connects to
•
Public sources, such as company websites and Companies House
•
Our clients, where a client supplies a list of its own leads or past customers for us to contact on its behalf
Campaign data: whether an email was delivered, opened or replied to, the content of replies, and whether a meeting was booked.
Website data: we use Framer’s built-in analytics, which is cookieless and anonymised and does not identify you. If you use our booking calendar, Calendly collects the details you enter. See our Cookie Policy.
We do not collect special category data (such as health, ethnicity, religion or political views), and we do not knowingly collect data about anyone under 18.
4. How we use it and our lawful basis
Email business contacts about our services, or our clients’ services, that are relevant to their role
Lawful basis: Legitimate interests — growing our and our clients’ businesses through relevant B2B contact
Respond to enquiries and run sales calls
Lawful basis: Legitimate interests, or steps before entering a contract
Deliver our services to clients, invoice and keep records
Lawful basis: Performance of a contract; legal obligation (tax and accounting)
Keep a suppression list of people who have opted out
Lawful basis: Legitimate interests and legal obligation — so we never contact you again
Measure and improve our website and campaigns
Lawful basis: Legitimate interests
Before relying on legitimate interests for outreach we assess whether contact is relevant to the person’s role, whether they would reasonably expect it, and whether it is proportionate. We keep a record of that assessment.
5. Business email, international contacts and opting out
We contact business decision-makers in the UK, the United States, Canada and Australia. We do not run outreach campaigns to people in the EU or EEA. We follow the email marketing rules of the country where each recipient is based. In particular:
•
UK: we only send unsolicited marketing emails to business addresses at limited companies, LLPs and other corporate bodies — not to sole traders or non-corporate partnerships, where prior consent is required.
•
United States: our emails comply with the CAN-SPAM Act — accurate sender details, honest subject lines, a valid postal address and an opt-out we honour promptly.
•
Canada and Australia: we only contact people whose business email address has been publicly published in connection with their role, about matters relevant to that role, and never where they have said they do not want marketing messages.
Every email we send identifies the sender and gives a free, simple way to opt out — reply to say so, or email max@olicana.co. Once you opt out we stop contacting you and add your email address to our suppression list, which we keep so that you are not contacted again by us or in any campaign we run.
6. Our role in client campaigns
When we run campaigns for a client (directly or through an agency partner), the client usually decides who should be contacted and why, so the client is the controller and we act as its processor, following its written instructions. Where we choose the targeting and source the data ourselves, we may act as a controller, alone or jointly with the client.
Whichever applies, you can contact us at max@olicana.co: we will act on any opt-out straight away and pass any other request to the right party.
7. Use of AI tools
We use AI tools to help research companies, draft and personalise emails, and sort replies so that interested contacts get a fast response. A person at Olicana oversees our campaigns. We do not make any decisions about you by automated means that have legal or similarly significant effects.
8. Who we share data with
We do not sell personal data. We share it only with:
•
Service providers who process it for us: Google Workspace (email and documents), Smartlead (email sending), Calendly (booking), Framer (website hosting and analytics), and our data and enrichment providers
•
The client on whose behalf a campaign is run — for example, sharing your reply or booking a meeting with them
•
Agency partners we deliver campaigns with, under written agreements
•
Professional advisers such as accountants, banks, insurers and lawyers
•
HMRC, regulators or law enforcement where the law requires it
9. International transfers
Some of our providers are based in, or use servers in, the United States and other countries outside the UK. Where data leaves the UK we rely on UK adequacy regulations (including the UK–US Data Bridge, where the provider is certified) or on approved contract terms such as the UK International Data Transfer Agreement or Addendum.
10. How long we keep data
•
Outreach contacts who don’t engage: up to 12 months from our last contact
•
Enquiries and sales conversations that don’t lead to a contract: up to 2 years
•
Client records: for the length of the contract and 6 years after, for tax and legal reasons
•
Suppression list: indefinitely, holding only the minimum needed (usually just an email address) to make sure you are not contacted again
11. Keeping data secure
We use reputable providers, two-factor authentication, restricted access and encrypted connections. Only people who need data for their work can access it, and they are bound by confidentiality. If a breach occurs that is likely to affect you, we will tell you and the ICO where the law requires.
12. Your rights
You have the right to:
•
access the personal data we hold about you
•
have inaccurate data corrected
•
have your data deleted
•
restrict how we use it
•
object to our use of it — including an absolute right to object to direct marketing
•
receive your data in a portable format, where applicable
•
withdraw consent, where we rely on consent
Email max@olicana.co to use any of these rights. It is free, and we will respond within one month. We may ask you to confirm your identity first.
13. Complaints
If you are unhappy with how we have handled your data, please tell us first at max@olicana.co and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
If you are outside the UK, you may also have rights under your local privacy law and can complain to your local regulator — contact us first and we will help.
14. Changes to this policy
We will update this policy when our practices change. The date at the top shows when it was last updated.