Privacy Policy

October 2026 update: We have added information about our AI assistant and the AI platforms our clients can connect it to, the information our clients store in our platform and our role when we host it, and how we score and rank professional contacts. We have also removed remaining references to website visitor identification, which we stopped using in September 2026.

Purpose

Athena BDA Ltd (known as Athena BDA) respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we process your personal data on our website (https://athenabda.com/) for clients, website visitors and professional contacts. This privacy notice also tells you about your privacy rights pursuant to UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR) and the EU GDPR, collectively known as Data Protection Laws.

Controller for Personal Data

Unless we notify you otherwise, Athena BDA Ltd (Company No. 15477746), 129 Tavistock Ave, St Albans, Hertfordshire, AL1 2NL is the controller of your personal data for the purposes described in this privacy notice and where we directly have a relationship with you, except for Client Content, which we process on our clients' behalf as a processor (see "Data Protection and Client Responsibilities" below).

Scope

This privacy notice applies to the processing of personal data by us in connection with:

• Clients: Individuals and companies who use Athena BDA's services and platform.
• Website visitors: Anyone browsing our website or interacting with us online.
• Professional contacts: Individuals whose professional business contact information is included in our business database which is provided to clients.
• Individuals in Client Content: People whose information our clients add to our platform, where we act on our clients' behalf (see "Data Protection and Client Responsibilities" below).

Types of Personal Data

Personal data or personal information means any information about an individual from which that person can be identified. Athena BDA may collect, use, store and transfer different kinds of personal data, including:

• Identity Data: Name, job title, seniority level, employer/company name.
• Contact Data: Business email address, business address, location (work).
• Financial Data: Payment details, for example where you are a client.
• Profile Data: Professional networking data (connection counts, employment start dates if publicly available), conference speaking engagements, professional activities, therapy/brand/disease area focus, and Intent Signals we derive from this information, such as a recent job change, news about a drug or brand you work on, or an upcoming conference appearance.
• Technical Data: IP address, browser type and device information, country/location.
• Account Data: Username, password, login credentials.
• Usage Data: Pages visited, time spent, referral sources, support enquiries, demo requests, feedback, survey responses, and the requests an AI assistant makes to our platform on your behalf, such as searches run and documents read.
• Communications Data: Information provided when requesting demos, client support or submitting surveys.
• Client Content: Information our clients and their users add to our platform. This includes their company and personal context documents (such as the companies, role types, therapy areas and locations they focus on), messaging playbooks, lead-scoring rules, their team's professional networking connections, and working notes our AI assistant keeps for each user.

We do not collect or process sensitive personal data (e.g. health/ethnicity), personal email or home information, or information about family members.

Lawful Bases: How We Use Your Personal Data

Athena BDA will only use your personal data where UK data protection law allows. Depending on your relationship with us, we process your data based on:

• Consent: Only if and where we ask and you choose to give it. You can withdraw consent at any time.
• Performance of a contract: To provide, register and support your account and service.
• Legal obligation: To comply with our legal obligations e.g. retention and accounting.
• Legitimate interests: For business intelligence database operation, B2B data provision, platform, service operation, improvement and sales and related support.

Where we process Client Content on our clients' behalf, our client decides the lawful basis for that processing (see "Data Protection and Client Responsibilities" below).

How We Collect Your Personal Data

Directly from you (Clients and Website Visitors): When you register, fill in forms, request a demo, send us correspondence, feedback or support requests, or add information to our platform, including through an AI assistant connected to our platform.

From third parties and public sources (Professional Contacts in our database):

• Licensed business intelligence providers
• Publicly available professional networking platforms
• Public business sources: company websites, event/conference lists, professional directories
• Email validation services or generated using standard business naming conventions

From our clients (Client Content): When our clients or their users add information to our platform, for example a messaging playbook or their professional networking connections.

Processing Tables

The processing tables explain why we process personal data and the lawful basis for doing so. Depending on your relationship with us, you may need to refer to different tables relevant to your specific interactions or services.

Client Processing Information

Website Visitor Processing Information

Professional Contacts (Database) Processing Information

Email Campaign Click Tracking

Where we send you a business email that links to our website, that link may contain a short reference code. If you open the page in a browser, our own software records that the link was visited, together with the page path and the time of the visit. The reference code corresponds to a contact record we already hold, so the visit is associated with your existing record.

This is first-party processing. The information is sent to our own secure database, which is the same infrastructure that runs our customer relationship management system. It is not shared with a third-party advertising or analytics provider, and it is not used to build profiles of your activity across other websites. No cookie is set for this purpose and the reference code is removed from the address bar after the visit is recorded.

We do not identify anonymous visitors to our website. We only record a visit in this way where you have followed a link from a business email we sent to you.

We rely on legitimate interests as our lawful basis, specifically our interest in understanding whether our business-to-business communications are relevant and in following up proportionately with professional contacts. The categories of personal data processed are Identity Data, Contact Data, Technical Data and Usage Data, as defined earlier in this notice.

Your choices:

• Do not follow the link: Nothing is recorded unless you open the linked page in a browser.
• Object or request erasure: Contact us at adrian@athenabda.com or use our Data Compliance Centre to object to this processing, ask us to stop using tracked links for you, or exercise any of your other rights set out in this notice.

Our AI Assistant

Our clients can use Aidrian, our AI assistant, by connecting our platform to an AI service they already use, such as Claude (provided by Anthropic) or ChatGPT (provided by OpenAI). The client chooses whether to connect, and uses their own account with that provider.

When a client's user asks their assistant a question, our platform returns the information needed to answer it. This can include professional contact information from our database, drug and conference information, and that client's own Client Content. The conversation itself takes place on the AI provider's platform and is governed by the client's own agreement with that provider. We receive the requests the assistant makes to our platform, not the full conversation.

Files a user attaches in a conversation are used by the assistant to help draft in that conversation. We do not store them unless the user asks the assistant to save content to their documents in our platform.

We do not use Client Content, or information from conversations with the assistant, to train AI models.

For professional contacts in our database: our clients may use the assistant to find, prioritise and prepare business communications to relevant contacts. This uses the same professional information described elsewhere in this notice, and our clients remain responsible for any communications they send.

Data Protection and Client Responsibilities

Our clients act as independent data controllers and determine how they use the information we provide. They are solely responsible for ensuring that their use of such information complies with applicable Data Protection Laws and for providing their own privacy notices to data subjects. Once a client receives the information they are responsible for any communications they send and for their own legal compliance in relation to such communications. We require our clients to respect data subjects' rights and to inform data subjects of processing activities through a privacy notice.

Our clients are independent data controllers:

• They are responsible for their own compliance with Data Protection Laws.
• They make their own decisions about how to use the information.
• They have their own privacy policies and opt-out mechanisms.
• Athena BDA is not responsible for how they use the information once accessed.
• Athena BDA does not act as a data processor for its clients in relation to our business contact database.

By remaining in our database, you may be contacted by the client when they are conducting their business-to-business sales, marketing and recruiting activities. Communications you receive from our client may be relevant to your profession or employment role, but we cannot guarantee that you will find such communications to be relevant or of interest to you.

Information our clients store in our platform (Client Content). Where our clients and their users add their own information to our platform, we process it on their behalf and on their instructions, as a data processor. The client is the controller of that information.

We use Client Content only to provide our services to the client that added it. We do not share it with other clients, add it to our business contact database, or use it to train AI models, or for any purpose of our own beyond providing, securing and supporting our service to that client. This includes professional networking connections a client adds so the assistant can highlight people their team already knows: these are visible only to that client.

If you believe one of our clients holds information about you in our platform, please contact that client directly. If you contact us, we will pass your request to the relevant client and help them respond.

Data Protection Impact Assessment (DPIA)

We have conducted a Data Protection Impact Assessment (DPIA) considering the limited visibility of the processing to the individuals concerned to ensure that appropriate safeguards are implemented to protect their rights and interests. The information we process relates strictly to an individual in their professional capacity and is used solely within a B2B business context primarily for business intelligence in the pharmaceutical and life science sector. Our DPIA has been updated to cover our AI assistant, the scoring and ranking of professional contacts, and the hosting of Client Content.

We do not process data relating to children or vulnerable individuals. These safeguards ensure that the impact on your privacy is minimal and that our business use of your data remains fair, relevant and lawful.

Exercising Your Opt-Out and Data Access Rights

We have established a Data Compliance Centre where you can exercise your data rights. You can submit two types of request:

• Opt Out of Our Database (labelled 'Do Not Sell My Information' on our website) — If you do not want your professional information to be included in our contact database or shared with our clients, submit an opt-out request via the Data Compliance Centre. You will need to provide your email address and country. You may also provide your LinkedIn profile URL, which helps us ensure we do not re-import your details if you change employer in the future. Once processed:
  • We will add you to our suppression list and ensure you are not re-imported in future data refreshes.
  • Your data will be removed from future provision to our clients but may remain with third parties who obtained it previously or from other sources.
  • Your suppression record is retained indefinitely so we can honour your opt-out on an ongoing basis.
• Access, Correct or Delete My Data — If you wish to request a copy of the personal data we hold about you, have inaccurate information corrected, or request deletion of your data, you can submit a request via the Data Compliance Centre. You will need to provide your email address, country and the type of request you are making. You may also provide your name, company, job title and any additional context to help us locate your records and process your request efficiently.

We aim to complete all requests within 24 hours of receipt. In all cases, your request will be fulfilled within one month in accordance with applicable legal requirements. We may need to verify your identity before processing your request as a security measure to ensure personal data is not disclosed to any person who has no right to receive it.

You can also contact us directly at adrian@athenabda.com if you prefer to submit your request by email or have any questions about the process.

These requests cover the information Athena BDA holds as controller. For information a client has added to our platform as Client Content, please see "Data Protection and Client Responsibilities" above.

Who We Share Your Information With

In certain circumstances, we may disclose your personal information to third parties for contract fulfilment purposes, legitimate purposes and other reasons subject to this privacy notice. Such circumstances include:

• Internally: Your personal data will be used by our employees and contractors who are working on providing our services on a need-to-know basis.
• With our affiliates: We may share information within our corporate group to operate and manage our business effectively and to provide you with the services you request.
• Our service partners: With vendors or other third parties who perform services on our behalf (for example IT management, client support, and cloud storage).
• AI platforms our clients connect: Where a client connects our AI assistant to an AI platform such as Claude (provided by Anthropic) or ChatGPT (provided by OpenAI), we return information, including professional contact information from our database, to that platform at the client's request. The client's use of that platform is governed by their own agreement with its provider.
• Legal advisors: To enforce any applicable terms of service and to protect or defend our rights and the rights of our users or others.
• Professional advisers: Including bankers, auditors and insurers who provide consultancy, banking, insurance and accounting services.
• Payment Service Intermediaries: These providers help facilitate payment to us.
• Business transactions (M&A): In connection with a business transaction such as a merger or acquisition. Where this is the case, your personal data shall continue to be processed in accordance with this privacy notice.

Marketing Communications

We may send prospective clients or clients marketing communications. You have the right to object to processing of your personal data for direct marketing purposes. You can unsubscribe from receiving marketing communications from us by using the unsubscribe methods contained in communications we send to you or by contacting us at adrian@athenabda.com. Where you opt out of receiving marketing communications this will not apply to personal data provided to us as a result of registering for or using our service, your service experience or other interactions with this website.

International Transfers (UK/EU)

We may transfer and process your personal data outside of the United Kingdom (UK) / European Union (EU) to countries where data protection laws are less stringent than those in the UK/EU. When we transfer your personal data outside of the UK/EU we only do so to entities that offer the same level of data protection as that afforded by the UK Data Protection Act 2018 (including the UK GDPR) and the EU GDPR / Data Protection Laws. Specifically:

1. We will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information; or
2. We will use specific contracts approved for use in the UK or EU which give personal information the same protection it has in the UK/EU. For example, the use of Article 46 UK and EU GDPR safeguard mechanisms endorsed by the UK Government or European Commission.

For other countries we will use local law guidance to ensure personal data is transferred securely where there is a requirement in law to do so.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

Client Content is kept separate for each client and is visible only to that client's authorised users. Personal context documents and the assistant's working notes for a user are visible only to that user and to the people their organisation has authorised to manage its set-up.

The transmission of information via the internet is not completely secure. Although we will take reasonable measures to protect your personal data, we cannot guarantee the security of your information transmitted and any transmission is at your own risk.

Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

Client and Website Visitor Data: We retain this information for as long as you maintain an account with us plus up to 3 years after account closure for legal and business purposes.

Business Contact Data: We retain professional contact information for up to 3 years from the date of last verification or update unless:

• You request deletion earlier.
• The information becomes demonstrably inaccurate or outdated.
• Our legitimate interest basis no longer applies.

Client Content: We keep Client Content while the client's account is active and delete it within 90 days of the account closing, unless the client asks us to return or delete it sooner.

Suppression List (Exception): If you opt out or request deletion, we retain your contact details on a suppression list indefinitely to ensure we do not re-import or re-process your information from future data refreshes.

Data Subject Rights

Under certain circumstances, you have rights under Data Protection Laws. Not all rights are absolute and depending on where you are located, not all rights are given to you. You can:

• Request access to your personal data: Known as a "subject access request" — enables you to receive a copy of the personal data we hold about you.
• Request correction of your personal data: This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal data: This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. We may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you at the time of your request.
• Object to processing of your personal data: Where we are processing your personal data based on a legitimate interest and you may challenge this. We may be entitled to continue processing your information based on our legitimate interests or where this is relevant to any legal claims.
• Request restriction of processing: This enables you to ask us to suspend the processing of your personal data in certain scenarios, for example if you want us to establish the information's accuracy or where our use of the information is unlawful but you do not want us to erase it.
• Request transfer of your personal information (data portability): In some circumstances we will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.
• Right to withdraw consent: Where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
• Automated decision making and profiling: We use automated scoring to rank professional contacts against our clients' own criteria, which is a form of profiling. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Our clients decide whether, and how, to contact anyone.

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than one month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

To exercise any of the rights set out above, please visit our Data Compliance Centre or contact us directly at adrian@athenabda.com.

Keeping Personal Information Accurate and Current

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. Please contact us if you wish to update your personal data.

Concerns and Complaints

We would appreciate the chance to deal with your concerns in the first instance — please contact us at adrian@athenabda.com. If you have unresolved issues, you have the right to complain at any time to a data protection supervisory authority such as the UK data protection regulator — the Information Commissioner's Office (ICO). You may also lodge a complaint with a supervisory authority if you live or work outside the UK or you have a complaint concerning our personal data processing activities.

Changes to Our Privacy Notice

This privacy notice may be changed from time to time in response to legal, technical or business developments. We will take appropriate measures to inform you when we update our privacy notice. We will obtain your consent to any material privacy notice changes if and where this is required by applicable Data Protection Laws.

Contact Us

If you would like more information about the way we manage personal information that we hold about you, please contact us at: adrian@athenabda.com

Version last updated: October 2026