Data Protection Impact Assessment

1. Processing description

TRM Flex Limited processes role-based business contact data (name, work email, job title, seniority, employer) sourced from Apollo.io to deliver low-volume, role-relevant introductions about its Event Operations Platform to UK event, venue and hospitality decision-makers.

2. Lawful basis

• UK GDPR Art 6(1)(f) — Legitimate interest (cold B2B introduction).
• PECR Reg 22(2) — corporate subscriber (limited companies, LLPs, partnerships).
• Standing Legitimate Interest Assessment dated 2026-05-06, valid 12 months.

3. Necessity & proportionality

Cold outreach to a tightly-filtered cohort of role-relevant corporate contacts is the proportionate way to introduce a niche operational platform at this scale. We exclude consumers, sole traders, interns and students by data filter. Volume is throttled by deliverability circuit-breakers and per-domain caps.

4. Identified risks & mitigations

5. Data subject rights

Subjects can object, access, rectify or erase their data at any time via /data-request or by emailing privacy@trmflex.com. All requests are fulfilled within 30 days.

6. Residual risk

With the controls above in place the residual risk is assessed as low. No prior consultation with the ICO is required.