This Data Protection Impact Assessment (DPIA) evaluates the privacy risks arising from Tentrois Ltd's 6-stage B2B lead intelligence pipeline. This assessment is conducted in accordance with Article 35 of UK GDPR.
| Field | Detail |
|---|---|
| Data Controller | Tentrois Ltd |
| Assessment Date | 2 April 2026 |
| Processing Purpose | B2B lead intelligence — scoring, enriching, and delivering qualified business leads |
| Lawful Basis | Legitimate Interest (Art. 6(1)(f)) — see LIA |
| Data Subjects | Business professionals at mid-market companies (employees at companies with fewer than 5,000 staff) |
| Stage | Processing Activity | Data Involved |
|---|---|---|
| 1. Extraction | Collect data from 54 public sources (job boards, RSS feeds, government registries, APIs) | Company names, domains, job titles, news mentions, filing data |
| 2. Transformation | Normalise, deduplicate, and verify data quality | Same as above, cleaned and merged |
| 3. Signal Intersection | Score companies on 5 signal vectors (hiring, funding, tech stack, growth, registration). Filter enterprises (5,000+ employees) | Signal scores, company metadata |
| 4. XGBoost Scoring | Machine learning propensity scoring to rank leads | Feature vectors derived from signals |
| 5. AI Enrichment | LLM generates 12 intelligence layers per lead (company summary, pain points, outreach scripts) | Company name, domain, signals, contact title sent to LLM API |
| 6. Delivery | Route leads to subscribed clients by niche | Enriched lead data delivered via dashboard |
All data is sourced from publicly available endpoints:
| Risk | Likelihood | Severity | Overall | Mitigation |
|---|---|---|---|---|
| Inaccurate data delivered to clients | Medium | Low | Low | Multi-stage validation, deduplication, signal threshold (3+ signals required) |
| Excessive data collection beyond purpose | Low | Medium | Low | Enterprise blocklist (5,000+ employees filtered), data minimisation at extraction |
| Unauthorised access to lead data | Low | High | Medium | JWT authentication, bcrypt passwords, role-based access, TLS encryption |
| Data breach at infrastructure provider | Low | High | Medium | SOC 2 compliant providers (Supabase, Render), encrypted at rest |
| LLM provider retaining prompt data | Low | Medium | Low | Prompts contain only business-context data (company name, domain, signals). No personal identifiers beyond business title. API terms reviewed. |
| Data subject unable to exercise rights | Low | Medium | Low | Clear contact mechanism (privacy@tentrois.com), 30-day response commitment |
| Re-identification from enriched profiles | Low | Low | Low | Enrichment is company-level analysis, not individual profiling |
Our pipeline includes automated scoring (XGBoost propensity model) and AI-generated enrichment. However:
This processing therefore does not fall within the scope of Article 22 (automated individual decision-making).
| Provider | Location | Purpose | Safeguard |
|---|---|---|---|
| Supabase | EU (AWS eu-west-2) | Database hosting | EU adequacy, SCCs |
| Render | US/EU | Application hosting | SCCs |
| Google (Gemini API) | US | AI enrichment | SCCs, data processing terms |
This DPIA has been reviewed internally. Given that residual risks are assessed as low to medium after mitigations, prior consultation with the ICO under Article 36 is not required at this stage.
This DPIA will be reviewed: