Last updated 19 August 2026

Privacy notice

If you received an email from roland@getbastrax.com, this page tells you exactly what is held about you, where it came from, and how to make it stop or make it go away.

Who is responsible

Roland Obasohan, trading as Bastrax, Bellinzona Str.28, München, 81475, Germany, is the controller for the processing described here, within the meaning of Article 4(7) GDPR. Contact for any privacy matter: roland@getbastrax.com. There is no separate data protection officer — the thresholds in §38 BDSG are not met — and that address reaches the founder directly.

Full provider details are in the Impressum.

What is held

Business contact and company data only. Specifically:

• Name, job title, business email address, and where public, a LinkedIn profile URL.
• Company name, website, industry, approximate headcount, location, and technologies detected on the company’s own public website.
• Publicly posted company signals — job adverts, public repositories, public forum posts — used to judge whether the company fits the profile described on the home page.
• A record of messages sent to you and any reply you send back, including its classification, so that a request to stop is honoured and not repeated.

No special-category data, no consumer or private-individual contact details, no purchased lists, and no data about your private accounts.

Where it came from

Public sources and business-data providers, not from you directly. The sources in use are:

Each of these providers publishes its own privacy notice covering how it collected the data before passing it on.

Why, and on what legal basis

Purpose: to identify companies that plausibly need what Bastrax does, and to make one relevant, individually addressed business approach with a short follow-up sequence.

Legal basis: legitimate interests, Article 6(1)(f) UK/EU GDPR — the interest being direct business-to-business marketing of a relevant service. The balance was assessed as follows: the data is professional rather than personal, the contact is low-volume and individually relevant rather than bulk, the sender identity is real and replies are read by a person, and opting out takes one reply. Where local rules require prior consent for electronic marketing to a given recipient, those rules take precedence and no message is sent on this basis.

Bastrax does not sell, rent, or share this data with third parties for their own marketing.

Automated processing

Scoring, message drafting and reply classification are automated. A score decides only whether a company is contacted about a service — it produces no legal or similarly significant effect, grants or denies nothing, and can be overridden by a person. Drafted messages are generated by a large language model from the factual signals listed above; the underlying reasoning for any individual decision can be provided on request.

Who else processes it

Processors acting on documented instructions, not independent recipients:

• Google Workspace — the mailbox outreach is sent from and replies are received in.
• Resend — account and service email for Bastrax customers.
• Anthropic — language-model drafting and classification.
• Cal.com — meeting scheduling, where a meeting is booked.
• Stripe — billing, for paying customers only.
• The data providers listed above, at the point of enrichment.

Some of these are established outside the UK/EEA. Transfers rely on the providers’ standard contractual clauses or an applicable adequacy decision.

How long it is kept

The retention criterion is relevance, not a fixed clock: a prospect record is kept while the company still looks like a plausible fit for the service and no opt-out has been received. There is no automated expiry beyond that, which is why the two routes below are the ones that matter.

If you opt out, the record is kept and marked as suppressed. That is deliberate: a suppression mark is the only reliable way to guarantee no future message is sent to you. The record is used for nothing except that check.

If you ask for erasure, your identifying details — name, email address, LinkedIn URL, phone number — are irreversibly overwritten with placeholders, and the subject and body of every message and reply on the record are erased. What survives is a de-identified company-level entry that can no longer be connected to you, plus a dated log of the erasure itself (a reference, a timestamp, and counts — no personal data), kept as the record that the request was honoured.

Your rights

Object to direct marketing

Absolute, and takes effect immediately. Reply to any message, or write to the address below.

Access

A copy of everything held about you, including where each field came from.

Rectification

Correction of anything wrong — enrichment providers are frequently out of date.

Erasure

Irreversible removal of everything that identifies you, as described above.

Restriction and portability

Available on request where the conditions in the GDPR are met.

Complain

To your national supervisory authority. That right exists whether or not you raise it with Bastrax first, though the fastest route is usually to ask directly.

To exercise any of these, email roland@getbastrax.com. No particular form of words is needed. Requests are actioned within 30 days and usually the same week; opt-outs are actioned immediately.

This website

This site sets no cookies, embeds no third-party scripts, runs no analytics, and loads no external fonts or images. Nothing you do on this page is tracked. The host records standard server request logs for security and abuse handling.

Changes

Material changes will be reflected in the date at the top of this page. The current version is always the one published here.