Skip to main content
This page answers the questions that come up in a data, privacy, or security review of the CompanyEnrich API: where the data comes from, which personal data it contains, what happens to the data you send, and how a person can have their record removed.
This page is a summary for teams evaluating or integrating the API. The Privacy Policy, Data Processing Addendum, and Trust Center are the governing documents. If this page differs from one of them, the legal document applies.

Where the data comes from

We build company and people records from dozens of sources in the categories below. This page names source categories, not individual providers. Some fields are derived, not collected. Machine learning models classify each company’s industries, detect its business model for categories, and tag its keywords. revenue is an estimated range.

How records are built and checked

Every record passes through four steps before it reaches the API.
1

Collect

Raw records arrive from registries, web crawls, and partner feeds.
2

Deduplicate and merge

Entity resolution matches the records that describe the same company or person across sources, merges them, and resolves conflicts between sources.
3

Validate and enrich

Automated checks and AI models verify domains, addresses, and social links.
4

Refresh

Records are re-verified on a rolling basis, defunct entries are removed, and new companies are added every day. The updatedAt field on each record shows when it was last updated.

Personal data in the API

People records contain professional and business information:
  • Name and profile image
  • Current position, seniority, and department
  • Country and reported location
  • Professional profile URL
  • Work history, and education when you request it
  • Work email, through a separate lookup
The person schema lists every field. The API returns no personal data fields beyond that list. We do not collect or process sensitive personal data, including:
  • Racial or ethnic origin
  • Religious or political beliefs
  • Genetic or biometric data
  • Information about children under 18
  • Government-issued identification, such as Social Security numbers

Privacy laws and roles

We maintain contractual and operational measures that support GDPR requirements: a Data Processing Addendum (DPA), EU Standard Contractual Clauses, and a process for individual data requests. Individuals can also request access or deletion, and opt out of the sale or sharing of their information, where the CCPA or a similar law applies. The DPA covers the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, Türkiye’s Law No. 6698 (KVKK), and applicable US state privacy laws. Who is the controller depends on the data:
  • DPA. For self-service customers, the DPA is part of the Terms and applies when you accept them. Enterprise customers can add it to an order form or sign it separately.
  • International transfers. Where a restricted transfer applies, the DPA incorporates the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and the adaptations for Swiss transfers. Schedule 5 of the DPA lists processing and access locations.
  • Legal basis. The Privacy Policy states the legal bases we rely on: legitimate interests and, where required, consent.

What happens to the data you send

We process the personal data you send only on your instructions, to provide the service you requested.
  • It is not used to train models and is not added to the CompanyEnrich dataset.
  • It is not sold or shared, and it is not used for advertising targeted to individuals.
  • API response content is not stored. Logs record only whether a request succeeded or failed.
Cancelling a paid plan does not close your account. To close and delete it, email legal@companyenrich.com.
Do not send special-category or sensitive personal data, children’s data, government identification numbers, financial-account credentials, payment-card data, protected health information, biometric identifiers, or precise geolocation. The API is not intended for them.

Opt-out, access, and deletion requests

Any person can ask us to give them access to their data, correct it, delete it, or stop selling or sharing it. They do not need an account. Which rights apply depends on the applicable law.
  • How to submit a request. Use the privacy request page or email legal@companyenrich.com. Include the name, email address, professional profile URL, or company details needed to find the right record.
  • Opt-out timing. We process an opt-out as soon as reasonably possible, and no later than 15 business days after we receive it. An opt-out needs no identity verification.
  • Access, correction, and deletion. We may verify these requests, and we respond within the period the applicable law requires.
  • What we keep. We use the details in an opt-out request only to identify the record, process the request, keep the record from being re-added, and maintain legally required records.
If a person contacts you about data you received from CompanyEnrich, you are responsible for the copy in your own systems. To have the source record suppressed as well, direct them to the privacy request page.

Security and hosting

The Trust Center lists every confirmed control and the current assurance status. Section 11 of the DPA explains how customers can review or audit our processing.

Your responsibilities

  • Have a lawful basis for the personal data you send and for how you use the personal data the API returns. This includes any notices and consents your use requires.
  • Respond to rights requests about the data in your own systems.
  • Keep your API tokens secret. See Authentication.

Contacts

Trust Center

Controls, infrastructure, and legal documents.

Our Data

Coverage, source types, and the quality pipeline.

Data Processing Addendum

Processor terms, deletion, audits, and transfers.

Privacy request

Request access, correction, deletion, or an opt-out.

Person schema

Every field in a person record.

Company schema

Every field in a company record.