DPIA outline

Processing

Allocatin profiles professional users and firms to apply hard filters, rank remaining candidates, and write a “why this match” explanation. Sources include claimed profile fields and a public-source directory. Models may draft explanations from those fields. Humans decide whether to connect.

Necessity and proportionality

Without filtering, a global manager/allocator graph is unusable. Hard filters are the minimum needed to exclude obvious mismatches. Soft-fit ranking does not exclude. We do not use the profile to make a legal or similarly significant decision about a person (GDPR Art. 22). We do not score retail credit, employment, or insurance.

Risks

• Incorrect public-source facts about a named professional.
• Over-disclosure if a user publishes fields they should have kept private.
• Transfer of professional data to US processors, including optional AI vendors.
• Claim email reaching a firm inbox that did not ask for it.

Measures

• Company-email claim and visibility rules.
• No pay-to-rank; no performance ranking.
• Human approval before send where outreach features exist.
• Objection, correction, and erasure via privacy request. Object and delete email a confirmation link, then unlist the person; a suppression record survives seed re-imports.
• Cookie consent and GPC for analytics.
• SCCs / UK Addendum with processors; model-region routing on request.
• Legitimate-interest assessment for the directory and claim email: LIA.

Residual risk and review

Residual risk is accepted for a B2B professional information service. This outline is reviewed when we add autonomous outreach, new special-category data, or a new high-risk model use. A fuller internal DPIA is available to a supervisory authority on request.