Privacy
Privacy policy
Last updated: 24 July 2026
This policy explains how Collaby BV, trading as From Cold To Warm, handles personal data as a data controller: on this website, when you contact us or become a client, and when we run account-based marketing. It is written under the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and Belgian data protection law.
When we process personal data on behalf of a client (for example the client's own CRM data, or contacts inside the client's target accounts), the client is the controller and we act as processor. That relationship is governed by our data processing agreement. The legal basis we and our clients rely on for account-based marketing is set out in our legitimate interest assessment.
1. Who is responsible
The controller is Collaby BV (BE 0744.962.770), Steenbergstraat 25, 3078 Kortenberg, Belgium. For any privacy question or to exercise your rights, contact hello@fromcoldtowarm.com. We have not appointed a Data Protection Officer, as we are not legally required to; the person responsible for privacy questions is Dylan Mendes.
2. Whose data we process
- Website visitors — people who browse fromcoldtowarm.com.
- Prospects and contacts — people who contact us, book a call or exchange emails with us.
- Clients and their staff — the people we work with to deliver a service.
- Business contacts in target accounts — professionals at companies we, or our clients, run account-based marketing towards (as controller for our own marketing, and as processor for a client's marketing).
3. What data we process, why, and on what legal basis
| Context | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Website analytics | Pages viewed, clicks, anonymised session recordings, approximate location, device/browser | Understand and improve how the site is used | Consent (Art. 6(1)(a)); nothing loads before you accept the banner |
| Contact and calls | Name, business email, company, role, message, scheduling data | Respond to you, hold meetings, and follow up | Pre-contract steps / legitimate interest (Art. 6(1)(b) and (f)) |
| Client delivery | Contact and account details, project data, access credentials you provide | Deliver, support and invoice the service | Performance of a contract (Art. 6(1)(b)) |
| Our own account-based marketing | Business contact and firmographic data (name, role, company, business email, professional profile, buying signals) | Identify and warm up relevant business accounts before a first conversation | Legitimate interest (Art. 6(1)(f)) — see our LIA |
| Bookkeeping and law | Invoicing and transaction data | Meet accounting, tax and other legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not seek out or use special categories of data (such as health, religion or political opinion), and we do not carry out automated decision-making that produces legal or similarly significant effects on you.
4. Where the data comes from
We collect data directly from you (when you visit, contact us or become a client) and, for account-based marketing, from public and licensed sources: professional networks, company websites, and reputable business data and enrichment providers. When we use enrichment providers, we require them to have a lawful basis for making the data available.
5. Who we share data with
We do not sell your personal data. We share it only with the service providers (processors) that help us run our business and deliver the service, and with authorities where the law requires it. Our main sub-processors are:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Cloud hosting, application server and database (self-hosted Supabase, n8n, CRM) | Germany / Finland (EU) |
| Cloudflare, Inc. | DNS, CDN, TLS and inbound email routing | USA (SCCs / EU-US DPF) |
| PostHog Inc. (EU Cloud) | Website product analytics (consent-gated) | EU (Frankfurt) |
| LinkedIn Ireland Unlimited Company | Advertising delivery and matched audiences | Ireland (EU) / USA (SCCs) |
| Meta Platforms Ireland Ltd. | Advertising delivery and custom audiences | Ireland (EU) / USA (SCCs) |
| Google Ireland Ltd. | Advertising delivery and measurement | Ireland (EU) / USA (SCCs / EU-US DPF) |
| Anthropic PBC | AI processing for message contextualisation | USA (SCCs) |
| Calendly LLC | Meeting scheduling | USA (SCCs / EU-US DPF) |
| Data enrichment providers | Business contact and firmographic enrichment (list to be finalised per engagement) | EU / USA (SCCs) |
6. International transfers
We keep the core of our infrastructure and database within the European Union. Some providers listed above are based in, or transfer data to, countries outside the EU (notably the United States). Where that happens, the transfer is protected by an adequacy decision, the EU Standard Contractual Clauses, and/or certification under the EU-US Data Privacy Framework.
7. How long we keep it
- Analytics data: retained by our analytics tool for a limited period, then aggregated or deleted.
- Prospect and contact data: kept while there is a reasonable prospect of a business relationship, then reviewed and removed.
- Client data: kept for the duration of the engagement and a reasonable period afterwards.
- Accounting records: kept for as long as Belgian law requires (currently up to 7 years).
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where the conditions are met;
- restrict or object to processing, including objecting to direct marketing and to processing based on legitimate interest;
- receive your data in a portable format; and
- withdraw consent at any time, without affecting processing that already took place.
To exercise any of these, email hello@fromcoldtowarm.com. We respond within one month. If you object to our account-based marketing, we will stop processing your data for that purpose.
9. Cookies
This site loads no analytics or advertising cookies until you accept them in the banner. If you decline, the site works exactly the same. You can change your mind any time by clearing this site's cookies, and the banner will ask again. A short summary is also on our cookie page.
10. Complaints
If you think we have handled your data wrongly, please tell us first so we can put it right. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, Belgium (www.gegevensbeschermingsautoriteit.be), or with the supervisory authority in your own country.
11. Changes
We may update this policy. The version shown here, with the date at the top, is the one that applies.