Your DMs are ready for an upgradeTry Now
SalesMorgan
Table of Contents
Back to Privacy Policy

Privacy Rights & Statutory Data Requests Guide

Information regarding data subject rights under GDPR, CCPA/CPRA, and global privacy frameworks

Overview of Privacy Rights

Sales Morgan respects individual privacy rights and provides transparent mechanisms for prospective leads, sequence recipients, and registered account holders to exercise statutory data rights under the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and applicable international privacy frameworks.

Whether your contact information was imported by a B2B sales team using Sales Morgan or you are an active platform subscriber, you may exercise any of the statutory rights detailed below free of charge.

1. Right to Erasure ("Right to be Forgotten")

You have the statutory right to request that all personal data, contact history, and associated records held by Sales Morgan be permanently purged from our active databases and infrastructure.

What occurs upon an Erasure Request:
  • Lead Record Deletion: Your name, corporate email address, job title, company name, phone number, and social profile handles are hard-deleted across all customer lead lists and sequence queues.
  • Message History Purge: Inbound and outbound message drafts, engagement logs, and telemetry timestamps linked to your address are permanently cleared.
  • Irreversible Cryptographic Suppression: To guarantee that your email is never re-imported or contacted in the future by any user, an irreversible SHA-256 one-way hash of your email is added to our Universal Suppression Matrix. No human-readable plaintext remains.

2. Right to Access & Data Export (Portability)

You have the right to request confirmation of whether Sales Morgan processes personal data relating to you, and to obtain a structured, machine-readable export of all such data.

The Data Access Export Package includes:
  • Specific categories of personal data recorded (e.g. business email, name, title).
  • Source attribution (the workspace or customer account that imported the lead record).
  • Purposes for processing and lawful basis under GDPR Article 6.
  • Third-party subprocessors that received data (e.g. AWS infrastructure, Cloudflare edge security).
  • Data is delivered in standard, accessible JSON or CSV format within statutory timelines.

3. Right to Opt-Out & Universal Suppression

You may at any time object to direct outbound communications and request permanent addition to our global "do-not-contact" suppression list.

Immediate Self-Service Opt-Out Options:
  • Reply Opt-Out: Replying with "STOP", "UNSUBSCRIBE", "REMOVE ME", or similar keywords to any email automatically triggers immediate suppression.
  • One-Click Header: Every email includes RFC 8058 standard one-click List-Unsubscribe headers for email client unsubscribe buttons.
  • Platform-Wide Block: Once suppressed, Sales Morgan prevents any customer or workspace from queuing or dispatching messages to that address platform-wide.

4. Right to Rectification & Correction

You have the right to request the correction of inaccurate personal data or the completion of incomplete records maintained across our platform.

If lead enrichment records, company association, or contact details in Sales Morgan are outdated or erroneous, submitting a rectification request ensures records are updated or suppressed across our active data repositories.

5. How to Submit a Privacy Rights Request

To exercise any of the statutory rights detailed above, please send a direct request to our designated Data Protection and Compliance team:

Data Protection Officer (DPO) ContactDirect email intake for GDPR, CCPA/CPRA, and privacy requests
privacy@salesmorgan.com

Please include the following details in your email:

  • Your Full Legal Name.
  • The Email Address or social handle subject to the request.
  • The Type of Request (e.g. Erasure / Right to be Forgotten, Data Access & Export, Universal Suppression, or Correction).
  • Any relevant campaign context or sender address that contacted you (if applicable).

6. Statutory Identity Verification Standards

Under GDPR Article 12(6) and CCPA Section 1798.130, Sales Morgan is legally obligated to verify the identity of any individual requesting access to or deletion of personal data before executing the request.

This verification standard exists to safeguard personal privacy and prevent unauthorized third parties from fraudulently exfiltrating or deleting records belonging to other individuals. Where a request originates directly from the specific email address in question, ownership is typically confirmed without requiring government-issued identification.

7. Statutory Response Timelines & SLAs

European Union & UK (GDPR)Responses and executions are fulfilled within 30 calendar days of receiving a verified request, free of charge.
California & US States (CCPA/CPRA)Requests are fulfilled within 45 calendar days, with written notification in the event of any complex extension.
General privacy questions?support@salesmorgan.com
View Complete Privacy Policy →