Privacy Notice — Business Contact Data Obtained from Third Parties

Last updated: June 11, 2026

1. Who We Are

New River Strategies LLC (“we,” “us,” “our”), a company registered at 4615 Sedgwick Street NW, Washington, DC 20016 is the data controller responsible for the personal data described in this notice.

Contact: hello@newriverstrat.com | 4615 Sedgwick Street NW, Washington, DC 20016

2. Scope of This Notice

This notice explains how we process personal data relating to business contacts whose information we did not collect from them directly, but instead obtained from third-party data vendors, lead-generation providers, business partners, and publicly available sources. It is provided in accordance with Article 14 of the EU General Data Protection Regulation (“GDPR”) and, where applicable, the UK GDPR.

3. Personal Data We Process

We process the following categories of personal data about you:

• Identity data: full name
• Contact data: business email address
• Professional data: job title and employer/organization name

We may supplement this data with additional information we generate through our own processing, such as records of our communications with you, engagement data (e.g., whether you opened or responded to our communications), inferred interests, and lead scores.

4. Source of Your Data

We obtained your personal data from one or more of the following sources:

• Third-party data vendors and lead-generation providers, including IR Impact, who have represented to us that the data was collected and shared lawfully;
• Business partners, resellers, and event co-organizers;
• Publicly available sources, such as company websites and professional networking platforms.

5. Purposes and Legal Bases for Processing

We process your personal data for the following purposes:

Purpose	Legal Basis (Art. 6 GDPR)
Contacting you about our products, services, offers, events, and content that we believe are relevant to your professional role (direct marketing by email, phone, post, and other channels)	Legitimate interests (Art. 6(1)(f)) — promoting our business to relevant professional audiences; or consent (Art. 6(1)(a)) where required by applicable e-marketing laws
Sales prospecting, lead qualification, lead scoring, segmentation, and profiling to assess the relevance of our offerings to you and your organization	Legitimate interests — efficient and targeted business development
Maintaining and improving our customer relationship management (CRM) databases, including enriching, deduplicating, correcting, and updating records	Legitimate interests — accurate and effective business records
Analytics, market research, and business intelligence, including aggregate analysis of industries, roles, and engagement	Legitimate interests — understanding our market and improving our offerings
Developing, testing, and improving our products, services, and internal systems	Legitimate interests — business improvement and innovation
Sharing data within our corporate group and with service providers as described in Section 6	Legitimate interests — efficient business administration
Establishing, exercising, or defending legal claims; complying with legal obligations; responding to lawful requests from authorities	Legal obligation (Art. 6(1)(c)); legitimate interests
Corporate transactions, including mergers, acquisitions, financing, or sale of assets	Legitimate interests — enabling business transactions

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights and freedoms, taking into account that the data is limited, professional in nature, and relates to your business role rather than your private life. You may request a copy of our legitimate interest assessment, or object to this processing, using the contact details above.

Where local law (including the ePrivacy Directive as implemented in EU member states) requires consent for electronic marketing communications, we will obtain your consent before sending such communications, or rely on applicable business-to-business exemptions where available.

6. Who We Share Your Data With

We may share your personal data with:

• Group companies: our subsidiaries, and affiliates, for the purposes described above;
• Service providers (processors): CRM platforms, email and marketing automation providers, data hosting and IT providers, analytics providers, and professional advisers, each bound by contractual obligations consistent with Article 28 GDPR;
• Business partners: where relevant to a joint offering, event, or referral, and where permitted by law;
• Public authorities, courts, and regulators: where required by law or necessary to protect our legal rights;
• Transaction parties: prospective or actual purchasers, investors, and their advisers in connection with a corporate transaction.

We do not sell your personal data to third parties for their independent marketing use.

7. International Transfers

Your personal data will be transferred to and processed in countries outside the European Economic Area or the United Kingdom, including the United States. Where we do so, we put in place appropriate safeguards as required by Chapter V GDPR, such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum, where applicable), or we rely on adequacy decisions, including the EU–US Data Privacy Framework for certified recipients. You may request a copy of the relevant safeguards using the contact details above.

8. Retention

We retain your personal data for as long as reasonably necessary for the purposes described in this notice. As a general rule:

• If you do not engage with our communications, we retain lead data for up to 60 months from the date we obtained it, after which it is deleted or anonymized;
• If you become a customer or enter into an active business relationship with us, your data is retained in accordance with our customer data retention policy;
• If you object to processing or unsubscribe, we retain the minimum data necessary to honor that objection (a suppression record) indefinitely;
• We may retain data longer where required by law or necessary for legal claims.

9. Your Rights

Under the GDPR, you have the following rights, subject to applicable conditions and exemptions:

• Access — obtain confirmation of whether we process your data and receive a copy of it;
• Rectification — have inaccurate data corrected and incomplete data completed;
• Erasure — have your data deleted in certain circumstances;
• Restriction — restrict processing in certain circumstances;
• Objection — object to processing based on legitimate interests; and an absolute right to object to direct marketing at any time, including related profiling. If you object to direct marketing, we will stop;
• Portability — receive certain data in a structured, commonly used, machine-readable format;
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing;
• Complain — lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. A list of EU authorities is available at https://edpb.europa.eu. In the UK, the authority is the Information Commissioner’s Office (https://ico.org.uk).

To exercise any of these rights, contact us at hello@newriverstrat.com. We will respond within one month, extendable by two further months for complex requests. We may need to verify your identity before acting on a request.

Every marketing email we send includes an unsubscribe link. You may also opt out at any time by contacting hello@newriverstrat.com.

10. Automated Decision-Making

We may use automated tools to score, segment, and prioritize leads. These activities do not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including access controls, encryption in transit, and staff confidentiality obligations.

12. Changes to This Notice

We may update this notice from time to time. The current version will always be available at www.newriverstrat.com/privacy. Material changes will be communicated where required by law.

This notice was provided to you in accordance with Article 14 GDPR within one month of our obtaining your data, at the time of our first communication with you, or at the time of first disclosure to another recipient, whichever occurred first.