How The Signal Engine collects, uses, retains, and protects personal data. This notice covers the website and the outbound programmes we operate for clients, including how to contact us and exercise your rights.
Last updated: 27 September 2026
1. Who is responsible for your data
The data controller is Aligned Software Solutions Inc., a company incorporated in British Columbia, Canada, which operates The Signal Engine™ service.
Data controller
Aligned Software Solutions Inc., trading as The Signal Engine™
Registered address
170–422 Richards Street Vancouver, BC V6B 2Z4 Canada
Email
Telephone
+1 604 259 7676
Data protection officer
Not appointed. We are not required to appoint one, and privacy questions are handled by the contact above.
EU representative — Article 27
Because we are established in Canada and offer services to people in the European Economic Area, we are required to designate a representative in the Union under Article 27 GDPR. Stefan-Raducu Radu has been designated as our representative in the Union. You may contact the representative on any matter relating to the processing of your personal data, in addition to or instead of contacting us: Drumul Valea Danului 36, Ap. 42, Sector 6, 061982 Bucharest, Romania, or by email at . Designating a representative does not create an establishment in the Union.
2. The three ways we may hold data about you
The information we hold depends on your relationship with us. The following categories explain which parts of this notice apply.
You visited this website. We hold analytics data only, and only if you accepted analytics cookies.
You contacted us through the research walkthrough, the outreach self-assessment or the free lead sample form. We hold the information you submitted.
We contacted you as part of a client’s outbound programme. We hold business contact details and the verified signal that prompted the message. You did not give us this data directly, so section 4 explains where it came from.
3. What we collect, why, and on what legal basis
Data
Why
Legal basis
Kept for
Website analytics Pages viewed, approximate location, device and browser, referring site
To understand which pages are read and where visitors come from
Consent — Art. 6(1)(a). Set only after you accept analytics cookies
14 months
Contact and scorecard submissions Name, role, work email, company, website, and the answers you selected
To respond to your enquiry, prepare for a research walkthrough, and review your self-assessment
Steps taken at your request before entering a contract — Art. 6(1)(b)
3 months
Free lead sample requests Work email, company website, and your description of who you sell to
To research and deliver the three-lead sample you asked for
Steps taken at your request — Art. 6(1)(b)
3 months
Marketing emails Work email, company website, and a record of your consent: date, time, page, IP address and the wording you agreed to
To send you news, offers and research about our services
Consent — Art. 6(1)(a), given by ticking the box on the free lead sample form
Until you withdraw consent. The consent record is then kept for 3 years to show the consent was valid
Outbound prospect data Name, job title, employer, business email, public professional profile, and the verified event the message is based on
To open a relevant business conversation on behalf of a client
Legitimate interests — Art. 6(1)(f). See section 4
3 months
Correspondence Emails and messages you send us, and our replies
To handle the conversation and keep a record of what was agreed
Legitimate interests — Art. 6(1)(f)
3 months
We do not collect special category data, we do not knowingly process data about anyone under 18, and we do not make automated decisions that produce legal or similarly significant effects about you.
4. Where outbound prospect data comes from
If we contacted you without receiving your details directly from you, this section explains the sources of that information, as required by Article 14 GDPR.
Public professional profiles, principally LinkedIn, for your name, role and employer.
Company websites, public registers and published announcements, for the event the message refers to.
Business email verification services, to confirm a work address is valid and belongs to the domain we expect.
We do not buy contact lists or present guesses as facts. Factual claims in outreach are checked against dated primary sources. A possible business need is treated as a hypothesis, not as a verified fact. You can inspect our research criteria in the Quality standards.
Our legitimate interests, stated plainly
We rely on legitimate interests to contact business people in a professional capacity about a matter relevant to their role. We have weighed that against your interests and rights: we contact you at a business address, about your work, in low volume, with a stated reason, and we stop permanently the moment you ask. You can object at any time — see section 8 — and we will action it without argument.
5. Who else sees your data
We do not sell personal data, and we never share it with other advertisers. We use a small number of service providers who process data on our instructions under a written agreement:
Who
What they do
Where
Google (Analytics 4, Tag Manager)
Website analytics, only after consent
EU / United States
Digital Intelligence SRL
Receives and forwards the contact, scorecard and free lead sample forms on our behalf
Romania (EU)
GoDaddy / Host Europe GmbH
Serves this website and stores its logs
Germany / France (EU)
Email and LinkedIn delivery infrastructure
Sends the messages in an outbound programme, and our marketing emails
EU / United States
Where a client engages us to run outbound, that client is a separate controller for the conversations that result. If you appear in a free lead sample, your business contact details and the event we cite are shared with the company that requested the sample, which becomes a separate controller for its use of them. We may also disclose data where the law requires it.
Sending data outside the EEA
We are based in Canada, so data reaches us there. The European Commission has decided that Canada offers an adequate level of protection for personal data handled by commercial organisations, which is the basis for that transfer. Transfers to providers in the United States are made under the European Commission’s standard contractual clauses.
6. How long we keep it
We keep personal data for 3 months, after which it is deleted. Website analytics data is the exception and is kept for 14 months, the retention period configured in Google Analytics. Two further exceptions: data that forms part of a signed client contract is kept for as long as that contract and the legal claim periods that follow it require, and an opt-out is kept permanently on a suppression list — that is the only way to guarantee you are never contacted again. Marketing consent is the last exception: we use your email for marketing until you withdraw consent, and keep the record of that consent for 3 years afterwards.
7. Cookies
This website sets analytics cookies only after you accept them, and functional storage that remembers your colour theme. The full list, with providers and expiry dates, is in the Cookie Notice, where you can also change or withdraw your choice.
8. Your rights
Under the GDPR you can exercise all of the following, free of charge. We answer within one month.
Access — a copy of the data we hold about you, and where we got it.
Rectification — correction of anything inaccurate.
Erasure — deletion of your data.
Restriction — a freeze on processing while a dispute is resolved.
Portability — the data you gave us, in a machine-readable format.
Objection — to processing based on legitimate interests. Where you object to direct marketing, including outbound contact, we stop immediately and permanently. There is no balancing test for that one.
Withdraw consent — at any time, for anything based on consent, without affecting what was lawful before. That includes consent to marketing emails: use the unsubscribe link in any marketing email, or write to us.
To exercise any of these, email . You do not need to explain why, and you do not need to use a particular form of words. Asking us to stop is enough.
9. Complaints
If you are unhappy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to a supervisory authority — the data protection authority in the EU or EEA country where you live or work, or where you believe the problem occurred. The full list is published by the European Data Protection Board at edpb.europa.eu.
10. Changes to this notice
If we change how we handle personal data we will update this page and the date at the top. Where the change is significant and affects people we already hold data about, we will say so directly rather than relying on you noticing.