When you export contacts from Tomba, or copy them into your own tools, you decide how they're used, and you're responsible for that use. This article is a plain summary of Tomba's Acceptable Use Policy. If the two differ, the policy applies. This isn't legal advice.
Who is responsible for the data I export?
You are. For the personal data you get through Tomba, you're an independent data controller: the person or company that decides how the data is used. So you need a lawful reason to use it, and you must answer requests from the people in it.
What can I use Tomba data for?
Use Tomba data for your own business, to contact people in their work role. This is called business-to-business, or B2B, outreach.
What must I never do with Tomba data?
Never do any of these with data you get from Tomba:
Sell, resell, rent or pass on the data, including lists you built with it.
Make the data public, for example through a free tool or an open dataset.
Use the data to build a product or a database that competes with Tomba.
Target people in their private life, or look for their personal, non-work contact details.
Collect or guess sensitive details, such as someone's health, religion, political views or sexual orientation.
Use the data to decide whether someone gets a job, credit, insurance or housing.
Use the data to discriminate against anyone.
Send spam or misleading messages, or keep contacting someone who opted out.
How long can I keep Tomba data?
Keep Tomba data only as long as you need it, and follow these rules:
Refresh or delete contact data at least every 12 months. Contact details go out of date as people change jobs.
When Tomba tells you that someone asked for their data to be erased, delete them from your systems and leave them out of future outreach.
When your subscription ends, delete or return the data you got through Tomba. The API Terms give you 90 days to do this.
What else must I do with Tomba data?
As the data controller, you also need to:
Answer requests you get directly from the people in your data, such as a request to see or delete their data, within the time the law sets.
Keep the data secure.
Follow the law when you send: have a lawful basis, include a working unsubscribe option, and act on opt-outs promptly. See Send responsibly.
Common questions
Can I sell a list I built with Tomba?
No. You can't sell, resell, rent or redistribute Tomba data, and that includes lists you built with it.
What if a search shows claimed_email?
The person asked Tomba to stop processing their data. Don't use it, and if they're already in your lists, remove them. See Why does a result say claimed_email or Data removed?
What happens if I break these rules?
Tomba can limit your usage, suspend seats or API keys, or close the account, in proportion to the breach. See Send responsibly.
For developers: the API Terms add rules for storing data from the API and for showing it to your own users.
Related articles