"Where Did You Get My Number?" A Skeptic's Test for Any Contact-Data Vendor

A BDR lead at a Nordic software company described a pain we hear often:

"So many of our calls end with: why on earth are you calling me? This is my private number."

A founder who runs an outsourced SDR agency put a number on it:

"There's a long-term risk with the LinkedIn-based data sources: some numbers are private. It's bitten us. Not often, maybe one in a hundred. But that one in a hundred gets furious."

One in a hundred sounds small until you do the math. A team making a thousand calls a week reaches ten people a week who never published the number you just used. Some of them hang up. Some of them write to you and cite the GDPR.

Buyers are rightly skeptical of contact data. Every vendor claims to have everyone, and one buyer told us their last round of vendor tests took longer than finding the numbers themselves. But most trials measure only one thing, how many numbers you get. This post is about the question that decides whether those numbers are worth having: where did each one come from?

Two kinds of numbers

There is nothing wrong with collecting data from public sources. We do it ourselves. The question is not whether a number was collected, it's what the number was published for.

A number the company published to be contacted. It's on the company's website: on the contact page, on the team page, under a name and a role. Small companies often list the founder's mobile as the main number. Whoever published it expected the phone to ring.

A number matched to a person. It starts with a profile, usually LinkedIn. A tool takes the name and employer, asks one or more databases for a mobile number tied to that person and returns whatever comes back. The waterfall tools ask several providers in a row until one of them answers. This finds far more mobile numbers, which is exactly why it is sold. But nobody checks what the number was originally published for. Some are work phones. Some are the number someone gave a webshop, a loyalty club or an app.

The second kind is where the one in a hundred comes from. And it's a structural problem, not one vendor's bug: any service that builds mobile numbers from personal profiles runs into it. That applies to many popular international tools as well as some Nordic ones, and the more a database leans on that route, the more private numbers it carries.

Most vendors, us included, use more than one route. That's fine. What isn't fine is a vendor that can't tell you which route a given number came by, because then neither of you knows which kind you're about to call.

Why it's your risk, not the vendor's

When your rep dials the number, you are the controller for that call. Your vendor is responsible for its database. You are responsible for what you do with it.

B2B prospecting in the Nordics usually rests on legitimate interest, and legitimate interest rests on reasonable expectations. A founder who puts a mobile on the company website can reasonably expect sales calls. Someone whose private mobile was matched to their LinkedIn profile cannot. Same call, same script, very different legal footing.

The GDPR also gives the person you called the right to know where you got their details (Article 14), and the right to object to direct marketing (Article 21), which is absolute: once they object, you stop. When the objection arrives it lands on you first, because you made the call. If your vendor can't tell you the source, you can't tell them either. And "our data provider" is not an answer anyone accepts.

So the private-number problem costs more than one angry call. It costs the answer you can't give afterwards.

What a good answer looks like

This month, one of our customers' SDRs called the founder of a small company. The founder emailed the customer afterwards and objected under Article 21, asking for the calls to stop, the number on a blocklist so it couldn't come back with the next import, and written answers to three questions: where did you get my data, who is responsible for it, and who else has received it.

The customer forwarded it to us. Within two hours both of them had a reply in the same email thread:

• Source: the founder's own company website, where the number was published as the company's contact number, collected in March.
• Roles: the customer is responsible for its call and its CRM. We are an independent controller for the database the number came from.
• Recipients: one account had unlocked the number, the customer who made the call. No exports.
• Action: the founder's contact details were erased from our contact database, and the number, email address and profile link were added to a blocklist, stored as one-way hashes, that every new import is checked against.
• What the customer had to do: stop calling and block the number in their own CRM and call lists.

That was the whole matter. The founder got every answer they asked for in one email, and the customer didn't have to choose between guessing and stonewalling. Nobody was glad the call had happened, but both were happy with how it was handled.

None of this is clever. It only works if three things are true before the email arrives: every number has a recorded source, you can see who received it, and erasure blocks re-collection instead of just deleting a row until the next crawl. Those are the things to test before you sign with a vendor.

Seven questions to ask any contact-data vendor

We've written before about the four questions that expose stale data. These seven are about where the data came from and what happens when someone objects.

1. Where did this exact number come from? Pick five random numbers in the trial and ask for the source of each. A real answer names the route (company website, register, profile lookup, data partner) and ideally the page and the date. "Public sources" is not an answer.
2. How much of your mobile coverage comes from personal profiles? Ask plainly whether mobile numbers are looked up from LinkedIn profiles or bought from other providers, and roughly what share of the numbers you'd receive come that way. The higher the share, the more often you'll hear "this is my private number".
3. What happens when a customer reports a private number? The right answer is that it leaves the database for everyone, not just for the customer who complained.
4. How fast can you answer an objection, and what do you send? Ask to see a redacted example of a real reply. Look for source, roles and recipients.
5. Can you tell me who has received a given person's data? If they can't, they can't answer an access request, and neither can you.
6. Does erasure stop re-collection? Deleting a record is easy. Keeping it from coming back on the next crawl requires a blocklist checked at import.
7. Who is the controller for your database? And can they show you their legitimate interest assessment? A vendor that has written one can usually find it in thirty seconds.

A one-week trial that measures the right things

Most data trials count how many numbers you get, or only test the contacts missing from your CRM, and end with "it's about the same". Run this instead:

1. Bring twenty real target accounts, including some already in your CRM, so you can compare against what you have.
2. Include the hard roles. Finance and IT are where coverage usually falls apart.
3. Call them for real, in a normal calling block, from the same rep with the same script.
4. Measure per number: connected, wrong number, switchboard vs direct, right role, decision maker.
5. Count the "where did you get my number?" moments. Write down every call where the person says the number is private. Even one in fifty is a finding.
6. Run the source check from question 1 on five numbers you actually reached.

At the end of the week you'll have a connect rate, a wrong-number rate and a private-number rate. The last one is the number nobody puts in a sales deck.

How we do it at Funnelfeedr

We'd rather show you how we answer these questions than claim we've solved them, so here is what's in place.

• Every phone number and email address carries its source. Company website, register, profile lookup, the customer's own CRM or import. Contacts found on a company website are also linked to the page they were seen on, with the date we first and last saw them there.
• Company data comes first-hand from the registries in Sweden, Norway, Denmark and Finland, so the organization number behind every contact is the real one.
• We log every unlock. Each time an account reveals a number or an email address, we record which account, which user and when, and whether it went out in an export. That's how we could tell the founder above that exactly one account had the number.
• Objections go to one address. Data subjects, and customers who receive an objection, write to privacy@funnelfeedr.com. We erase the person from the contact database and add the phone number, email address and profile link to a hashed blocklist that new imports are checked against.
• Our legitimate interest assessment is public. You can read it at funnelfeedr.com/legal/legitimate-interest-assessment before a sales rep ever calls you.

What we tell customers: if someone you call says the number is private, forward it to privacy@. You handle your call and your CRM; we make sure the number leaves the database for every other customer too.

The takeaway

The test of a data vendor isn't how many numbers it has. It's whether you'd be comfortable reading out the source of any one of them to the person who answers. If you would, the vendor did its job. If you wouldn't, you've bought a list of objections you'll have to answer on your own.

Want to see where the numbers in your segment come from? Book a demo and ask us for the source of any number on the list →