Companies, not individuals

For an identified visit you get the organisation and its context: company name, industry, size band, coarse location, the pages viewed, session length, return visits and the campaign or referrer that brought them in. That is enough to tell an interested account from a passer-by and to prioritise follow-up.

What you do not get is a person. No names, no email addresses, no job titles attached to a session, no person-level profile that accumulates across visits. There is no setting that unlocks it, because the pipeline never resolves that layer in the first place.

Identifying a company is a statement about a legal entity. Identifying the individual behind an anonymous visit is a statement about a person — and that is where visitor identification turns into the kind of processing regulators, privacy teams and visitors object to. Keeping the output at entity level is what makes the balancing test under legitimate interest workable.

It also keeps the data honest. Attributing a visit to a specific employee would require guessing which person in a company was behind a shared office connection. A guess dressed up as a fact is worse than no answer, especially when a salesperson is about to act on it.

In practice the workflow starts from the account, not the individual. A company that reads your pricing page twice in a week is a signal to reach out through your normal channels: your existing contact there, a LinkedIn approach, or an account-based campaign. The visit tells you which door to knock on, and your own relationship data tells you who to ask for.

If you need contacts inside an identified company, you can plug in an enrichment provider with your own key. In that setup the contact lookup runs on your side under your own contract — lead.box does not sell contact lists and does not enrich anonymous visitors into people.

Three facts usually matter most to a reviewer: the output is a legal entity, no cross-site or advertising profiles are created, and processing happens in the EU. On top of that, the DPA can be signed digitally, the sub-processor list is public and versioned, and there is a public opt-out page for visitors who object.

That combination is why company-level identification is a very different conversation from person-level tracking — and why most reviews can be completed during the free trial rather than after a commitment.