# Referral consent data minimization: six fields | SourceX

Canonical: https://refer.sourcex.si/guides/how-to-record-an-executive-s-approval-without-keeping-extra-data
Last updated: 2026-11-05

Record the approval, not the conversation around it. Six fields carry everything a later decision needs: an internal company code, the approver's role, the date and channel, the scope approved, anything ruled out, and a pointer to the message in which the approval was given. Point to evidence where it already lives instead of copying it, keep board material, recordings and company records out entirely, and set a delete-by date tied to reward accounting and any dispute.

This guide is for VC operating partners and platform leads who log a CEO's yes before introducing a company to SourceX. Program facts come from SourceX's terms (Version 2026-10-22.2, since replaced by version 2026-11-04), its unsigned sample Channel Partner Agreement and its who-qualifies page, all read on 26 October 2026. The record design and the sorting test are this page's own, and the examples are Illustrative. Where several people each grant part of a permission, a fuller register may be justified; this page asks the opposite question, which is how little a record can hold and still do its job.

## What an approval record has to prove later

A record earns its keep only when someone asks a question it can answer. Four questions come up in practice, and only two of them are yours to answer.

| Later question | Who asks it | Minimum evidence you need |
|---|---|---|
| Did the CEO agree before anything was sent? | You, and SourceX if credit is disputed | The date and a pointer to the CEO's message |
| What exactly was allowed to travel? | You, the CEO | The scope approved and anything ruled out |
| Was the introduction itself recorded in writing? | SourceX, under the agreement | SourceX's own introduction record, not your file |
| What does the fund hold about our company? | The company | A record short enough to show them in full |

The third row is easy to over-engineer. The sample agreement requires an introduction to be recorded in writing, through a portal submission, a tracked verified application, an email or a mutually acknowledged log, and an oral introduction to be confirmed in writing; each introduction record identifies the company, domain, partner, opportunity, introduction method and timestamps. The terms add that attribution is decided from dated records. SourceX keeps that record. Yours only has to show that the company's approval came first and what it covered.

The three answers a company can give need three different amounts of record.

| Company's answer | What to keep | What not to keep |
|---|---|---|
| Founder interest, CEO not yet asked | Nothing in an approval record; at most a private reminder | Notes on the founder's enthusiasm |
| Authorized sponsorship by the CEO | The six fields below and a delete-by date | Anything outside the six fields |
| Voluntary decline | One line: date, declined, do not ask again | The reason, the tone, who else was present |

## The minimal consent record design

Six fields, filled on the day of the approval. Names belong in one restricted index that only the people who make introductions can open; every other view uses the code.

| Field | What goes in | What stays out | Example (Illustrative) |
|---|---|---|---|
| 1. Company code | An internal code; the name lives in the restricted index | The company name in shared trackers | C-0412 |
| 2. Approver's role | The role, with the name in the index | Mobile numbers, personal email, home address | CEO |
| 3. Date and channel | When and how the yes was given | A recording or transcript of the call | 2026-10-14, email |
| 4. Scope approved | What may travel: an introduction, the company's name, a line on record types and years | Figures, system lists or files beyond that | Introduction; record types and years |
| 5. Ruled out | Anything the CEO excluded, in a few words | The CEO's reasons | Do not name the fund |
| 6. Pointer | Where the evidence lives: a message ID or link in the system of record | A forwarded copy of the thread | Link to the CEO's reply in the shared mailbox |

Below the six fields sits one control: a **delete-by** date or trigger, covered further down.

The pointer field does most of the minimizing. The CEO's email already exists in a mail system. Copying it into a tracker note, a CRM activity, a deal-room folder and a spreadsheet creates four copies to secure and four to delete later. Keep one copy in a shared, company-owned system of record and point to it. A shared mailbox beats a personal one, because a pointer into the inbox of a colleague who has left the fund resolves to nothing.

## Keep, point or drop: sorting everything else you might hold

Run three questions over every other item that gathers around a referral. Will a later decision depend on it? If not, drop it. Does it already live somewhere you can point to? Then point. Did it reach you through a board seat, information rights or the company's own systems? Then it never enters the record.

| Item | Verdict | Why |
|---|---|---|
| The CEO's approval email | Point | It is the evidence; one copy in the system of record |
| Your own message asking the question | Point | It shows what the CEO was actually asked |
| A call recording or AI meeting notes | Drop, or better, never create | It captures far more than a yes; confirm by email instead |
| Board deck pages showing systems or headcount | Never | Board-derived information carries confidentiality duties |
| A headcount spreadsheet | Drop | The CEO's own statement is enough for a first screen |
| An org chart | Drop | The sponsor's role is the only part needed |
| The CEO's mobile number or personal email | Drop | Use the company channel the CEO chose |
| Screenshots of professional profiles | Drop | The role is already recorded |
| The CEO's reasons for agreeing or declining | Drop | No later decision depends on them |
| Samples, exports or logins | Never | A partner has no authority to hold or share them |
| Notes on a founder's personal enthusiasm | Drop | Interest is not approval |
| A sample file the company sent unasked | Delete and say so | Tell the sender it is deleted; do not forward it |

Two "never" rows rest on documents rather than taste. NVCA's model management rights letter puts information an investor receives under it within the confidentiality provisions of the Investors' Rights Agreement, and says those obligations survive after the management rights end. The sample Channel Partner Agreement gives a partner no authority to share a supplier's inventory, records, raw data or personal information, and bars collecting or retaining supplier dataset copies through the program without separate written authorization. If a call has to be recorded at all, the consent questions are set out in [AI notetaker consent laws](/guides/ai-notetaker-consent-laws).

## Why the smaller record is the stronger one

The record names people, so the data protection rules your fund already follows apply to it; for UK contacts, for example, those rules include data minimisation. The UK Information Commissioner's Office describes the principle as personal data that is adequate, relevant and limited to what is necessary, and advises organisations to identify the minimum they need for their purpose and hold that much, but no more. In paraphrase, it also recommends reviewing what is held from time to time and deleting what is no longer needed. Whether a given contact falls under those rules is a question for your fund's counsel; the design here works either way.

Smallness also helps in three practical ways. A six-field record can be checked in seconds before an introduction goes out. It can be shown to the CEO in full if the company asks what the fund holds. And it carries nothing that could embarrass the fund if it were forwarded by mistake.

## A founder's enthusiasm is not a field

The record holds one person's approval: the CEO's. In this program that authority sits with the CEO, who opens any licensing discussion and signs on the company's behalf, so a co-founder's excitement, a director's opinion or the fund's own view of the opportunity has no field to go in. SourceX's screening page separates a board seat from the authority to open this discussion, and an introduction the decision maker does not know about is, by that page, usually not a fit.

If the CEO names a sponsor to handle the work, the designation belongs inside field 4 as part of the CEO's approval ("sponsor: the COO answers records questions"), not as a second approval from the sponsor. Whether to route through a sponsor at all is a separate choice, set out in the comparison of [going through a sponsor versus straight to the CEO](/compare/introduce-through-sponsor-or-directly-to-ceo).

No approval record can make a company fit. The fit facts sit elsewhere: a peak of 50 or more full-time employees, contractors not counted; records spanning years that the company produced itself, with the rights to license them; and an authorized contact. Relevance to SourceX's current data needs is checked during review.

## Hand off only what the record allows

1. **Read fields 4 and 5** and nothing else before sending.
2. **Send only that scope**, either as your partner link for the company to apply itself or as a submitted introduction. Whoever submits must already have signed the SourceX Channel Partner Agreement.
3. **Keep the record itself at home.** SourceX keeps its own introduction record and may communicate with a referred company directly, so the CEO's words can reach SourceX from the CEO.
4. **Ask the duplicate question once.** The terms treat a company with any earlier application, relationship, lead, account or email correspondence with SourceX as a duplicate that is not credited to a later partner.

**Before and after (Illustrative).** An invented 310-person claims processor whose CEO agreed to an introduction.

| Measure | Before sorting | After sorting |
|---|---|---|
| Items held | 14: the CEO's thread in three places, a call recording, AI meeting notes, two board deck pages, a headcount sheet, an org chart, the CEO's mobile number, two profile screenshots, the CEO's reasons and a sample claim file the COO sent unasked | Six fields, one pointer and a delete-by trigger |
| Where they sat | A personal inbox, the CRM, a deal-room folder and a laptop | One restricted index and one shared mailbox |
| Board-derived material | Two pages | None |
| Company records | One sample file | None; deleted, and the COO told |

## When to delete, and what survives

Set the delete-by trigger on the day you create the record.

| Trigger | What to delete | What survives |
|---|---|---|
| The CEO declines | The six fields | One line: date, declined, do not ask again |
| The row closes without an application | The six fields, after the review period your fund sets | Nothing |
| A reward is paid and nothing is disputed | The six fields, once your accounting no longer needs them | What your accounting rules require |
| The company asks you to delete | Everything you can, at once | Only what a legal obligation requires |

The sample agreement's return-and-deletion clause excepts records needed for legal obligations, reward accounting, dispute evidence and routine inaccessible backups. Treat that list as the outer edge; the terms set no retention period for a partner's own notes, so your fund's policy picks the number. How to keep the one-line decline flag respectful is covered in [tracking declined and ineligible referrals](/guides/how-to-track-declined-and-ineligible-referrals-respectfully).

## Where a minimal record falls short

- **A contested credit needs evidence that still resolves.** SourceX reviews disputes against dated evidence. A pointer into a deleted mailbox proves nothing, so keep the evidence in a shared, company-owned system.
- **It proves agreement, not freedom.** A record shows that a CEO said yes, not that a board relationship left the CEO free to say no.
- **Pointers break in migrations.** When the fund changes mail or CRM systems, check that pointers still open.
- **It is not legal advice.** Which privacy rules reach a given contact depends on where they are and what your fund does.
- **Nothing here is measured.** SourceX has not published a benchmark for record completeness or deletion, and this page offers none.

**Methods note.** The six fields, the sorting test and the triggers apply SourceX's terms (Version 2026-10-22.2, since replaced by version 2026-11-04), the sample Channel Partner Agreement and the who-qualifies page, with the ICO's data minimisation guidance and NVCA's model management rights letter, all checked on 26 October 2026. They describe what to record and delete; they do not measure whether any approval was freely given or whether a company will fit. To test the design, count per quarter the share of approval records that hold only the six fields and the number of items deleted at their trigger date.

## Next step

> **Refer a company. No cap on rewards.** Default reward on a company's first qualifying transaction: the greater of $50,000 plus 5% and 15% of Actual Supplier Payout, with no cap; further qualifying transactions first agreed within 12 months of the first Closing pay 15%. Eligibility and payment conditions apply, including the USD 100,000 Minimum Transaction, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.

Once the CEO's approval fits in six fields with a pointer and a delete-by trigger, [create a partner account](/register), make sure the company meets the [published criteria](/who-qualifies) and read how dated records decide credit in the [program terms](/terms) before you send anything. The [venture platform teams page](/for/venture-platform-teams) and the [guides hub](/guides) cover the rest of the workflow.

A tidy approval record serves your referrals; whether to invest in SourceX is a decision for a different file, and the company's diligence materials can be requested through the [SourceX investor overview](https://sourcex.si/investors).

This article is for information only and is not an offer to sell or a solicitation of an offer to buy securities. Any offering by SourceX is made only to verified accredited investors through its offering documents.

## Sources

- https://refer.sourcex.si/terms
- https://sourcex.si/documents/partner/SourceX_Channel_Partner_Agreement_Sample.pdf
- https://refer.sourcex.si/who-qualifies
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/
- https://nvca.org/wp-content/uploads/2019/06/NVCA_Model_Management-Rights-Letter.doc
- https://sourcex.si/investors