Good legal practice for sending emails

What applies across the European Union

The General Data Protection Regulation (GDPR) applies to any data about a person, including a professional’s email address (marta.gil@company.com). The essentials:

• A legal basis for every contact. The usual ones are consent (they said yes), the contractual relationship (they’re a customer) and legitimate interest (for example, a business contact whose work your offer is useful for). Legitimate interest requires weighing things up: what you offer must relate to their activity and they must be able to expect your email.
• Inform. Who you are, what you use their data for, how to stop receiving your emails and where your privacy policy is.
• The right to object. Unsubscribing must be easy, free and take effect straight away. Anyone who has unsubscribed receives nothing again, even if you import them again.
• Keep only what you need. Don’t pile up data you don’t use, and delete everything about anyone who asks you to.

You are the controller of that data: you decide who you write to and why. Tude only processes, on your behalf, the tracking data (opens, clicks and unsubscribes), without your recipients’ addresses. It’s set out in the data processing agreement.

Commercial communications: each country, its own rules

On top of the GDPR, each country regulates commercial email with its own law, based on the same European directive. The differences matter when you write to another country.

Spain

The LSSI-CE forbids sending commercial communications by email that haven’t been requested or expressly authorised, including when you write to other companies. The exception is your customers: you may write to them about products or services similar to the ones they bought, if you gave them the option to refuse when you collected their data and you give it again in every email.

Each email must be recognisable as commercial and identify who sends it.

France

The Code des postes et des communications électroniques requires prior consent to write to individuals, with the same exception for customers.

With professionals, the CNIL accepts writing without prior consent to their work address if what you offer relates to their profession, if they were informed when their data was collected and if they can unsubscribe in every email.

Italy

The Codice privacy requires prior consent, and the Garante applies it strictly to professionals too. The exception is the so-called “soft spam”: you may write to your customers about products similar to the ones they bought, if you informed them and they haven’t objected.

In Italy it’s advisable to have each contact’s consent and be able to prove it.

Germany

The law against unfair competition (UWG, § 7) considers advertising by email without prior express consent unacceptable harassment, both to individuals and to companies. The exception for customers is narrow: an address obtained in a sale, similar products of your own, no objection, and informing them when you collect the address and in every email.

In practice, double opt-in (the person confirms with a click in an email) is used to be able to prove consent. And the email footer is expected to carry your company details, as in a business letter.

How Secuenza helps you

• Each contact’s legal basis is saved when you import or add them, so you know who you can write to and why.
• Every email carries the unsubscribe link and the header Gmail and Outlook use for their “Unsubscribe” button. The unsubscribe page carries your brand, and the unsubscribe is recorded even if Secuenza is closed: it arrives as soon as you open it.
• The suppression list stops you from writing again to anyone who unsubscribed, even if they turn up again in an import.
• The legal footer with your company details goes out in every email.
• GDPR deletion removes a contact with everything about them: sends, opens and replies.
• The safety brake pauses a campaign if unsubscribes or bounces shoot up, which is usually a sign of a list that shouldn’t have been used.
• Sign-ups from your website record whether the person ticked the consent checkbox, which is required on the form, and when. Secuenza doesn’t send them a confirmation email (double opt-in): if you write to Germany, bear it in mind.
• Your contacts stay on your PC. Only tracking data reaches our servers, without addresses. Sign-ups from your website or through the API wait there until your program collects them, 30 days at most.

Bought or rented lists are forbidden by the acceptable use policy: besides being illegal in almost every case, they sink your mailbox’s reputation.

Before you start a campaign

1. Do you have a legal basis for every contact on the list, according to their country?
2. Does the first email say who you are and why you’re writing?
3. Is your privacy policy linked in the footer?
4. Have you removed anyone who already unsubscribed or asked you not to write?
5. Does what you offer relate to their work (if you write to professionals without prior consent)?