Documentation and execution resources

Legitimate interest is usually relied on to store and work with professional contact data. It is enough to write down, on one page, who you target, what you offer and why it fits their activity. Having it documented gives you peace of mind if anyone asks.

In Spain, sending advertising by email without the recipient’s prior authorisation or an existing customer relationship is restricted (LSSI, art. 21), including between businesses. That is why the first message carries no commercial offer: it says where the contact came from, offers something useful or asks a question, and asks permission before sending more information. It reduces risk; it does not remove it.

When you did not get the data from the person, the GDPR (art. 14) requires you to tell them its source. One line in the first message (“I found you on Google Maps while looking for…”) covers part of that obligation and also builds trust.

You must be able to demonstrate where each data point came from and in what context it was public. Lists of unknown provenance or acquired without guarantees make this impossible, which is itself a compliance failure regardless of how they are used.

Every commercial message must include a visible, simple opt-out mechanism that works. A broken link, a procedure requiring several steps or a route that goes unattended is equivalent to offering none.

The right to object to processing for direct marketing purposes is absolute: it admits no assessment or negotiation. You need a procedure that records each request and guarantees that person receives no further communications on any channel, not only the one through which the right was exercised.

Every communication must clearly identify who is sending it: company name, means of contact and, where applicable, additional identifying details. Concealing or obscuring sender identity is not defensible under any framework.

Individuals whose data you process have the right to know, even if they did not provide it to you directly. Your privacy policy must reflect this processing: what data, for what purpose, on what legal basis, from what origin and what rights apply.

Accessibility of a data point does not determine whether you may use it. What matters is whether your use aligns with the purpose for which it was made public. A phone number published by a business to be contacted commercially supports commercial contact; a personal data point appearing in another context does not.

Even with a valid legal basis, use must be proportionate. A reasonable number of contacts spaced over time is defensible; repeated insistence on someone who does not reply, ignoring the absence of interest, is not, even if the underlying data was legitimate.

Depending on the volume and nature of the data you process, you may be required to maintain a record of processing activities. It is worth verifying whether your case falls within that obligation based on your size and data types.

The applicable framework changes substantially depending on whether the recipient is a business or a consumer. Practices permissible in business-to-business contact do not carry over to contact with private individuals, where consent requirements are considerably stricter.