Your responsibilities under GDPR

Updated Markdown

This page is general orientation, not legal advice — talk to a lawyer about your specific outreach before relying on it. ListPlus helps you find and enrich B2B contact data, but you decide who to contact and how, so under GDPR you are the controller for that use.

You are the controller for your outreach#

ListPlus processes data on your behalf when you search, enrich or export a list, but once you use that data — for example to send an email — you decide the purpose and means of that processing. That makes you the controller for your own outreach, with the obligations that come with it (a lawful basis, honesty about where the data came from, and honoring objections).

Legitimate interest needs a balancing test#

B2B outreach is commonly based on "legitimate interest" (GDPR Art. 6(1)(f)) rather than consent. That basis is not automatic: it requires weighing your business interest in reaching out against the individual's interest in not being contacted, considering things like their role, whether the outreach is relevant to their job, and whether they'd reasonably expect it. It does not cover every kind of contact or every audience — a lawyer can help you judge where your outreach falls.

The duty to tell people where their data came from#

When you didn't collect someone's data directly from them — which is the normal case for enriched or purchased contact data — GDPR's Art. 14 requires telling them certain information, including the source of their data, within a reasonable period and at the latest within one month — and if you use the data to contact them, at the latest when you first contact them. You also need to tell people about their right to object when you first contact them (Art. 21(4)). See "Where does the data come from?" for the specific provider behind each lookup, which you'll need to answer that question accurately.

The right to object, and suppressing contacts#

Anyone you contact under legitimate interest has the right to object at any time, and once they do, you should stop contacting them. ListPlus's Block List (Settings panel — the gear icon at the bottom of the left rail) is built for exactly this: add an email or domain once and ListPlus flags every matching row across your lists with the "On Global Block List" check, so you don't re-contact them by accident. It only flags matches inside ListPlus — it does not filter Segment Search results or block enrichment. The full mechanics, including the separate automated do-not-contact check, are covered in "Block List and the do-not-contact check."

Cold email and cold-call rules in Germany and DACH#

In Germany, the Act Against Unfair Competition (UWG §7(2)) generally requires the recipient's prior express consent before you send marketing email — to businesses as well as consumers. There is a narrow exception for existing customers (§7(3)), which does not cover contacts you sourced to approach for the first time. B2B marketing calls need at least the recipient's presumed consent. Austria and Switzerland also generally require consent for marketing email — get advice from a lawyer familiar with your market before running a cold outreach campaign.

Exported files carry no source note#

A file export (CSV/Excel) writes out only the columns you select, with no added "source" or "provenance" field — so if you need to state where a contact's data came from, keep track of it yourself before or after export. Inside ListPlus, click the small number badge in the sparkles column at the right edge of a row to see that row's enrichment results, each labelled with the provider it came from. For someone asking about their own data (a deletion or information request), see "Someone asks where I got their data, or wants it deleted" for what to do and what ListPlus can provide.

Related topics: where-does-the-data-come-from · do-not-contact-and-block-list · data-subject-requests · dpa-avv · subprocessors.

FAQ#

No. This page explains general principles so you know what to think about; it is not a substitute for advice from a lawyer about your specific outreach, market and audience.

Am I allowed to email a business contact I find through ListPlus?#

That depends on your legal basis and, in Germany and similar markets, on cold-email rules like UWG §7 — ListPlus doesn't determine or guarantee this for you. Get advice from a lawyer before running outreach based on data you sourced through ListPlus.

What is "legitimate interest" and does it cover B2B outreach?#

Legitimate interest (GDPR Art. 6(1)(f)) is a lawful basis some companies rely on for B2B outreach instead of consent, but it requires weighing your interest in contacting someone against their interest in not being contacted. It's not automatic or unconditional — whether it applies to a given contact and message is a legal judgment call.

Do I have to tell someone where I got their data?#

Generally yes, when the data wasn't collected from them directly — GDPR's Art. 14 requires giving them certain information, including the source, within a reasonable period (at most one month), and no later than your first message if you contact them. "Where does the data come from?" names the provider behind each ListPlus lookup so you can answer accurately.

What happens if someone asks me to stop contacting them?#

They have the right to object, and once they do, you should stop contacting them going forward. Add their email or domain to your Block List (gear icon → Block List) so ListPlus flags any matching row in your lists before you contact them again.

Does ListPlus check my lists against a do-not-contact or suppression list?#

Yes — your Block List (Settings panel — the gear icon at the bottom of the left rail) flags rows whose email or domain matches an entry you've added with the "On Global Block List" check, and a separate automated check flags obviously unreachable addresses like noreply or unsubscribe. See "Block List and the do-not-contact check" for how both work.

Can I send cold emails to businesses in Germany?#

Generally, German law (UWG §7(2)) requires the recipient's prior express consent before you send marketing email to a business, with a narrow exception for existing customers that doesn't cover new contacts. B2B marketing calls need at least the recipient's presumed consent, and these are general rules with exceptions, so confirm your approach with a lawyer.

Do exported files show where each contact's data came from?#

No — a file export contains only the columns you select, no added source or provenance field, so it doesn't carry over. To check a value's source before exporting, click the number badge in the sparkles column at the right edge of a row to see that row's enrichment results labelled by provider.

Someone is asking where I got their data or wants it deleted — what do I do?#

See "Someone asks where I got their data, or wants it deleted" for the steps to take and what ListPlus can provide to help you respond.

Is ListPlus responsible for making sure my outreach is GDPR-compliant?#

No. You decide who to contact and how, so you are the controller for your outreach and responsible for its legal basis. ListPlus can't guarantee that any use of the data is lawful.