Gdpr weekly do you need consent for direct marketing… database tools

Coming into force on may 25, the general data protection regulation (GDPR) – which replaces the data protection act 1998 – is something which all businesses are expected to comply with.

To help you on your way, in association with the valpal network, we’ve assembled a panel of experts who will be answering a GDPR-related question each week.

If you have a question you’d like to ask our experts in a future edition of GDPR weekly, please get in touch on press@estateagenttoday.Co.Uk.

The simple answer to this is no. The ICO has recently released its reviewed guidance on using lawful bases for processing, and it should make for very good reading for agents.Basis processing

Agents might consider looking at the news like this: if you choose to use consent as your lawful basis for processing, the individual has given you clear consent for you to process their personal data for a specific purpose, e.G.


For direct marketing, so you have evidence to support your lawful basis for sending them marketing communications.

If you choose to use legitimate interest, they have not, so it is your responsibility to show justification for why you are sending them marketing communications. To do this, you should undertake a legitimate interest assessment (LIA) and conduct a three-part test which will help you to understand what you are trying to achieve from your direct marketing messages, and if they will have any impact on your customers’ rights.Direct marketing

When it comes to emails, texts, and automated calls, you should risk assess if legitimate interest is the most appropriate basis for processing, as e-privacy laws may require that you obtain consent.

You may find the ICO’s guidance useful, as for legitimate interest to be viable, ‘soft opt-ins’ must have previously been obtained. A soft opt-in means that a customer has bought or discussed a product or service with you, and you have always provided a means for them to opt-out of communications.

As with any direct marketing, you should inform the customer of their rights. Within your privacy policy, you should make them aware of the lawful bases you use to process data and inform them that they can opt-out of receiving direct marketing communications from you at any time.Direct marketing

To cope with the demands of the GDPR, we have developed our system with a ‘planning for the worst and hoping for the best’ approach. In light of the news, we’re delighted that we have covered all bases, as it means our customers can determine their own approach to the GDPR.

For each person you directly market to, but with whom you do not have signed terms of engagement, you must have recorded GDPR-adequate consent. We advise you put together a mass email now to convert as much of your database as possible.

This way, if ‘mrs adams’ asks why she’s receiving a list of properties from you, you can say: ‘because on X date you consented to hear from us, and here’s a copy of the email’.Angels media

If you are marketing services to someone who has recently transacted with you for a similar service or product, who was also given the chance to opt out but did not, then they fall under the soft opt-in exception and you can continue to direct market to them.

We have even had subscribers ask us if they can still send out christmas cards. You can, and in general you can still mail out marketing letters too.

– but where you have an existing client relationship there is an exception which allows you to send out e-mail marketing on an opt-out basis.

The GDPR is designed to give people more control over their personal data, whilst also ensuring that businesses across the EU benefit from a level playing field.Personal data

Although estate and letting agents may have a legitimate interest to use personal data for direct marketing, this can’t override the obligation to have recipients’ consent for any electronic direct marketing (unless it is to an existing customer who has not objected to receiving it).

It is therefore always advisable to seek consent, which under GDPR must be a freely given, specific, informed and unambiguous indication of the individual’s wishes. There must be some form of clear affirmative action – or in other words, a positive opt-in – consent cannot be inferred from silence, pre-ticked boxes or inactivity.

When seeking consent you should be clear about the purposes for which the personal data will be used (normally done through the privacy notice).Angels media in addition to the general right to withdraw consent, you should also inform individuals of their right to object, at any time, to the processing of their personal data for directing marketing (and this should be brought to their attention at least at the time of the first communication with them).

For direct marketing to identifiable individuals, you have to be able to show that you have a lawful basis for processing this information and that specific consent has been given for you to do this.

– if individuals submit their own contact information you need a clear and prominent privacy notice so the individual can understand at that point exactly what you are proposing to send them.Direct marketing GDPR will change what ‘consent’ means, as pre-ticked opt-in boxes, opt-out boxes, or any other ‘consent by default’ methods will no longer be valid.

– you must you get valid consent and be able to demonstrate it by keeping records. A consent to be emailed is not automatically a consent to be phoned or texted or recorded. Each must be separately identified.

A ‘soft opt-in’ is allowed as ‘consent’ for previous and existing customers, but this is limited to promoting your own service that is similar to the one they previously purchased – and you must give a way to opt out.

Avoid using consent when you have another legitimate method of processing data (for example an existing customer you wish to invoice) as consent can be withdrawn at any time.Angels media

Angels media ltd encourages you to seek additional guidance, including professional legal advice, to ensure that all of your business operations are ready for the GDPR.

We would like to stress that there is no substitute for making your own detailed investigations or seeking your own legal advice if you are unsure about the implications of the GDPR on your businesses.

While we have made every effort to ensure that the information covered here is correct and up to date, we angels media ltd makes no promises as to completeness or accuracy and the information is delivered on an “as is” basis without any warranties, express or implied.

Angels media ltd will not accept any liability for errors or omissions and will not be liable for any damage (including, without limitation, damage for loss of business or loss of profits) arising in contract, tort or otherwise from the use of or reliance on this information or from any action or decisions taken as a result of using this information.Angels media

Coming into force on may 25, the general data protection regulation (GDPR) – which replaces the data protection act 1998 – is something which all businesses are expected to comply with.

To help you on your way, in association with the valpal network, we’ve assembled a panel of experts who will be answering a GDPR-related question each week.

If you have a question you’d like to ask our experts in a future edition of GDPR weekly, please get in touch on press@estateagenttoday.Co.Uk.

The simple answer to this is no. The ICO has recently released its reviewed guidance on using lawful bases for processing, and it should make for very good reading for agents.Basis processing

Agents might consider looking at the news like this: if you choose to use consent as your lawful basis for processing, the individual has given you clear consent for you to process their personal data for a specific purpose, e.G. For direct marketing, so you have evidence to support your lawful basis for sending them marketing communications.

If you choose to use legitimate interest, they have not, so it is your responsibility to show justification for why you are sending them marketing communications. To do this, you should undertake a legitimate interest assessment (LIA) and conduct a three-part test which will help you to understand what you are trying to achieve from your direct marketing messages, and if they will have any impact on your customers’ rights.Personal data

When it comes to emails, texts, and automated calls, you should risk assess if legitimate interest is the most appropriate basis for processing, as e-privacy laws may require that you obtain consent.

You may find the ICO’s guidance useful, as for legitimate interest to be viable, ‘soft opt-ins’ must have previously been obtained. A soft opt-in means that a customer has bought or discussed a product or service with you, and you have always provided a means for them to opt-out of communications.

As with any direct marketing, you should inform the customer of their rights. Within your privacy policy, you should make them aware of the lawful bases you use to process data and inform them that they can opt-out of receiving direct marketing communications from you at any time.Personal data

To cope with the demands of the GDPR, we have developed our system with a ‘planning for the worst and hoping for the best’ approach. In light of the news, we’re delighted that we have covered all bases, as it means our customers can determine their own approach to the GDPR.

For each person you directly market to, but with whom you do not have signed terms of engagement, you must have recorded GDPR-adequate consent. We advise you put together a mass email now to convert as much of your database as possible.

This way, if ‘mrs adams’ asks why she’s receiving a list of properties from you, you can say: ‘because on X date you consented to hear from us, and here’s a copy of the email’.Direct marketing

If you are marketing services to someone who has recently transacted with you for a similar service or product, who was also given the chance to opt out but did not, then they fall under the soft opt-in exception and you can continue to direct market to them.

We have even had subscribers ask us if they can still send out christmas cards. You can, and in general you can still mail out marketing letters too.

– but where you have an existing client relationship there is an exception which allows you to send out e-mail marketing on an opt-out basis.

The GDPR is designed to give people more control over their personal data, whilst also ensuring that businesses across the EU benefit from a level playing field.Personal data

Although estate and letting agents may have a legitimate interest to use personal data for direct marketing, this can’t override the obligation to have recipients’ consent for any electronic direct marketing (unless it is to an existing customer who has not objected to receiving it).

It is therefore always advisable to seek consent, which under GDPR must be a freely given, specific, informed and unambiguous indication of the individual’s wishes. There must be some form of clear affirmative action – or in other words, a positive opt-in – consent cannot be inferred from silence, pre-ticked boxes or inactivity.

When seeking consent you should be clear about the purposes for which the personal data will be used (normally done through the privacy notice).Angels media in addition to the general right to withdraw consent, you should also inform individuals of their right to object, at any time, to the processing of their personal data for directing marketing (and this should be brought to their attention at least at the time of the first communication with them).

For direct marketing to identifiable individuals, you have to be able to show that you have a lawful basis for processing this information and that specific consent has been given for you to do this.

– if individuals submit their own contact information you need a clear and prominent privacy notice so the individual can understand at that point exactly what you are proposing to send them.Direct marketing GDPR will change what ‘consent’ means, as pre-ticked opt-in boxes, opt-out boxes, or any other ‘consent by default’ methods will no longer be valid.

– you must you get valid consent and be able to demonstrate it by keeping records. A consent to be emailed is not automatically a consent to be phoned or texted or recorded. Each must be separately identified.

A ‘soft opt-in’ is allowed as ‘consent’ for previous and existing customers, but this is limited to promoting your own service that is similar to the one they previously purchased – and you must give a way to opt out.

Avoid using consent when you have another legitimate method of processing data (for example an existing customer you wish to invoice) as consent can be withdrawn at any time.Angels media

Angels media ltd encourages you to seek additional guidance, including professional legal advice, to ensure that all of your business operations are ready for the GDPR.

We would like to stress that there is no substitute for making your own detailed investigations or seeking your own legal advice if you are unsure about the implications of the GDPR on your businesses.

While we have made every effort to ensure that the information covered here is correct and up to date, we angels media ltd makes no promises as to completeness or accuracy and the information is delivered on an “as is” basis without any warranties, express or implied.

Angels media ltd will not accept any liability for errors or omissions and will not be liable for any damage (including, without limitation, damage for loss of business or loss of profits) arising in contract, tort or otherwise from the use of or reliance on this information or from any action or decisions taken as a result of using this information.Direct marketing

banner