Cold outreach & GDPR — compliant B2B prospecting in Germany
This page summarizes how Amplifa runs cold B2B outreach in Germany in a GDPR-compliant way: legal basis, opt-out, data sourcing, retention and audit trail. It is not legal advice — for binding guidance, consult your data protection officer.
Legal basis for B2B cold outreach in Germany
- Legitimate interest (Art. 6(1)(f) GDPR). Sales outreach to business decision-makers in your ICP can rely on legitimate interest when documented and balanced against the recipient's rights.
- UWG § 7. Unsolicited advertising via electronic means generally requires prior consent, with narrow exceptions for B2B contexts where the recipient's interest can be presumed.
- Transparency. Every message must clearly identify the sender, contain a meaningful subject and an unambiguous opt-out.
What Amplifa does by default
- Hosts and processes all data in Germany; no US cloud for personal data.
- Documents legitimate interest per campaign and per data source.
- Adds a one-click opt-out to every email sequence and honors it across all campaigns.
- Honors objections (Art. 21 GDPR) immediately and platform-wide.
- Retains data only as long as needed for the documented purpose.
The legitimate-interest balancing test in practice
For every cold-outreach campaign, Amplifa documents a written balancing test per Art. 6 (1) (f) GDPR. The structure is:
- Purpose. The concrete commercial purpose of the campaign (e.g. "introduce our AI sales platform to VP-Sales in DACH mechanical engineering, 50–2,000 employees").
- Necessity. Why direct contact via business email/LinkedIn is the appropriate means and why less intrusive alternatives (paid ads, events, inbound) do not achieve the same result for the defined ICP.
- Recipient's reasonable expectation. Business decision-makers in the defined role and segment can reasonably expect to receive relevant B2B offers via their work email — provided the message is clearly identified, relevant and contains a one-click opt-out.
- Balancing. The recipient's right to data protection is weighed against the sender's legitimate interest; safeguards (frequency cap, opt-out, no special-category data, EU hosting) tip the balance toward legitimacy.
- Result. Documented decision that legitimate interest applies, with the date, the responsible person and a renewal date.
UWG § 7 — what the B2B exception actually means
§ 7 UWG generally requires prior consent for electronic advertising. The B2B context allows a presumed-interest exception when all of the following apply:
- The recipient is contacted in their professional role, at a work email address.
- The offer is plausibly relevant to the recipient's professional responsibilities.
- The message identifies the sender clearly (name, company, address, contact).
- The message contains a low-friction objection mechanism (opt-out link).
- The contact frequency stays proportionate (no daily mass-mailing of the same recipient).
Data sourcing — what Amplifa uses and what it does not
- Public business directories. Company websites, LinkedIn business profiles, public press releases, public job posts and association directories.
- Public registry data. Commercial register (Handelsregister) entries, public corporate filings, public funding announcements.
- Verified business email patterns. Domain-level email patterns verified via SMTP for deliverability; no scraping of private inboxes.
- What Amplifa does not use. No purchased B2C lists, no scraped private contact details, no special-category data (Art. 9 GDPR), no data from sources without a legitimate legal basis.
Retention & opt-out — the operational defaults
- Active campaign data. Retained for the duration of the campaign plus 12 months for reply-history continuity.
- Opt-outs. Stored indefinitely as a suppression list — to ensure the recipient is never contacted again.
- Bounces & hard rejections. Stored as a suppression list to protect deliverability.
- Art. 21 objections. Honored immediately and platform-wide. The objection is documented with timestamp and the responsible processor.
- Audit trail. Every send, reply, bounce and opt-out is logged with timestamp, IP and message ID.
The Amplifa opt-out flow
- Every email contains a one-click unsubscribe link in the footer and (for compatible clients) a list-unsubscribe header per RFC 8058.
- One click removes the recipient from all current and future Amplifa campaigns across the entire tenant — not just the campaign that triggered it.
- Confirmation page states clearly which data was suppressed and how to contact the data protection officer for further rights (access, deletion, portability per Art. 15–20 GDPR).
- LinkedIn outreach respects "not interested" replies and connection withdrawals the same way: the contact is suppressed across the tenant.
Roles, responsibilities & contracts
- Controller. The Amplifa customer is the controller for outreach to their ICP; they define purpose, ICP and message.
- Processor. amplifa GmbH acts as processor under a Data Processing Agreement (DPA) per Art. 28 GDPR. Standard DPA is available on request.
- Sub-processors. A current sub-processor list is maintained and updated; changes are notified in advance.
- International transfers. No transfer of personal data outside the EEA for the standard product. Where unavoidable (e.g. specific enrichment partners), Standard Contractual Clauses (SCCs) plus a Transfer Impact Assessment (TIA) apply.
Documentation a typical Amplifa customer keeps
- Signed DPA between customer (controller) and amplifa GmbH (processor).
- Records of processing activities (RoPA) per Art. 30 GDPR — Amplifa ships a template.
- Written legitimate-interest balancing test per campaign.
- ICP definition with personas and segments.
- Sub-processor list and notification log.
- Opt-out and Art. 21 objection log (auto-generated by Amplifa).
Frequently asked questions
Is cold email allowed in Germany under GDPR?
Cold B2B email in Germany is regulated by GDPR and the UWG. It is permissible under strict conditions: legitimate interest must be documented, the recipient must be a relevant business contact, the message must be clearly identifiable and contain an opt-out, and personal data must be processed lawfully. Amplifa's workflows are designed to meet these conditions.
What about cold LinkedIn outreach?
Cold LinkedIn messages are governed by LinkedIn's terms of service rather than direct GDPR enforcement, but personal data handling still applies. Personalized 1:1 outreach to business contacts in your ICP is widely accepted; bulk unsolicited automation is not.
What documentation should we keep?
For every cold outreach campaign: documented legitimate interest, ICP definition, data source, retention policy, opt-out mechanism, and a record of consent or objection per contact. Amplifa stores these per campaign by default.