I have a lead form in my website (A website about High-End Fashion) in which visitors can contact a sales representative about product A. There is no opt-in checkbox, just a couple of text fields (phone number, e-mail etc...) and I received several thousands of submissions from customers in the UK. The form's purpose is to schedule an appointment.

I want to send these leads a marketing mail of product B. It's a different product from the same brand and I know it's relevant to those leads - But, it's a completely different product category.

Currently, I do not have a privacy policy in my website.

  1. Can I legally send such e-mails?
  2. What kind of privacy policy do I need in my website for this to be legal?
  • You should also study the T&C's of which ever service you use to send the marketing emails from. If you sent me one of these emails I would inspect the email headers and file an abuse report. I get accounts banned regularly and it's better for you to disclose your intentions in advance and let people opt in if they're still interested - this group is far more likely to convert to a sale too. Nov 20 '17 at 13:46

across the EU there is a concept that allows you to send emails to a list without their permission, but that's still based on prior permission.

It's known as 'soft opt-in'. It applies if the following conditions are met;

  • where you've obtained a person's details in the course of a sale or negotiations for a sale of a product or service;
  • where the messages are only marketing similar products or services; and
  • where the person is given a simple opportunity to refuse marketing when their details are collected, and if they don't opt out at this point, are given a simple way to do so in future messages.

Though you seem to have two problems imo: you don't actually have their consent email them (which is a different purpose), nor have you ever shown them a privacy notice. Therefore theoretically you'd need to create new consent.

I think you might be interested in reading these two guides by the UK authority, the ICO:

which will go into detail about the requirements for successfully navigating the waters of compliance.

Regarding your second question - what kind of privacy policy you need - that privacy policy will need to follow the minimum standards of EU/UK law and case law and include the data processing practices, along with the information about direct marketing being done by you.

P.S. I've written a bit about the topic on my company blog here, which might also give you some desired insights.


You are collecting personal data from users to send them promotional emails.

You can send those emails as long as you have a proper disclosure to users that they may receive promotional emails and you have a Privacy Policy where you disclose what kind of personal data you collect, what are you going to do with that data and how users can opt-out from your emails.

In summary:

  • Depending on your jurisdiction, read about CAN-SPAM in the USA, the new GDPR in the EU and the DPA in the UK.
  • Research how to draft a more prominent disclosure of your data collection in your lead generation forms. Clickwrap method (without or without the ‘I agree’ checkbox) is a good start.
  • Draft a Privacy Policy where you disclose:
    • What information you collect from users.
    • What will you do with the collected personal information.
    • With whom you share the collected personal information, i.e. with third-parties
    • How users can unsubscribe from your promotional emails.
  • Place links to your Privacy Policy on your lead generation page
  • Place unsubscribe links in your emails

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.