1. Purpose test
What is the purpose of the processing?
SPL Consulting Limited has a legitimate interest in processing the personal data of decision-makers and budget holders in medium-to-large UK organisations. We use this data for business-to-business (B2B) direct marketing of our consultancy services. This is a lawful business objective, as recognised by Recital 47 of the GDPR and the Privacy and Electronic Communications Regulations (PECR). Our marketing is designed to inform businesses about our services and generate new business relationships.
2. Necessity test
Is the processing necessary for this purpose?
Yes. The processing of this data is necessary to achieve our B2B marketing objectives. Without the ability to contact individuals in relevant professional roles, we would be unable to inform potential clients about our services. The processing is proportionate to our goal, and there is no less intrusive way to achieve this purpose.
- Data Sourcing: The data is gathered from publicly available sources (such as company websites and business directories) or from direct, professional interactions with the companies concerned.
- Data Types: The data is limited to names, job titles, company addresses, business phone numbers, and corporate email addresses. We do not process any personal data beyond what is required for our legitimate purpose.
3. Balancing test
Do the individual’s interests override our legitimate interests?
We have carefully balanced our business interests against the rights and freedoms of the individuals whose data we process. We have concluded that our interests do not override theirs for the following reasons:
- Reasonable Expectation: The individuals are business professionals (decision-makers and budget holders) who can reasonably expect to be contacted with marketing materials relevant to their professional roles. The marketing is not directed at them in a personal capacity.
- Minimal Privacy Impact: The data we collect is limited to professional contact details and does not include any sensitive or private information. The privacy impact is minimal and in line with reasonable expectations for a business professional.
- Transparency and Control:
- Transparency: We have updated our Privacy Notice to inform individuals that we rely on legitimate interests for this processing.
- Control: We provide a clear and easy way for individuals to opt-out of our marketing at any time. If a data subject requests removal, their data is suppressed from all future communications.
- Data Retention: We only retain the data for three years or until an opt-out request is made. If we are notified that an individual has left their role, their data is deleted.
4. Conclusion
Having completed the three-part test, SPL Consulting Limited has a clear and demonstrable legitimate interest in processing the personal data of business professionals for B2B direct marketing. The processing is necessary for our business, and our interests are not outweighed by the rights or freedoms of the data subjects, particularly given the low privacy risk and the controls we offer.
